Edit tour

Windows Analysis Report
6qqWn6eIGG.dll

Overview

General Information

Sample name:	6qqWn6eIGG.dll renamed because original name is a hash value
Original sample name:	430599e85618bd750b5bbfb21cb5f857.dll
Analysis ID:	1591270
MD5:	430599e85618bd750b5bbfb21cb5f857
SHA1:	c9ff0c824d324d6047a31eb07da54ba43a0a8b86
SHA256:	ec2a990e5ceea72eec6128d38e8debedffbe6cac244f7ee5e5e3d58e2ad0b202
Tags:	dllexeuser-mentality
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Wannacry ransomware

AI detected suspicious sample

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5028 cmdline: loaddll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3168 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 5980 cmdline: rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4396 cmdline: rundll32.exe C:\Users\user\Desktop\6qqWn6eIGG.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvr.exe (PID: 4832 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 03E8741684A2EA2AA24BAD8DA574435E)

tasksche.exe (PID: 5988 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 1FF321DE9E6B8A865048789E18BB4232)

rundll32.exe (PID: 6128 cmdline: rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvr.exe (PID: 3176 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 03E8741684A2EA2AA24BAD8DA574435E)

tasksche.exe (PID: 5640 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 1FF321DE9E6B8A865048789E18BB4232)

mssecsvr.exe (PID: 1172 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 03E8741684A2EA2AA24BAD8DA574435E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
6qqWn6eIGG.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6qqWn6eIGG.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x353d0:$x3: tasksche.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.2140985093.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.2117428894.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2769349749.0000000002282000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.2127384895.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.2097891962.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2769091093.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 4832	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 1172	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 3176	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.mssecsvr.exe.1d50084.5.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.22738c8.9.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.22738c8.9.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.22738c8.9.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.22738c8.9.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.2282948.6.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.2282948.6.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x222ec:$x3: tasksche.exe 0x222c4:$x8: C:\%s\qeriuwjhrf 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$
7.2.mssecsvr.exe.2282948.6.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.1d5f104.4.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d5f104.4.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x222ec:$x3: tasksche.exe 0x222c4:$x8: C:\%s\qeriuwjhrf 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$
7.2.mssecsvr.exe.1d5f104.4.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.1d50084.5.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d50084.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.1d50084.5.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
9.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
9.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.1d5f104.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d5f104.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x1daec:$x3: tasksche.exe 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x50b9d4:$s1: C:\%s\%s 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$
9.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
9.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.1d5b0a4.3.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d5b0a4.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2634c:$x3: tasksche.exe 0x26324:$x8: C:\%s\qeriuwjhrf 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$
7.2.mssecsvr.exe.227e8e8.8.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.227e8e8.8.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2634c:$x3: tasksche.exe 0x26324:$x8: C:\%s\qeriuwjhrf 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$
7.2.mssecsvr.exe.2282948.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.2282948.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x1daec:$x3: tasksche.exe 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$
Click to see the 35 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T21:03:31.891094+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	103.224.212.215	80	TCP
2025-01-14T21:03:33.492425+0100	2803304	3	Unknown Traffic	192.168.2.5	49706	103.224.212.215	80	TCP
2025-01-14T21:05:39.497573+0100	2803304	3	Unknown Traffic	192.168.2.5	50614	103.224.212.215	80	TCP

ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T21:03:30.986998+0100	2830018	1	A Network Trojan was detected	192.168.2.5	57178	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6qqWn6eIGG.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef051d	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef05	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b6d	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e72	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0705-398f-94c8-f5d240e73af9	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\tasksche.exe

Avira: detection malicious, Label: TR/Rasftuby.cpsmo

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 96%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 96%

Multi AV Scanner detection for submitted file

Source: 6qqWn6eIGG.dll	Virustotal: Detection: 94%			Perma Link
Source: 6qqWn6eIGG.dll	ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.7% probability

Machine Learning detection for sample

Source: 6qqWn6eIGG.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: 6qqWn6eIGG.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source:

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: tasksche.exe, 0000000A.00000000.2130160027.000000000042A000.00000002.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmp, tasksche.exe, 0000000B.00000000.2140206636.000000000042A000.00000002.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000B.00000002.3363264138.000000000042A000.00000002.00000001.01000000.00000007.sdmp, 6qqWn6eIGG.dll, tasksche.exe.5.dr

Source: C:\Windows\tasksche.exe	Code function: 10_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		10_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		10_2_0040DE5E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2830018 - Severity 1 - ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) : 192.168.2.5:57178 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0703-312f-890a-41fa0d8d0e72 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0703-3312-aefe-653e09ef051d HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736885011.1575354
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0703-347d-85b7-a8856e518b6d HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=a95eefa5-1fa4-4707-a8db-f9d18c124d8c
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0705-398f-94c8-f5d240e73af9 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49706 -> 103.224.212.215:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 103.224.212.215:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:50614 -> 103.224.212.215:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.162
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 135.71.100.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.156
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.156
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.156
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.156
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 162.139.80.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.93
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.93
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.93
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.93
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 133.222.94.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.69
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.69
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.69
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.69
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.1
Source: unknown	TCP traffic detected without corresponding DNS query: 185.24.227.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0703-312f-890a-41fa0d8d0e72 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0703-3312-aefe-653e09ef051d HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736885011.1575354
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0703-347d-85b7-a8856e518b6d HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=a95eefa5-1fa4-4707-a8db-f9d18c124d8c
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0705-398f-94c8-f5d240e73af9 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: global traffic	DNS traffic detected: DNS query: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: mssecsvr.exe, 00000007.00000002.2768575914.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000005.00000002.2132344584.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000002.2132344584.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e
Source: mssecsvr.exe, 00000007.00000002.2768575914.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef05
Source: mssecsvr.exe, 00000009.00000002.2141807571.0000000000CED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b
Source: 6qqWn6eIGG.dll	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000009.00000002.2141807571.0000000000CED000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2141807571.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000005.00000002.2132344584.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/3
Source: mssecsvr.exe, 00000009.00000002.2141807571.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?
Source: mssecsvr.exe, 00000009.00000003.2139375248.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/H
Source: mssecsvr.exe, 00000007.00000002.2768575914.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/VGV
Source: mssecsvr.exe, 00000007.00000002.2768575914.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/oGV?
Source: mssecsvr.exe, 00000009.00000002.2141807571.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/w
Source: mssecsvr.exe, 00000007.00000002.2767315794.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: 6qqWn6eIGG.dll, type: SAMPLE
Source: Yara match	File source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d5f104.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d50084.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d5f104.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d5b0a4.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.227e8e8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2140985093.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2117428894.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2769349749.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2127384895.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2097891962.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2769091093.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 4832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 1172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 3176, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 6qqWn6eIGG.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d50084.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.22738c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d5f104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d5f104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d50084.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d50084.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d5f104.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d5b0a4.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.227e8e8.8.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

10_2_0040690A

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\tasksche.exe	File created: C:\Windows\__tmp_rar_sfx_access_check_6784656	Jump to behavior
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to behavior
Source: C:\Windows\tasksche.exe	File created: C:\Windows\__tmp_rar_sfx_access_check_6785484	Jump to behavior
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to behavior

Source: C:\Windows\tasksche.exe

File deleted: C:\Windows\__tmp_rar_sfx_access_check_6784656

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 10_2_00402F2C	10_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041B0D9	10_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041B8B9	10_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 10_2_00414946	10_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 10_2_00410178	10_2_00410178
Source: C:\Windows\tasksche.exe	Code function: 10_2_00404986	10_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 10_2_00429241	10_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 10_2_0042727C	10_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040CB23	10_2_0040CB23
Source: C:\Windows\tasksche.exe	Code function: 10_2_004283FC	10_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041AC04	10_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 10_2_00416C3F	10_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 10_2_00401CC1	10_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041F4D4	10_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041BCD9	10_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040C4FF	10_2_0040C4FF
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041B4AD	10_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 10_2_00417D78	10_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 10_2_00427D04	10_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041450F	10_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 10_2_00415D9A	10_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 10_2_00405610	10_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041462B	10_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 10_2_00413EE3	10_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 10_2_004106F4	10_2_004106F4
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040C756	10_2_0040C756
Source: C:\Windows\tasksche.exe	Code function: 10_2_004277C0	10_2_004277C0

Source: Joe Sandbox View

Dropped File: C:\Windows\eee.exe 95EF1D077176B0DE86FB8BA7BF2AE56A08BF7944B05424A2F6E013ACDF5FD684

Source: C:\Windows\tasksche.exe	Code function: String function: 0041AAF0 appears 49 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041A4DC appears 37 times
Source: C:\Windows\tasksche.exe	Code function: String function: 0041FA9C appears 38 times

Source: eee.exe.10.dr

Static PE information: No import functions for PE file found

Source: 6qqWn6eIGG.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 6qqWn6eIGG.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d50084.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.22738c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d5f104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d5f104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d50084.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d50084.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d5f104.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d5b0a4.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.227e8e8.8.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@20/3@2/100

Source: C:\Windows\tasksche.exe

Code function: 10_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

10_2_00406553

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		5_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		7_2_00407C40

Source: C:\Windows\tasksche.exe

Code function: 10_2_00419BB0 CoCreateInstance,

10_2_00419BB0

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle,

5_2_00407CE0

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\mssecsvr.exe	Code function: 5_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		5_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 7_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		7_2_00408090

Source: C:\Windows\tasksche.exe

File created: C:\Users\user\New folder

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03

Source: C:\Windows\tasksche.exe	Command line argument: sfxname	10_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: sfxstime	10_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: STARTDLG	10_2_0040FEF0
Source: C:\Windows\tasksche.exe	Command line argument: @CB	10_2_00424290

Source: 6qqWn6eIGG.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\tasksche.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6qqWn6eIGG.dll,PlayGame

Source: 6qqWn6eIGG.dll	Virustotal: Detection: 94%
Source: 6qqWn6eIGG.dll	ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6qqWn6eIGG.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\6qqWn6eIGG.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK
Source: C:\Windows\tasksche.exe	Automated click: OK

Source: C:\Windows\tasksche.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 6qqWn6eIGG.dll

Static file information: File size 5267459 > 1048576

Source: 6qqWn6eIGG.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0040CEB6

Source: C:\Windows\tasksche.exe

File created: C:\Windows\__tmp_rar_sfx_access_check_6784656

Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 10_2_0041FAE1 push ecx; ret		10_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041A4DC push eax; ret		10_2_0041A4FA

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\tasksche.exe	File created: C:\Windows\eee.exe	Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\tasksche.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\tasksche.exe

Dropped PE file which has not been started: C:\Windows\eee.exe

Jump to dropped file

Source: C:\Windows\tasksche.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_10-19475

Source: C:\Windows\mssecsvr.exe TID: 5428	Thread sleep count: 93 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5428	Thread sleep time: -186000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6600	Thread sleep count: 129 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6600	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5428	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\tasksche.exe	Code function: 10_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		10_2_00409476
Source: C:\Windows\tasksche.exe	Code function: 10_2_0040DE5E SendDlgItemMessageW,DestroyIcon,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SHGetFileInfoW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		10_2_0040DE5E

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvr.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oy'
Source: tasksche.exe, 0000000B.00000002.3365130022.0000000006B40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mssecsvr.exe, 00000005.00000002.2132344584.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@8
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: mssecsvr.exe, 00000005.00000002.2132344584.0000000000A6A000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2768575914.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2141807571.0000000000D1B000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2141807571.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mssecsvr.exe, 00000007.00000002.2768575914.0000000000BF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHy
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ya
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y"
Source: tasksche.exe, 0000000A.00000002.3363541837.000000000051C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\.7#m
Source: tasksche.exe, 0000000B.00000003.2548672865.0000000006B4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:z
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: tasksche.exe, 0000000B.00000003.2548720488.000000000059E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@@
Source: tasksche.exe, 0000000A.00000002.3363541837.000000000051C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+4&l
Source: tasksche.exe, 0000000A.00000003.2325295815.000000000058D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c
Source: tasksche.exe, 0000000B.00000003.2745700948.0000000006B64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: tasksche.exe, 0000000B.00000002.3365167883.0000000006B54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 0000000B.00000002.3363501701.000000000054D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: tasksche.exe, 0000000B.00000003.2745700948.0000000006B64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: tasksche.exe, 0000000A.00000003.2325295815.000000000058D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Pro
Source: tasksche.exe, 0000000A.00000002.3363541837.000000000058D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0uWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevice
Source: tasksche.exe, 0000000A.00000003.2325295815.000000000058D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0uWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevice3
Source: tasksche.exe, 0000000A.00000002.3363541837.000000000051C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\tasksche.exe

Code function: 10_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

10_2_0041E6DE

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040CEB6 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0040CEB6

Source: C:\Windows\tasksche.exe	Code function: 10_2_004234CE SetUnhandledExceptionFilter,	10_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 10_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 10_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	10_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1

Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040CA52 cpuid

10_2_0040CA52

Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		10_2_0040D155
Source: C:\Windows\tasksche.exe	Code function: GetLocaleInfoA,		10_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 10_2_0040FEF0 OleInitialize,_memset,GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,LoadBitmapW,DialogBoxParamW,DeleteObject,DeleteObject,DeleteObject,CloseHandle,Sleep,OleUninitialize,

10_2_0040FEF0

Source: C:\Windows\tasksche.exe

Code function: 10_2_00409C06 GetVersionExW,

10_2_00409C06

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	4 Windows Service	1 Access Token Manipulation	121 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	4 Windows Service	21 Virtualization/Sandbox Evasion	LSASS Memory	1 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	11 Process Injection	1 Access Token Manipulation	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rundll32	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6qqWn6eIGG.dll	94%	Virustotal		Browse
6qqWn6eIGG.dll	92%	ReversingLabs	Win32.Ransomware.WannaCry
6qqWn6eIGG.dll	100%	Avira	TR/AD.DPulsarShellcode.uvbfu
6qqWn6eIGG.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tasksche.exe	100%	Avira	TR/Rasftuby.cpsmo
C:\WINDOWS\qeriuwjhrf (copy)	97%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\eee.exe	10%	ReversingLabs
C:\Windows\tasksche.exe	97%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef051d	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef05	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b6d	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	Avira URL Cloud	safe
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e72	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0705-398f-94c8-f5d240e73af9	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
77026.bodis.com	199.59.243.228	true	false	high
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	103.224.212.215	true	false	high
ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e72	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef051d	false	Avira URL Cloud: malware	unknown
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b6d	false	Avira URL Cloud: malware	unknown
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0705-398f-94c8-f5d240e73af9	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e	mssecsvr.exe, 00000005.00000002.2132344584.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000002.2132344584.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/H	mssecsvr.exe, 00000009.00000003.2139375248.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/VGV	mssecsvr.exe, 00000007.00000002.2768575914.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvr.exe, 00000007.00000002.2768575914.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	6qqWn6eIGG.dll	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b	mssecsvr.exe, 00000009.00000002.2141807571.0000000000CED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?	mssecsvr.exe, 00000009.00000002.2141807571.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef05	mssecsvr.exe, 00000007.00000002.2768575914.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000007.00000002.2767315794.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/oGV?	mssecsvr.exe, 00000007.00000002.2768575914.0000000000C1B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/w	mssecsvr.exe, 00000009.00000002.2141807571.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/3	mssecsvr.exe, 00000005.00000002.2132344584.0000000000A4F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
128.29.176.167	unknown	United States	5691	MITRE-AS-5US	false
114.118.212.192	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
131.113.135.1	unknown	Japan	38635	KEIO-NETKeioUniversityJP	false
131.113.135.2	unknown	Japan	38635	KEIO-NETKeioUniversityJP	false
96.109.54.1	unknown	United States	7922	COMCAST-7922US	false
76.35.66.204	unknown	United States	18494	CENTURYLINK-LEGACY-EMBARQ-WRBGUS	false
133.222.94.93	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
2.240.171.1	unknown	Germany	6805	TDDE-ASN1DE	false
2.240.171.2	unknown	Germany	6805	TDDE-ASN1DE	false
92.187.212.1	unknown	France	12479	UNI2-ASES	false
207.58.177.56	unknown	United States	30633	LEASEWEB-USA-WDCUS	false
135.71.100.1	unknown	United States	18676	AVAYAUS	false
135.71.100.2	unknown	United States	18676	AVAYAUS	false
94.64.50.1	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
28.125.169.1	unknown	United States	7922	COMCAST-7922US	false
172.73.100.23	unknown	United States	11426	TWC-11426-CAROLINASUS	false
131.217.163.173	unknown	Australia	7573	UTASTheUniversityofTasmaniaAU	false
35.61.65.8	unknown	United States	36375	UMICH-AS-5US	false
42.129.113.223	unknown	China	4249	LILLY-ASUS	false
114.118.212.1	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
128.29.176.1	unknown	United States	5691	MITRE-AS-5US	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106
192.168.2.227
192.168.2.107

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591270
Start date and time:	2025-01-14 21:02:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6qqWn6eIGG.dll renamed because original name is a hash value
Original Sample Name:	430599e85618bd750b5bbfb21cb5f857.dll
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@20/3@2/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 75% Number of executed functions: 65 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 2.17.190.73, 13.107.253.45, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:03:32	API Interceptor	1x Sleep call for process: loaddll32.exe modified
15:04:07	API Interceptor	112x Sleep call for process: mssecsvr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
133.222.94.93	l1sADDB043.elf	Get hash	malicious	Mirai	Browse
133.222.94.93	XvYj8j1YWM	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77026.bodis.com	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	jgd5ZGl1vA.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	jgd5ZGl1vA.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	LisectAVT_2403002A_327.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	yrBA01LVo2.exe	Get hash	malicious	Wannacry	Browse	103.224.212.215
	lJt3mQqCQl.dll	Get hash	malicious	Wannacry	Browse	103.224.212.220
	xIwkOnjSIa.dll	Get hash	malicious	Wannacry	Browse	103.224.212.220
	IU28r0EZFA.dll	Get hash	malicious	Wannacry	Browse	103.224.212.220
	ViNIRfmQmE.dll	Get hash	malicious	Wannacry	Browse	103.224.212.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MITRE-AS-5US	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	129.83.88.111
	mips.elf	Get hash	malicious	Unknown	Browse	129.83.24.31
	yakuza.arm5.elf	Get hash	malicious	Unknown	Browse	129.83.131.0
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	128.29.188.87
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	129.83.231.164
	mirai.m68k.elf	Get hash	malicious	Mirai	Browse	128.29.160.223
	RDEHNTKF1V.elf	Get hash	malicious	Mirai, Moobot	Browse	129.83.143.191
	TsDTSDr8mU.elf	Get hash	malicious	Mirai	Browse	129.83.231.140
	IBkWoEFOlH.elf	Get hash	malicious	Mirai	Browse	128.29.133.159
	d0iDboIDfK.elf	Get hash	malicious	Mirai	Browse	66.170.237.34
KEIO-NETKeioUniversityJP	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	133.27.90.27
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	131.113.43.127
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	133.27.108.236
	m68k.elf	Get hash	malicious	Unknown	Browse	133.27.36.214
	elitebotnet.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	131.113.178.214
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	133.27.156.156
	i686.elf	Get hash	malicious	Unknown	Browse	131.113.81.202
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	131.113.50.136
	mips.elf	Get hash	malicious	Mirai	Browse	131.113.230.69
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	131.113.229.90
UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	https://imtcoken.im/	Get hash	malicious	Unknown	Browse	58.254.150.48
	http://www.toekan.im/	Get hash	malicious	Unknown	Browse	58.254.150.48
	https://wap.sunblock-pro.com/	Get hash	malicious	Unknown	Browse	58.254.150.48
	6.elf	Get hash	malicious	Unknown	Browse	157.255.17.238
	http://m.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	58.254.150.48
	https://www.xietaoz.com/	Get hash	malicious	Unknown	Browse	58.254.150.48
	http://wap.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	58.254.150.48
	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	58.254.150.48
	http://www.oinsurgente.com/	Get hash	malicious	Unknown	Browse	58.254.150.48
	1.elf	Get hash	malicious	Unknown	Browse	157.148.104.76

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Windows\eee.exe	xIwkOnjSIa.dll	Get hash	malicious	Wannacry	Browse
C:\Windows\eee.exe	r2gAjMU8hM.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.964411648365158
Encrypted:	false
SSDEEP:	49152:XE/bcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:X4oBhz1aRxcSUDk36SAEdhvm
MD5:	1FF321DE9E6B8A865048789E18BB4232
SHA1:	67A548CF33D086C224058AB30C631C04F5DAD29D
SHA-256:	EAD0300A439BE8EA26ABC28944D1D3EB3B111BA1B3CAD76B3B0F00B26DADD97A
SHA-512:	AB57E6BDCE2DD71C49AFFB8C093384E27D2CEC6B4165A0089617098AC30AB00715E0251CC5F96F5710A74215C9EB8804113C177DF7DEEF046D895AC733BBA0BC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 97%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\eee.exe

Download File

Process:	C:\Windows\tasksche.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1981503
Entropy (8bit):	0.38424875875863396
Encrypted:	false
SSDEEP:	768:2BBHFOA2zoXR5WrrTKMb5D1teJxkrc12hFoDTkN04ARNEMZQZlkayb6SoGC28jjO:23NiTmJurc+iCQNEMZUGakhcjcJdyVu
MD5:	1C25F6BB95D52132CEEE2ED6D4DA43D7
SHA1:	2BA8D778FCCC55CEEFCA6016A8BA89E6078571B3
SHA-256:	95EF1D077176B0DE86FB8BA7BF2AE56A08BF7944B05424A2F6E013ACDF5FD684
SHA-512:	BBCA81786BCB8F8DABD1A67D9EEC40D1431385A663EBD30813851905117FA7E67F6B130CBFDB094FED976CD4F22FEADC30E75EBFED0CF4F5C21D30182579D130
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 10%
Joe Sandbox View:	Filename: xIwkOnjSIa.dll, Detection: malicious, Browse Filename: r2gAjMU8hM.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..`_Z.`_Z.`_Z...Z.`_Z...Z1`_Z...Z.`_Z.>\[.`_Z.>[[.`_Z.>Z[.`_Z...Z.`_Z...Z.`_Z.`^Z@`_Z->Z[.`_Z->_[.`_Z(>.Z.`_Z->][.`_ZRich.`_Z........PE..L......Y..........................................@.......................... ............@.........................@...4...t...(........:......................X...Pn..T...............................@...................... ....................text............................... ..`.rdata..............................@..@.data...............................@....gfids..............................@..@.rsrc....F.......H..................@..@.reloc..X........ ..................@..B........................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.964411648365158
Encrypted:	false
SSDEEP:	49152:XE/bcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:X4oBhz1aRxcSUDk36SAEdhvm
MD5:	1FF321DE9E6B8A865048789E18BB4232
SHA1:	67A548CF33D086C224058AB30C631C04F5DAD29D
SHA-256:	EAD0300A439BE8EA26ABC28944D1D3EB3B111BA1B3CAD76B3B0F00B26DADD97A
SHA-512:	AB57E6BDCE2DD71C49AFFB8C093384E27D2CEC6B4165A0089617098AC30AB00715E0251CC5F96F5710A74215C9EB8804113C177DF7DEEF046D895AC733BBA0BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.289820386110604
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6qqWn6eIGG.dll
File size:	5'267'459 bytes
MD5:	430599e85618bd750b5bbfb21cb5f857
SHA1:	c9ff0c824d324d6047a31eb07da54ba43a0a8b86
SHA256:	ec2a990e5ceea72eec6128d38e8debedffbe6cac244f7ee5e5e3d58e2ad0b202
SHA512:	579734a994750f09d3cd6feb1d6e5f2793bce1eca37f65cb4fef50c0c908b18248e143a85cbf3d62bf5d0af1e5a4b48faa94dc3e92846e615215276b9322c1f7
SSDEEP:	49152:RnpE/bcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1p4oBhz1aRxcSUDk36SAEdhv
TLSH:	1336236530A8C0B4C107157444ABCA62F6B67C3917FA694FBF904E7E3E63B96E710B42
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F2D78DBC1BBh
cmp dword ptr [10003140h], 00000000h
jmp 00007F2D78DBC1D8h
cmp esi, 01h
je 00007F2D78DBC1B7h
cmp esi, 02h
jne 00007F2D78DBC1D4h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F2D78DBC1BBh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F2D78DBC1BEh
push edi
push esi
push ebx
call 00007F2D78DBC0CAh
test eax, eax
jne 00007F2D78DBC1B6h
xor eax, eax
jmp 00007F2D78DBC200h
push edi
push esi
push ebx
call 00007F2D78DBBF7Ch
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F2D78DBC1BEh
test eax, eax
jne 00007F2D78DBC1E9h
push edi
push eax
push ebx
call 00007F2D78DBC0A6h
test esi, esi
je 00007F2D78DBC1B7h
cmp esi, 03h
jne 00007F2D78DBC1D8h
push edi
push esi
push ebx
call 00007F2D78DBC095h
test eax, eax
jne 00007F2D78DBC1B5h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F2D78DBC1C3h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F2D78DBC1BAh
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	9b27c3f254416f775f5a51102ef8fb84	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	4adff6979da8c24fa58ccf4a4a347623	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.8180646896362305

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T21:03:30.986998+0100	2830018	ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	1	192.168.2.5	57178	1.1.1.1	53	UDP
2025-01-14T21:03:31.891094+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	103.224.212.215	80	TCP
2025-01-14T21:03:33.492425+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	103.224.212.215	80	TCP
2025-01-14T21:05:39.497573+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	50614	103.224.212.215	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 21:03:26.013329029 CET	49674	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:26.013333082 CET	49675	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:26.138344049 CET	49673	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:31.298609972 CET	49704	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:31.304099083 CET	80	49704	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:31.304179907 CET	49704	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:31.304311037 CET	49704	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:31.309050083 CET	80	49704	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:31.891025066 CET	80	49704	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:31.891062021 CET	80	49704	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:31.891093969 CET	49704	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:31.891132116 CET	49704	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:31.894610882 CET	49704	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:31.899449110 CET	80	49704	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:32.297739029 CET	49705	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:32.302623034 CET	80	49705	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:32.302715063 CET	49705	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:32.302917004 CET	49705	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:32.307775021 CET	80	49705	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:32.756167889 CET	80	49705	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:32.756186008 CET	80	49705	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:32.756278992 CET	49705	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:32.760621071 CET	49705	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:32.760654926 CET	49705	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:32.878357887 CET	49706	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:32.883413076 CET	80	49706	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:32.883493900 CET	49706	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:32.883703947 CET	49706	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:32.888495922 CET	80	49706	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:33.492301941 CET	80	49706	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:33.492424965 CET	49706	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:33.492439032 CET	80	49706	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:33.492477894 CET	49706	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:33.495501995 CET	49706	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:33.500324011 CET	80	49706	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:33.502010107 CET	49707	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:33.506863117 CET	80	49707	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:33.506932974 CET	49707	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:33.507039070 CET	49707	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:33.511807919 CET	80	49707	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:33.894761086 CET	49708	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:33.899663925 CET	80	49708	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:33.899774075 CET	49708	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:33.899924040 CET	49708	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:33.904664993 CET	80	49708	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:33.970993996 CET	80	49707	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:33.971010923 CET	80	49707	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:33.971122980 CET	49707	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:33.977402925 CET	49707	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:33.977428913 CET	49707	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:34.020008087 CET	49709	445	192.168.2.5	135.71.100.162
Jan 14, 2025 21:03:34.024924040 CET	445	49709	135.71.100.162	192.168.2.5
Jan 14, 2025 21:03:34.024992943 CET	49709	445	192.168.2.5	135.71.100.162
Jan 14, 2025 21:03:34.026576996 CET	49709	445	192.168.2.5	135.71.100.162
Jan 14, 2025 21:03:34.026958942 CET	49710	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.031408072 CET	445	49709	135.71.100.162	192.168.2.5
Jan 14, 2025 21:03:34.031456947 CET	49709	445	192.168.2.5	135.71.100.162
Jan 14, 2025 21:03:34.031826019 CET	445	49710	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:34.031883001 CET	49710	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.031985044 CET	49710	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.036984921 CET	445	49710	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:34.037029028 CET	49710	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.038573980 CET	49711	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.043447018 CET	445	49711	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:34.043540955 CET	49711	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.043585062 CET	49711	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:34.048393965 CET	445	49711	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:34.504657984 CET	80	49708	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:34.504755020 CET	80	49708	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:34.504820108 CET	49708	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:34.507343054 CET	49708	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:03:34.509680986 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:34.512427092 CET	80	49708	103.224.212.215	192.168.2.5
Jan 14, 2025 21:03:34.514749050 CET	80	49721	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:34.514962912 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:34.515021086 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:34.519846916 CET	80	49721	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:34.988173008 CET	80	49721	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:34.988190889 CET	80	49721	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:34.988367081 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:34.998570919 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:34.999339104 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:35.003720999 CET	80	49721	199.59.243.228	192.168.2.5
Jan 14, 2025 21:03:35.003896952 CET	49721	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:03:35.622654915 CET	49675	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:35.622656107 CET	49674	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:35.747639894 CET	49673	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:36.014646053 CET	49735	445	192.168.2.5	162.139.80.156
Jan 14, 2025 21:03:36.019582987 CET	445	49735	162.139.80.156	192.168.2.5
Jan 14, 2025 21:03:36.019665003 CET	49735	445	192.168.2.5	162.139.80.156
Jan 14, 2025 21:03:36.019725084 CET	49735	445	192.168.2.5	162.139.80.156
Jan 14, 2025 21:03:36.020987034 CET	49736	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.025172949 CET	445	49735	162.139.80.156	192.168.2.5
Jan 14, 2025 21:03:36.025232077 CET	49735	445	192.168.2.5	162.139.80.156
Jan 14, 2025 21:03:36.025746107 CET	445	49736	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:36.026186943 CET	49736	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.026237965 CET	49736	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.027335882 CET	49737	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.031234980 CET	445	49736	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:36.031280041 CET	49736	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.032143116 CET	445	49737	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:36.032258034 CET	49737	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.032258034 CET	49737	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:36.037046909 CET	445	49737	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:37.385175943 CET	443	49703	23.1.237.91	192.168.2.5
Jan 14, 2025 21:03:37.385253906 CET	49703	443	192.168.2.5	23.1.237.91
Jan 14, 2025 21:03:38.030200005 CET	49760	445	192.168.2.5	133.222.94.93
Jan 14, 2025 21:03:38.035093069 CET	445	49760	133.222.94.93	192.168.2.5
Jan 14, 2025 21:03:38.035171986 CET	49760	445	192.168.2.5	133.222.94.93
Jan 14, 2025 21:03:38.035209894 CET	49760	445	192.168.2.5	133.222.94.93
Jan 14, 2025 21:03:38.035423994 CET	49761	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.040210009 CET	445	49760	133.222.94.93	192.168.2.5
Jan 14, 2025 21:03:38.040271044 CET	49760	445	192.168.2.5	133.222.94.93
Jan 14, 2025 21:03:38.040307045 CET	445	49761	133.222.94.1	192.168.2.5
Jan 14, 2025 21:03:38.040374994 CET	49761	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.040412903 CET	49761	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.041331053 CET	49762	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.045449018 CET	445	49761	133.222.94.1	192.168.2.5
Jan 14, 2025 21:03:38.045515060 CET	49761	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.046112061 CET	445	49762	133.222.94.1	192.168.2.5
Jan 14, 2025 21:03:38.046174049 CET	49762	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.046253920 CET	49762	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:38.051007032 CET	445	49762	133.222.94.1	192.168.2.5
Jan 14, 2025 21:03:40.046027899 CET	49784	445	192.168.2.5	185.24.227.69
Jan 14, 2025 21:03:40.050877094 CET	445	49784	185.24.227.69	192.168.2.5
Jan 14, 2025 21:03:40.050947905 CET	49784	445	192.168.2.5	185.24.227.69
Jan 14, 2025 21:03:40.051028013 CET	49784	445	192.168.2.5	185.24.227.69
Jan 14, 2025 21:03:40.051337004 CET	49785	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.056054115 CET	445	49784	185.24.227.69	192.168.2.5
Jan 14, 2025 21:03:40.056112051 CET	49784	445	192.168.2.5	185.24.227.69
Jan 14, 2025 21:03:40.056166887 CET	445	49785	185.24.227.1	192.168.2.5
Jan 14, 2025 21:03:40.056334019 CET	49785	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.056334019 CET	49785	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.058434963 CET	49786	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.061300039 CET	445	49785	185.24.227.1	192.168.2.5
Jan 14, 2025 21:03:40.063158989 CET	49785	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.063232899 CET	445	49786	185.24.227.1	192.168.2.5
Jan 14, 2025 21:03:40.063333035 CET	49786	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.063617945 CET	49786	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:03:40.068419933 CET	445	49786	185.24.227.1	192.168.2.5
Jan 14, 2025 21:03:42.279853106 CET	49808	445	192.168.2.5	2.240.171.60
Jan 14, 2025 21:03:42.284759998 CET	445	49808	2.240.171.60	192.168.2.5
Jan 14, 2025 21:03:42.284867048 CET	49808	445	192.168.2.5	2.240.171.60
Jan 14, 2025 21:03:42.284953117 CET	49808	445	192.168.2.5	2.240.171.60
Jan 14, 2025 21:03:42.285150051 CET	49810	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.289937019 CET	445	49808	2.240.171.60	192.168.2.5
Jan 14, 2025 21:03:42.289973974 CET	445	49810	2.240.171.1	192.168.2.5
Jan 14, 2025 21:03:42.290035963 CET	49808	445	192.168.2.5	2.240.171.60
Jan 14, 2025 21:03:42.290057898 CET	49810	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.290174007 CET	49810	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.291342974 CET	49811	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.295207977 CET	445	49810	2.240.171.1	192.168.2.5
Jan 14, 2025 21:03:42.295295954 CET	49810	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.296222925 CET	445	49811	2.240.171.1	192.168.2.5
Jan 14, 2025 21:03:42.296725988 CET	49811	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.296725988 CET	49811	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:03:42.301578045 CET	445	49811	2.240.171.1	192.168.2.5
Jan 14, 2025 21:03:44.233764887 CET	49839	445	192.168.2.5	160.40.25.54
Jan 14, 2025 21:03:44.238687038 CET	445	49839	160.40.25.54	192.168.2.5
Jan 14, 2025 21:03:44.238807917 CET	49839	445	192.168.2.5	160.40.25.54
Jan 14, 2025 21:03:44.238862038 CET	49839	445	192.168.2.5	160.40.25.54
Jan 14, 2025 21:03:44.239083052 CET	49840	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.243768930 CET	445	49839	160.40.25.54	192.168.2.5
Jan 14, 2025 21:03:44.243832111 CET	49839	445	192.168.2.5	160.40.25.54
Jan 14, 2025 21:03:44.243870020 CET	445	49840	160.40.25.1	192.168.2.5
Jan 14, 2025 21:03:44.243926048 CET	49840	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.243993044 CET	49840	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.245039940 CET	49842	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.249074936 CET	445	49840	160.40.25.1	192.168.2.5
Jan 14, 2025 21:03:44.249892950 CET	445	49842	160.40.25.1	192.168.2.5
Jan 14, 2025 21:03:44.249959946 CET	49840	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.249974012 CET	49842	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.250046968 CET	49842	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:03:44.254892111 CET	445	49842	160.40.25.1	192.168.2.5
Jan 14, 2025 21:03:46.248163939 CET	49878	445	192.168.2.5	76.35.66.204
Jan 14, 2025 21:03:46.253063917 CET	445	49878	76.35.66.204	192.168.2.5
Jan 14, 2025 21:03:46.253158092 CET	49878	445	192.168.2.5	76.35.66.204
Jan 14, 2025 21:03:46.253247023 CET	49878	445	192.168.2.5	76.35.66.204
Jan 14, 2025 21:03:46.253474951 CET	49879	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.258330107 CET	445	49878	76.35.66.204	192.168.2.5
Jan 14, 2025 21:03:46.258347034 CET	445	49879	76.35.66.1	192.168.2.5
Jan 14, 2025 21:03:46.258403063 CET	49878	445	192.168.2.5	76.35.66.204
Jan 14, 2025 21:03:46.258445978 CET	49879	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.258538961 CET	49879	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.259037018 CET	49880	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.263452053 CET	445	49879	76.35.66.1	192.168.2.5
Jan 14, 2025 21:03:46.263524055 CET	49879	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.263816118 CET	445	49880	76.35.66.1	192.168.2.5
Jan 14, 2025 21:03:46.263870955 CET	49880	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.263951063 CET	49880	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:03:46.268716097 CET	445	49880	76.35.66.1	192.168.2.5
Jan 14, 2025 21:03:48.263799906 CET	49913	445	192.168.2.5	131.113.135.72
Jan 14, 2025 21:03:48.268654108 CET	445	49913	131.113.135.72	192.168.2.5
Jan 14, 2025 21:03:48.268734932 CET	49913	445	192.168.2.5	131.113.135.72
Jan 14, 2025 21:03:48.268807888 CET	49913	445	192.168.2.5	131.113.135.72
Jan 14, 2025 21:03:48.269004107 CET	49914	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.273770094 CET	445	49913	131.113.135.72	192.168.2.5
Jan 14, 2025 21:03:48.273813963 CET	445	49914	131.113.135.1	192.168.2.5
Jan 14, 2025 21:03:48.273833036 CET	49913	445	192.168.2.5	131.113.135.72
Jan 14, 2025 21:03:48.273896933 CET	49914	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.273941040 CET	49914	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.274333000 CET	49915	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.278902054 CET	445	49914	131.113.135.1	192.168.2.5
Jan 14, 2025 21:03:48.278963089 CET	49914	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.279131889 CET	445	49915	131.113.135.1	192.168.2.5
Jan 14, 2025 21:03:48.279194117 CET	49915	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.279422998 CET	49915	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:03:48.284193039 CET	445	49915	131.113.135.1	192.168.2.5
Jan 14, 2025 21:03:50.271850109 CET	49948	445	192.168.2.5	35.61.65.8
Jan 14, 2025 21:03:50.277369976 CET	445	49948	35.61.65.8	192.168.2.5
Jan 14, 2025 21:03:50.277652025 CET	49948	445	192.168.2.5	35.61.65.8
Jan 14, 2025 21:03:50.277719975 CET	49948	445	192.168.2.5	35.61.65.8
Jan 14, 2025 21:03:50.277920008 CET	49950	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.283035040 CET	445	49948	35.61.65.8	192.168.2.5
Jan 14, 2025 21:03:50.283374071 CET	445	49950	35.61.65.1	192.168.2.5
Jan 14, 2025 21:03:50.283432007 CET	49948	445	192.168.2.5	35.61.65.8
Jan 14, 2025 21:03:50.283473015 CET	49950	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.287326097 CET	49950	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.287595034 CET	49951	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.293073893 CET	445	49950	35.61.65.1	192.168.2.5
Jan 14, 2025 21:03:50.294595003 CET	445	49951	35.61.65.1	192.168.2.5
Jan 14, 2025 21:03:50.294672012 CET	49950	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.294722080 CET	49951	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.303584099 CET	49951	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:03:50.308907986 CET	445	49951	35.61.65.1	192.168.2.5
Jan 14, 2025 21:03:52.279982090 CET	49985	445	192.168.2.5	114.118.212.192
Jan 14, 2025 21:03:52.284786940 CET	445	49985	114.118.212.192	192.168.2.5
Jan 14, 2025 21:03:52.284905910 CET	49985	445	192.168.2.5	114.118.212.192
Jan 14, 2025 21:03:52.285027981 CET	49985	445	192.168.2.5	114.118.212.192
Jan 14, 2025 21:03:52.285351992 CET	49986	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.289944887 CET	445	49985	114.118.212.192	192.168.2.5
Jan 14, 2025 21:03:52.290045023 CET	49985	445	192.168.2.5	114.118.212.192
Jan 14, 2025 21:03:52.290364981 CET	445	49986	114.118.212.1	192.168.2.5
Jan 14, 2025 21:03:52.290446997 CET	49986	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.290493965 CET	49986	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.290884972 CET	49987	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.295460939 CET	445	49986	114.118.212.1	192.168.2.5
Jan 14, 2025 21:03:52.295543909 CET	49986	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.295664072 CET	445	49987	114.118.212.1	192.168.2.5
Jan 14, 2025 21:03:52.295722008 CET	49987	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.295773983 CET	49987	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:03:52.300589085 CET	445	49987	114.118.212.1	192.168.2.5
Jan 14, 2025 21:03:54.295092106 CET	50016	445	192.168.2.5	28.125.169.77
Jan 14, 2025 21:03:54.300173998 CET	445	50016	28.125.169.77	192.168.2.5
Jan 14, 2025 21:03:54.300369978 CET	50016	445	192.168.2.5	28.125.169.77
Jan 14, 2025 21:03:54.300508976 CET	50016	445	192.168.2.5	28.125.169.77
Jan 14, 2025 21:03:54.300658941 CET	50017	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.305572033 CET	445	50016	28.125.169.77	192.168.2.5
Jan 14, 2025 21:03:54.305608034 CET	445	50017	28.125.169.1	192.168.2.5
Jan 14, 2025 21:03:54.305645943 CET	50016	445	192.168.2.5	28.125.169.77
Jan 14, 2025 21:03:54.305689096 CET	50017	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.305783033 CET	50017	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.306122065 CET	50018	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.310877085 CET	445	50017	28.125.169.1	192.168.2.5
Jan 14, 2025 21:03:54.310934067 CET	445	50018	28.125.169.1	192.168.2.5
Jan 14, 2025 21:03:54.310945034 CET	50017	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.311001062 CET	50018	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.311021090 CET	50018	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:03:54.315812111 CET	445	50018	28.125.169.1	192.168.2.5
Jan 14, 2025 21:03:55.424937010 CET	445	49711	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:55.427856922 CET	49711	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:55.427907944 CET	49711	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:55.427954912 CET	49711	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:55.432749987 CET	445	49711	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:55.432761908 CET	445	49711	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:56.318275928 CET	50054	445	192.168.2.5	94.64.50.15
Jan 14, 2025 21:03:56.323137045 CET	445	50054	94.64.50.15	192.168.2.5
Jan 14, 2025 21:03:56.323244095 CET	50054	445	192.168.2.5	94.64.50.15
Jan 14, 2025 21:03:56.325623989 CET	50054	445	192.168.2.5	94.64.50.15
Jan 14, 2025 21:03:56.327413082 CET	50055	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.330529928 CET	445	50054	94.64.50.15	192.168.2.5
Jan 14, 2025 21:03:56.330583096 CET	50054	445	192.168.2.5	94.64.50.15
Jan 14, 2025 21:03:56.332252026 CET	445	50055	94.64.50.1	192.168.2.5
Jan 14, 2025 21:03:56.332308054 CET	50055	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.332348108 CET	50055	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.332598925 CET	50057	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.337491035 CET	445	50055	94.64.50.1	192.168.2.5
Jan 14, 2025 21:03:56.337502956 CET	445	50057	94.64.50.1	192.168.2.5
Jan 14, 2025 21:03:56.337654114 CET	50055	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.337735891 CET	50057	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.337774992 CET	50057	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:03:56.342502117 CET	445	50057	94.64.50.1	192.168.2.5
Jan 14, 2025 21:03:57.393837929 CET	445	49737	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:57.393990040 CET	49737	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:57.393990040 CET	49737	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:57.394051075 CET	49737	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:03:57.398849010 CET	445	49737	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:57.398897886 CET	445	49737	162.139.80.1	192.168.2.5
Jan 14, 2025 21:03:58.326683998 CET	50091	445	192.168.2.5	179.12.193.116
Jan 14, 2025 21:03:58.331543922 CET	445	50091	179.12.193.116	192.168.2.5
Jan 14, 2025 21:03:58.332506895 CET	50091	445	192.168.2.5	179.12.193.116
Jan 14, 2025 21:03:58.332508087 CET	50091	445	192.168.2.5	179.12.193.116
Jan 14, 2025 21:03:58.332664967 CET	50092	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:03:58.337434053 CET	445	50092	179.12.193.1	192.168.2.5
Jan 14, 2025 21:03:58.337554932 CET	445	50091	179.12.193.116	192.168.2.5
Jan 14, 2025 21:03:58.337641001 CET	50091	445	192.168.2.5	179.12.193.116
Jan 14, 2025 21:03:58.337717056 CET	50092	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:03:58.337958097 CET	50093	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:03:58.342787981 CET	445	50092	179.12.193.1	192.168.2.5
Jan 14, 2025 21:03:58.342803001 CET	445	50093	179.12.193.1	192.168.2.5
Jan 14, 2025 21:03:58.342880964 CET	50092	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:03:58.342891932 CET	50093	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:03:58.342925072 CET	50093	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:03:58.347747087 CET	445	50093	179.12.193.1	192.168.2.5
Jan 14, 2025 21:03:58.435686111 CET	50098	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:58.440710068 CET	445	50098	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:58.442977905 CET	50098	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:58.443049908 CET	50098	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:03:58.448353052 CET	445	50098	135.71.100.1	192.168.2.5
Jan 14, 2025 21:03:59.393856049 CET	445	49762	133.222.94.1	192.168.2.5
Jan 14, 2025 21:03:59.393913031 CET	49762	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:59.393964052 CET	49762	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:59.394094944 CET	49762	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:03:59.398704052 CET	445	49762	133.222.94.1	192.168.2.5
Jan 14, 2025 21:03:59.398804903 CET	445	49762	133.222.94.1	192.168.2.5
Jan 14, 2025 21:04:00.341927052 CET	50117	445	192.168.2.5	42.129.113.223
Jan 14, 2025 21:04:00.404294968 CET	50118	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:04:01.274517059 CET	445	50117	42.129.113.223	192.168.2.5
Jan 14, 2025 21:04:01.274529934 CET	445	50118	162.139.80.1	192.168.2.5
Jan 14, 2025 21:04:01.274596930 CET	50117	445	192.168.2.5	42.129.113.223
Jan 14, 2025 21:04:01.274656057 CET	50118	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:04:01.274816990 CET	50118	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:04:01.274822950 CET	50117	445	192.168.2.5	42.129.113.223
Jan 14, 2025 21:04:01.275109053 CET	50119	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.285070896 CET	445	50118	162.139.80.1	192.168.2.5
Jan 14, 2025 21:04:01.285093069 CET	445	50119	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:01.285120010 CET	445	50117	42.129.113.223	192.168.2.5
Jan 14, 2025 21:04:01.285193920 CET	50117	445	192.168.2.5	42.129.113.223
Jan 14, 2025 21:04:01.285209894 CET	50119	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.285289049 CET	50119	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.287014961 CET	50120	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.294281006 CET	445	50119	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:01.294333935 CET	50119	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.296350002 CET	445	50120	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:01.296411991 CET	50120	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.296451092 CET	50120	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:01.301884890 CET	445	50120	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:01.426338911 CET	445	49786	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:01.426446915 CET	49786	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:01.436839104 CET	49786	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:01.436929941 CET	49786	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:01.441643953 CET	445	49786	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:01.441656113 CET	445	49786	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:02.357681036 CET	50126	445	192.168.2.5	146.94.210.4
Jan 14, 2025 21:04:02.363048077 CET	445	50126	146.94.210.4	192.168.2.5
Jan 14, 2025 21:04:02.363152981 CET	50126	445	192.168.2.5	146.94.210.4
Jan 14, 2025 21:04:02.363261938 CET	50126	445	192.168.2.5	146.94.210.4
Jan 14, 2025 21:04:02.363343000 CET	50127	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.368992090 CET	445	50126	146.94.210.4	192.168.2.5
Jan 14, 2025 21:04:02.369075060 CET	445	50127	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:02.369092941 CET	50126	445	192.168.2.5	146.94.210.4
Jan 14, 2025 21:04:02.369153976 CET	50127	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.369235039 CET	50127	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.369494915 CET	50128	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.375158072 CET	445	50127	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:02.375191927 CET	445	50128	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:02.375233889 CET	50127	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.375287056 CET	50128	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.375308037 CET	50128	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:02.380158901 CET	445	50128	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:02.404280901 CET	50129	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:04:02.409662962 CET	445	50129	133.222.94.1	192.168.2.5
Jan 14, 2025 21:04:02.409758091 CET	50129	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:04:02.409826994 CET	50129	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:04:02.415177107 CET	445	50129	133.222.94.1	192.168.2.5
Jan 14, 2025 21:04:03.660235882 CET	445	49811	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:03.660295010 CET	49811	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:03.660357952 CET	49811	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:03.660434008 CET	49811	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:03.665088892 CET	445	49811	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:03.665163994 CET	445	49811	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:04.381685019 CET	50143	445	192.168.2.5	165.250.181.187
Jan 14, 2025 21:04:04.386584044 CET	445	50143	165.250.181.187	192.168.2.5
Jan 14, 2025 21:04:04.386689901 CET	50143	445	192.168.2.5	165.250.181.187
Jan 14, 2025 21:04:04.386878014 CET	50143	445	192.168.2.5	165.250.181.187
Jan 14, 2025 21:04:04.387001038 CET	50144	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.391964912 CET	445	50144	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:04.391983032 CET	445	50143	165.250.181.187	192.168.2.5
Jan 14, 2025 21:04:04.392038107 CET	50144	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.392071962 CET	50143	445	192.168.2.5	165.250.181.187
Jan 14, 2025 21:04:04.393068075 CET	50144	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.393229961 CET	50145	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.397954941 CET	445	50144	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:04.398055077 CET	50144	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.398077965 CET	445	50145	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:04.398127079 CET	50145	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.400497913 CET	50145	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:04.405267954 CET	445	50145	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:04.452758074 CET	50147	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:04.459018946 CET	445	50147	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:04.459099054 CET	50147	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:04.459647894 CET	50147	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:04.465861082 CET	445	50147	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:05.634088993 CET	445	49842	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:05.634157896 CET	49842	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:05.634196997 CET	49842	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:05.634274006 CET	49842	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:05.639414072 CET	445	49842	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:05.639425993 CET	445	49842	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:06.389112949 CET	50159	445	192.168.2.5	194.41.210.252
Jan 14, 2025 21:04:06.393951893 CET	445	50159	194.41.210.252	192.168.2.5
Jan 14, 2025 21:04:06.396861076 CET	50159	445	192.168.2.5	194.41.210.252
Jan 14, 2025 21:04:06.396970987 CET	50159	445	192.168.2.5	194.41.210.252
Jan 14, 2025 21:04:06.397213936 CET	50160	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.401793003 CET	445	50159	194.41.210.252	192.168.2.5
Jan 14, 2025 21:04:06.401983976 CET	445	50160	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:06.402046919 CET	50159	445	192.168.2.5	194.41.210.252
Jan 14, 2025 21:04:06.402131081 CET	50160	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.402131081 CET	50160	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.402446985 CET	50161	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.407210112 CET	445	50161	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:06.407805920 CET	445	50160	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:06.407917976 CET	50160	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.407923937 CET	50161	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.407989979 CET	50161	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:06.412796974 CET	445	50161	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:06.670131922 CET	50165	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:06.674920082 CET	445	50165	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:06.675002098 CET	50165	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:06.675048113 CET	50165	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:06.679904938 CET	445	50165	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:07.633934021 CET	445	49880	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:07.634021997 CET	49880	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:07.634021997 CET	49880	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:07.634067059 CET	49880	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:07.638853073 CET	445	49880	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:07.638874054 CET	445	49880	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:08.404829025 CET	50176	445	192.168.2.5	204.215.189.78
Jan 14, 2025 21:04:08.409708023 CET	445	50176	204.215.189.78	192.168.2.5
Jan 14, 2025 21:04:08.409780979 CET	50176	445	192.168.2.5	204.215.189.78
Jan 14, 2025 21:04:08.409802914 CET	50176	445	192.168.2.5	204.215.189.78
Jan 14, 2025 21:04:08.409991026 CET	50177	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.414769888 CET	445	50177	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:08.414869070 CET	50177	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.414869070 CET	50177	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.414880037 CET	445	50176	204.215.189.78	192.168.2.5
Jan 14, 2025 21:04:08.414930105 CET	50176	445	192.168.2.5	204.215.189.78
Jan 14, 2025 21:04:08.415236950 CET	50178	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.419886112 CET	445	50177	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:08.419934034 CET	50177	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.419998884 CET	445	50178	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:08.420061111 CET	50178	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.420123100 CET	50178	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:08.424834013 CET	445	50178	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:08.639364958 CET	50181	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:08.644153118 CET	445	50181	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:08.645061970 CET	50181	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:08.645061970 CET	50181	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:08.649884939 CET	445	50181	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:09.773047924 CET	445	49915	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:09.773112059 CET	49915	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:09.773245096 CET	49915	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:09.773422956 CET	49915	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:09.780157089 CET	445	49915	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:09.780270100 CET	445	49915	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:10.281925917 CET	50192	445	192.168.2.5	96.109.54.136
Jan 14, 2025 21:04:10.286752939 CET	445	50192	96.109.54.136	192.168.2.5
Jan 14, 2025 21:04:10.287012100 CET	50192	445	192.168.2.5	96.109.54.136
Jan 14, 2025 21:04:10.288122892 CET	50192	445	192.168.2.5	96.109.54.136
Jan 14, 2025 21:04:10.288441896 CET	50193	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.292951107 CET	445	50192	96.109.54.136	192.168.2.5
Jan 14, 2025 21:04:10.293051004 CET	50192	445	192.168.2.5	96.109.54.136
Jan 14, 2025 21:04:10.293226004 CET	445	50193	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:10.293351889 CET	50193	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.293628931 CET	50193	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.293899059 CET	50194	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.298671007 CET	445	50194	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:10.298732996 CET	50194	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.299161911 CET	445	50193	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:10.299336910 CET	50193	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.300374031 CET	50194	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:10.305191994 CET	445	50194	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:10.639126062 CET	50195	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:10.644356966 CET	445	50195	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:10.644462109 CET	50195	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:10.644489050 CET	50195	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:10.649528027 CET	445	50195	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:11.647970915 CET	445	49951	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:11.648051977 CET	49951	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:11.648153067 CET	49951	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:11.648196936 CET	49951	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:11.653090000 CET	445	49951	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:11.653537035 CET	445	49951	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:12.029756069 CET	50205	445	192.168.2.5	34.226.78.128
Jan 14, 2025 21:04:12.034595966 CET	445	50205	34.226.78.128	192.168.2.5
Jan 14, 2025 21:04:12.034708023 CET	50205	445	192.168.2.5	34.226.78.128
Jan 14, 2025 21:04:12.034749985 CET	50205	445	192.168.2.5	34.226.78.128
Jan 14, 2025 21:04:12.034971952 CET	50206	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.039720058 CET	445	50205	34.226.78.128	192.168.2.5
Jan 14, 2025 21:04:12.039777994 CET	50205	445	192.168.2.5	34.226.78.128
Jan 14, 2025 21:04:12.039830923 CET	445	50206	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:12.039896011 CET	50206	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.039913893 CET	50206	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.040169954 CET	50207	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.044827938 CET	445	50206	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:12.045012951 CET	50206	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.045093060 CET	445	50207	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:12.045166969 CET	50207	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.045212984 CET	50207	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:12.050024986 CET	445	50207	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:12.780268908 CET	50213	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:12.785078049 CET	445	50213	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:12.785312891 CET	50213	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:12.785342932 CET	50213	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:12.790095091 CET	445	50213	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:13.663769960 CET	445	49987	114.118.212.1	192.168.2.5
Jan 14, 2025 21:04:13.663872004 CET	49987	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:13.663917065 CET	49987	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:13.663954973 CET	49987	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:13.669204950 CET	445	49987	114.118.212.1	192.168.2.5
Jan 14, 2025 21:04:13.669259071 CET	445	49987	114.118.212.1	192.168.2.5
Jan 14, 2025 21:04:13.670979977 CET	50219	445	192.168.2.5	62.93.61.140
Jan 14, 2025 21:04:13.675796986 CET	445	50219	62.93.61.140	192.168.2.5
Jan 14, 2025 21:04:13.675862074 CET	50219	445	192.168.2.5	62.93.61.140
Jan 14, 2025 21:04:13.675995111 CET	50219	445	192.168.2.5	62.93.61.140
Jan 14, 2025 21:04:13.676129103 CET	50220	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.680803061 CET	445	50219	62.93.61.140	192.168.2.5
Jan 14, 2025 21:04:13.680866003 CET	50219	445	192.168.2.5	62.93.61.140
Jan 14, 2025 21:04:13.680928946 CET	445	50220	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:13.680991888 CET	50220	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.681041002 CET	50220	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.681339979 CET	50221	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.685985088 CET	445	50220	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:13.686041117 CET	50220	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.686199903 CET	445	50221	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:13.686266899 CET	50221	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.686291933 CET	50221	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:13.691099882 CET	445	50221	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:14.654263973 CET	50228	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:14.659292936 CET	445	50228	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:14.659424067 CET	50228	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:14.659621954 CET	50228	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:14.664458036 CET	445	50228	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:15.203282118 CET	50233	445	192.168.2.5	141.56.77.160
Jan 14, 2025 21:04:15.208116055 CET	445	50233	141.56.77.160	192.168.2.5
Jan 14, 2025 21:04:15.208209038 CET	50233	445	192.168.2.5	141.56.77.160
Jan 14, 2025 21:04:15.208265066 CET	50233	445	192.168.2.5	141.56.77.160
Jan 14, 2025 21:04:15.208417892 CET	50234	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.213109970 CET	445	50233	141.56.77.160	192.168.2.5
Jan 14, 2025 21:04:15.213190079 CET	445	50234	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:15.213192940 CET	50233	445	192.168.2.5	141.56.77.160
Jan 14, 2025 21:04:15.213248968 CET	50234	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.213310957 CET	50234	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.213706017 CET	50235	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.218343019 CET	445	50234	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:15.218419075 CET	50234	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.218502998 CET	445	50235	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:15.218556881 CET	50235	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.218579054 CET	50235	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:15.223356962 CET	445	50235	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:15.695194006 CET	445	50018	28.125.169.1	192.168.2.5
Jan 14, 2025 21:04:15.695276976 CET	50018	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:15.735903978 CET	50018	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:15.735903978 CET	50018	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:15.740747929 CET	445	50018	28.125.169.1	192.168.2.5
Jan 14, 2025 21:04:15.740761042 CET	445	50018	28.125.169.1	192.168.2.5
Jan 14, 2025 21:04:16.623707056 CET	50243	445	192.168.2.5	172.73.100.23
Jan 14, 2025 21:04:16.628470898 CET	445	50243	172.73.100.23	192.168.2.5
Jan 14, 2025 21:04:16.628540993 CET	50243	445	192.168.2.5	172.73.100.23
Jan 14, 2025 21:04:16.628587008 CET	50243	445	192.168.2.5	172.73.100.23
Jan 14, 2025 21:04:16.628757000 CET	50244	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.633493900 CET	445	50243	172.73.100.23	192.168.2.5
Jan 14, 2025 21:04:16.633543015 CET	445	50244	172.73.100.1	192.168.2.5
Jan 14, 2025 21:04:16.633570910 CET	50243	445	192.168.2.5	172.73.100.23
Jan 14, 2025 21:04:16.633619070 CET	50244	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.633718967 CET	50244	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.634052038 CET	50245	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.638648987 CET	445	50244	172.73.100.1	192.168.2.5
Jan 14, 2025 21:04:16.638724089 CET	50244	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.638812065 CET	445	50245	172.73.100.1	192.168.2.5
Jan 14, 2025 21:04:16.638870001 CET	50245	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.638906956 CET	50245	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:16.643671989 CET	445	50245	172.73.100.1	192.168.2.5
Jan 14, 2025 21:04:16.670346975 CET	50246	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:16.675174952 CET	445	50246	114.118.212.1	192.168.2.5
Jan 14, 2025 21:04:16.675252914 CET	50246	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:16.675303936 CET	50246	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:16.680143118 CET	445	50246	114.118.212.1	192.168.2.5
Jan 14, 2025 21:04:17.728013992 CET	445	50057	94.64.50.1	192.168.2.5
Jan 14, 2025 21:04:17.728108883 CET	50057	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:17.728179932 CET	50057	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:17.728245020 CET	50057	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:17.732964039 CET	445	50057	94.64.50.1	192.168.2.5
Jan 14, 2025 21:04:17.732988119 CET	445	50057	94.64.50.1	192.168.2.5
Jan 14, 2025 21:04:17.951531887 CET	50256	445	192.168.2.5	92.187.212.47
Jan 14, 2025 21:04:17.956363916 CET	445	50256	92.187.212.47	192.168.2.5
Jan 14, 2025 21:04:17.956613064 CET	50256	445	192.168.2.5	92.187.212.47
Jan 14, 2025 21:04:17.956655979 CET	50256	445	192.168.2.5	92.187.212.47
Jan 14, 2025 21:04:17.957046986 CET	50257	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.961677074 CET	445	50256	92.187.212.47	192.168.2.5
Jan 14, 2025 21:04:17.961771011 CET	50256	445	192.168.2.5	92.187.212.47
Jan 14, 2025 21:04:17.961869001 CET	445	50257	92.187.212.1	192.168.2.5
Jan 14, 2025 21:04:17.961951971 CET	50257	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.962028980 CET	50257	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.962444067 CET	50258	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.967238903 CET	445	50258	92.187.212.1	192.168.2.5
Jan 14, 2025 21:04:17.967346907 CET	50258	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.967367887 CET	50258	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.968209028 CET	445	50257	92.187.212.1	192.168.2.5
Jan 14, 2025 21:04:17.969162941 CET	445	50257	92.187.212.1	192.168.2.5
Jan 14, 2025 21:04:17.969221115 CET	50257	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:17.972127914 CET	445	50258	92.187.212.1	192.168.2.5
Jan 14, 2025 21:04:18.747997999 CET	50264	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:18.753103971 CET	445	50264	28.125.169.1	192.168.2.5
Jan 14, 2025 21:04:18.753173113 CET	50264	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:18.753196955 CET	50264	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:18.758121014 CET	445	50264	28.125.169.1	192.168.2.5
Jan 14, 2025 21:04:19.201852083 CET	50269	445	192.168.2.5	184.102.23.157
Jan 14, 2025 21:04:19.206718922 CET	445	50269	184.102.23.157	192.168.2.5
Jan 14, 2025 21:04:19.206847906 CET	50269	445	192.168.2.5	184.102.23.157
Jan 14, 2025 21:04:19.206979990 CET	50269	445	192.168.2.5	184.102.23.157
Jan 14, 2025 21:04:19.207190037 CET	50270	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.212003946 CET	445	50270	184.102.23.1	192.168.2.5
Jan 14, 2025 21:04:19.212090969 CET	50270	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.213241100 CET	445	50269	184.102.23.157	192.168.2.5
Jan 14, 2025 21:04:19.213301897 CET	50269	445	192.168.2.5	184.102.23.157
Jan 14, 2025 21:04:19.217195988 CET	50270	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.217823029 CET	50271	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.222110033 CET	445	50270	184.102.23.1	192.168.2.5
Jan 14, 2025 21:04:19.222162962 CET	50270	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.222589970 CET	445	50271	184.102.23.1	192.168.2.5
Jan 14, 2025 21:04:19.222651005 CET	50271	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.222738981 CET	50271	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:19.227479935 CET	445	50271	184.102.23.1	192.168.2.5
Jan 14, 2025 21:04:19.708538055 CET	445	50093	179.12.193.1	192.168.2.5
Jan 14, 2025 21:04:19.708663940 CET	50093	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:19.708718061 CET	50093	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:19.708780050 CET	50093	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:19.713490009 CET	445	50093	179.12.193.1	192.168.2.5
Jan 14, 2025 21:04:19.713550091 CET	445	50093	179.12.193.1	192.168.2.5
Jan 14, 2025 21:04:19.833621979 CET	445	50098	135.71.100.1	192.168.2.5
Jan 14, 2025 21:04:19.833745003 CET	50098	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:04:19.833807945 CET	50098	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:04:19.833875895 CET	50098	445	192.168.2.5	135.71.100.1
Jan 14, 2025 21:04:19.838660002 CET	445	50098	135.71.100.1	192.168.2.5
Jan 14, 2025 21:04:19.838682890 CET	445	50098	135.71.100.1	192.168.2.5
Jan 14, 2025 21:04:19.888756037 CET	50274	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.893619061 CET	445	50274	135.71.100.2	192.168.2.5
Jan 14, 2025 21:04:19.893734932 CET	50274	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.893745899 CET	50274	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.894129038 CET	50275	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.898619890 CET	445	50274	135.71.100.2	192.168.2.5
Jan 14, 2025 21:04:19.898668051 CET	50274	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.898935080 CET	445	50275	135.71.100.2	192.168.2.5
Jan 14, 2025 21:04:19.898998976 CET	50275	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.899054050 CET	50275	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:19.903795958 CET	445	50275	135.71.100.2	192.168.2.5
Jan 14, 2025 21:04:20.358385086 CET	50280	445	192.168.2.5	207.58.177.56
Jan 14, 2025 21:04:20.363385916 CET	445	50280	207.58.177.56	192.168.2.5
Jan 14, 2025 21:04:20.363553047 CET	50280	445	192.168.2.5	207.58.177.56
Jan 14, 2025 21:04:20.363553047 CET	50280	445	192.168.2.5	207.58.177.56
Jan 14, 2025 21:04:20.363678932 CET	50281	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.368556023 CET	445	50281	207.58.177.1	192.168.2.5
Jan 14, 2025 21:04:20.368607998 CET	445	50280	207.58.177.56	192.168.2.5
Jan 14, 2025 21:04:20.368618965 CET	50281	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.368635893 CET	50281	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.368655920 CET	50280	445	192.168.2.5	207.58.177.56
Jan 14, 2025 21:04:20.368896008 CET	50282	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.373619080 CET	445	50281	207.58.177.1	192.168.2.5
Jan 14, 2025 21:04:20.373672962 CET	50281	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.373733044 CET	445	50282	207.58.177.1	192.168.2.5
Jan 14, 2025 21:04:20.373949051 CET	50282	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.374005079 CET	50282	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:20.378772020 CET	445	50282	207.58.177.1	192.168.2.5
Jan 14, 2025 21:04:20.732631922 CET	50286	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:20.737546921 CET	445	50286	94.64.50.1	192.168.2.5
Jan 14, 2025 21:04:20.737607002 CET	50286	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:20.737644911 CET	50286	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:20.742850065 CET	445	50286	94.64.50.1	192.168.2.5
Jan 14, 2025 21:04:21.667334080 CET	50289	445	192.168.2.5	114.238.159.196
Jan 14, 2025 21:04:21.672205925 CET	445	50289	114.238.159.196	192.168.2.5
Jan 14, 2025 21:04:21.672278881 CET	50289	445	192.168.2.5	114.238.159.196
Jan 14, 2025 21:04:21.672369957 CET	50289	445	192.168.2.5	114.238.159.196
Jan 14, 2025 21:04:21.672521114 CET	50290	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.677316904 CET	445	50289	114.238.159.196	192.168.2.5
Jan 14, 2025 21:04:21.677330017 CET	445	50290	114.238.159.1	192.168.2.5
Jan 14, 2025 21:04:21.677370071 CET	50289	445	192.168.2.5	114.238.159.196
Jan 14, 2025 21:04:21.677402973 CET	50290	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.677484989 CET	50290	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.682307005 CET	445	50290	114.238.159.1	192.168.2.5
Jan 14, 2025 21:04:21.682364941 CET	50290	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.722404957 CET	50291	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.727322102 CET	445	50291	114.238.159.1	192.168.2.5
Jan 14, 2025 21:04:21.727390051 CET	50291	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.729120970 CET	50291	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:21.733983994 CET	445	50291	114.238.159.1	192.168.2.5
Jan 14, 2025 21:04:22.498667955 CET	50297	445	192.168.2.5	183.211.102.207
Jan 14, 2025 21:04:22.503511906 CET	445	50297	183.211.102.207	192.168.2.5
Jan 14, 2025 21:04:22.503575087 CET	50297	445	192.168.2.5	183.211.102.207
Jan 14, 2025 21:04:22.503598928 CET	50297	445	192.168.2.5	183.211.102.207
Jan 14, 2025 21:04:22.503788948 CET	50298	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.508555889 CET	445	50298	183.211.102.1	192.168.2.5
Jan 14, 2025 21:04:22.508570910 CET	445	50297	183.211.102.207	192.168.2.5
Jan 14, 2025 21:04:22.508614063 CET	50298	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.508626938 CET	50298	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.508662939 CET	50297	445	192.168.2.5	183.211.102.207
Jan 14, 2025 21:04:22.508898973 CET	50299	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.513550997 CET	445	50298	183.211.102.1	192.168.2.5
Jan 14, 2025 21:04:22.513614893 CET	50298	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.513695002 CET	445	50299	183.211.102.1	192.168.2.5
Jan 14, 2025 21:04:22.513751030 CET	50299	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.513807058 CET	50299	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:22.518582106 CET	445	50299	183.211.102.1	192.168.2.5
Jan 14, 2025 21:04:22.644392014 CET	445	50120	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:22.647300005 CET	50120	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:22.647334099 CET	50120	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:22.647377968 CET	50120	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:22.649974108 CET	445	50118	162.139.80.1	192.168.2.5
Jan 14, 2025 21:04:22.650039911 CET	50118	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:04:22.650141954 CET	50118	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:04:22.650259018 CET	50118	445	192.168.2.5	162.139.80.1
Jan 14, 2025 21:04:22.654484987 CET	445	50120	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:22.654975891 CET	445	50120	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:22.657798052 CET	445	50118	162.139.80.1	192.168.2.5
Jan 14, 2025 21:04:22.660614967 CET	445	50118	162.139.80.1	192.168.2.5
Jan 14, 2025 21:04:22.701622963 CET	50305	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.707442045 CET	445	50305	162.139.80.2	192.168.2.5
Jan 14, 2025 21:04:22.711503983 CET	50305	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.711524010 CET	50305	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.716757059 CET	50306	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:22.716814995 CET	445	50305	162.139.80.2	192.168.2.5
Jan 14, 2025 21:04:22.718930960 CET	50305	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.723875999 CET	445	50306	179.12.193.1	192.168.2.5
Jan 14, 2025 21:04:22.727216959 CET	50307	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.727272034 CET	50306	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:22.727313042 CET	50306	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:22.732145071 CET	445	50307	162.139.80.2	192.168.2.5
Jan 14, 2025 21:04:22.732156038 CET	445	50306	179.12.193.1	192.168.2.5
Jan 14, 2025 21:04:22.732254982 CET	50307	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.732254982 CET	50307	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:22.737083912 CET	445	50307	162.139.80.2	192.168.2.5
Jan 14, 2025 21:04:23.436635017 CET	50310	445	192.168.2.5	185.1.71.234
Jan 14, 2025 21:04:23.441445112 CET	445	50310	185.1.71.234	192.168.2.5
Jan 14, 2025 21:04:23.441512108 CET	50310	445	192.168.2.5	185.1.71.234
Jan 14, 2025 21:04:23.441545010 CET	50310	445	192.168.2.5	185.1.71.234
Jan 14, 2025 21:04:23.441706896 CET	50313	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.446753979 CET	445	50313	185.1.71.1	192.168.2.5
Jan 14, 2025 21:04:23.446768999 CET	445	50310	185.1.71.234	192.168.2.5
Jan 14, 2025 21:04:23.446826935 CET	50310	445	192.168.2.5	185.1.71.234
Jan 14, 2025 21:04:23.446893930 CET	50313	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.446893930 CET	50313	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.447196007 CET	50314	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.451791048 CET	445	50313	185.1.71.1	192.168.2.5
Jan 14, 2025 21:04:23.451862097 CET	50313	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.452058077 CET	445	50314	185.1.71.1	192.168.2.5
Jan 14, 2025 21:04:23.452125072 CET	50314	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.452158928 CET	50314	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:23.456913948 CET	445	50314	185.1.71.1	192.168.2.5
Jan 14, 2025 21:04:23.755491972 CET	445	50128	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:23.755554914 CET	50128	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:23.755615950 CET	50128	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:23.755651951 CET	50128	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:23.760488033 CET	445	50128	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:23.760499001 CET	445	50128	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:23.804713964 CET	445	50129	133.222.94.1	192.168.2.5
Jan 14, 2025 21:04:23.804779053 CET	50129	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:04:23.804996014 CET	50129	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:04:23.805047035 CET	50129	445	192.168.2.5	133.222.94.1
Jan 14, 2025 21:04:23.809958935 CET	445	50129	133.222.94.1	192.168.2.5
Jan 14, 2025 21:04:23.809992075 CET	445	50129	133.222.94.1	192.168.2.5
Jan 14, 2025 21:04:23.874675989 CET	50317	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.879641056 CET	445	50317	133.222.94.2	192.168.2.5
Jan 14, 2025 21:04:23.879743099 CET	50317	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.879993916 CET	50317	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.880935907 CET	50318	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.885283947 CET	445	50317	133.222.94.2	192.168.2.5
Jan 14, 2025 21:04:23.885337114 CET	50317	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.886707067 CET	445	50318	133.222.94.2	192.168.2.5
Jan 14, 2025 21:04:23.886770010 CET	50318	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.886868000 CET	50318	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:23.891741037 CET	445	50318	133.222.94.2	192.168.2.5
Jan 14, 2025 21:04:24.319118977 CET	50319	445	192.168.2.5	131.217.163.173
Jan 14, 2025 21:04:24.325109005 CET	445	50319	131.217.163.173	192.168.2.5
Jan 14, 2025 21:04:24.325176954 CET	50319	445	192.168.2.5	131.217.163.173
Jan 14, 2025 21:04:24.328531981 CET	50319	445	192.168.2.5	131.217.163.173
Jan 14, 2025 21:04:24.328977108 CET	50320	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.334667921 CET	445	50319	131.217.163.173	192.168.2.5
Jan 14, 2025 21:04:24.334743023 CET	50319	445	192.168.2.5	131.217.163.173
Jan 14, 2025 21:04:24.334990978 CET	445	50320	131.217.163.1	192.168.2.5
Jan 14, 2025 21:04:24.335048914 CET	50320	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.336790085 CET	50320	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.342864037 CET	445	50320	131.217.163.1	192.168.2.5
Jan 14, 2025 21:04:24.342917919 CET	50320	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.432569981 CET	50321	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.437407017 CET	445	50321	131.217.163.1	192.168.2.5
Jan 14, 2025 21:04:24.437500000 CET	50321	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.437535048 CET	50321	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:24.442266941 CET	445	50321	131.217.163.1	192.168.2.5
Jan 14, 2025 21:04:25.139085054 CET	50327	445	192.168.2.5	197.14.245.6
Jan 14, 2025 21:04:25.143873930 CET	445	50327	197.14.245.6	192.168.2.5
Jan 14, 2025 21:04:25.144002914 CET	50327	445	192.168.2.5	197.14.245.6
Jan 14, 2025 21:04:25.144089937 CET	50327	445	192.168.2.5	197.14.245.6
Jan 14, 2025 21:04:25.144319057 CET	50328	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.148919106 CET	445	50327	197.14.245.6	192.168.2.5
Jan 14, 2025 21:04:25.149005890 CET	50327	445	192.168.2.5	197.14.245.6
Jan 14, 2025 21:04:25.149065018 CET	445	50328	197.14.245.1	192.168.2.5
Jan 14, 2025 21:04:25.149131060 CET	50328	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.149175882 CET	50328	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.149580956 CET	50329	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.154278994 CET	445	50328	197.14.245.1	192.168.2.5
Jan 14, 2025 21:04:25.154346943 CET	50328	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.154364109 CET	445	50329	197.14.245.1	192.168.2.5
Jan 14, 2025 21:04:25.154428005 CET	50329	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.154690027 CET	50329	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:25.159441948 CET	445	50329	197.14.245.1	192.168.2.5
Jan 14, 2025 21:04:25.654309034 CET	50335	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:25.659626007 CET	445	50335	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:25.663198948 CET	50335	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:25.663228989 CET	50335	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:25.668361902 CET	445	50335	42.129.113.1	192.168.2.5
Jan 14, 2025 21:04:25.769470930 CET	445	50145	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:25.769571066 CET	50145	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:25.769597054 CET	50145	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:25.769646883 CET	50145	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:25.774631023 CET	445	50145	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:25.774774075 CET	445	50145	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:25.837863922 CET	445	50147	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:25.837965965 CET	50147	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:25.838022947 CET	50147	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:25.838109016 CET	50147	445	192.168.2.5	185.24.227.1
Jan 14, 2025 21:04:25.844991922 CET	445	50147	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:25.845006943 CET	445	50147	185.24.227.1	192.168.2.5
Jan 14, 2025 21:04:25.904618979 CET	50336	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.904885054 CET	50337	445	192.168.2.5	128.29.176.167
Jan 14, 2025 21:04:25.911186934 CET	445	50336	185.24.227.2	192.168.2.5
Jan 14, 2025 21:04:25.911216021 CET	445	50337	128.29.176.167	192.168.2.5
Jan 14, 2025 21:04:25.911281109 CET	50336	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.911307096 CET	50337	445	192.168.2.5	128.29.176.167
Jan 14, 2025 21:04:25.911416054 CET	50336	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.911557913 CET	50337	445	192.168.2.5	128.29.176.167
Jan 14, 2025 21:04:25.911725044 CET	50338	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.911919117 CET	50339	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.916291952 CET	445	50336	185.24.227.2	192.168.2.5
Jan 14, 2025 21:04:25.916424990 CET	445	50336	185.24.227.2	192.168.2.5
Jan 14, 2025 21:04:25.916475058 CET	50336	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.916505098 CET	445	50338	128.29.176.1	192.168.2.5
Jan 14, 2025 21:04:25.916517019 CET	445	50337	128.29.176.167	192.168.2.5
Jan 14, 2025 21:04:25.916575909 CET	50337	445	192.168.2.5	128.29.176.167
Jan 14, 2025 21:04:25.916661978 CET	50338	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.916661978 CET	50338	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.916702032 CET	445	50339	185.24.227.2	192.168.2.5
Jan 14, 2025 21:04:25.916861057 CET	50339	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.916861057 CET	50339	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:25.917033911 CET	50340	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.923382044 CET	445	50338	128.29.176.1	192.168.2.5
Jan 14, 2025 21:04:25.923440933 CET	50338	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.924351931 CET	445	50339	185.24.227.2	192.168.2.5
Jan 14, 2025 21:04:25.924369097 CET	445	50340	128.29.176.1	192.168.2.5
Jan 14, 2025 21:04:25.924427032 CET	50340	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.924458027 CET	50340	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:25.930938959 CET	445	50340	128.29.176.1	192.168.2.5
Jan 14, 2025 21:04:26.765175104 CET	50347	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:26.770034075 CET	445	50347	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:26.770121098 CET	50347	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:26.770147085 CET	50347	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:26.774909973 CET	445	50347	146.94.210.1	192.168.2.5
Jan 14, 2025 21:04:27.753793955 CET	445	50161	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:27.755178928 CET	50161	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:27.755222082 CET	50161	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:27.755280972 CET	50161	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:27.760242939 CET	445	50161	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:27.760360956 CET	445	50161	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:28.036813974 CET	445	50165	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:28.040874958 CET	50165	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:28.040957928 CET	50165	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:28.041014910 CET	50165	445	192.168.2.5	2.240.171.1
Jan 14, 2025 21:04:28.045762062 CET	445	50165	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:28.045829058 CET	445	50165	2.240.171.1	192.168.2.5
Jan 14, 2025 21:04:28.110297918 CET	50361	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.115183115 CET	445	50361	2.240.171.2	192.168.2.5
Jan 14, 2025 21:04:28.116894960 CET	50361	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.116961956 CET	50361	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.117422104 CET	50362	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.121895075 CET	445	50361	2.240.171.2	192.168.2.5
Jan 14, 2025 21:04:28.121962070 CET	50361	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.122200966 CET	445	50362	2.240.171.2	192.168.2.5
Jan 14, 2025 21:04:28.122261047 CET	50362	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.122303963 CET	50362	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:28.127065897 CET	445	50362	2.240.171.2	192.168.2.5
Jan 14, 2025 21:04:28.779571056 CET	50365	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:28.784496069 CET	445	50365	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:28.784569979 CET	50365	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:28.784615040 CET	50365	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:28.789398909 CET	445	50365	165.250.181.1	192.168.2.5
Jan 14, 2025 21:04:29.789206982 CET	445	50178	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:29.789345980 CET	50178	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:29.792488098 CET	50178	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:29.792572021 CET	50178	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:29.797245979 CET	445	50178	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:29.797264099 CET	445	50178	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:30.003983021 CET	445	50181	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:30.004045010 CET	50181	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:30.004092932 CET	50181	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:30.004152060 CET	50181	445	192.168.2.5	160.40.25.1
Jan 14, 2025 21:04:30.008830070 CET	445	50181	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:30.008908033 CET	445	50181	160.40.25.1	192.168.2.5
Jan 14, 2025 21:04:30.064002991 CET	50373	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.068895102 CET	445	50373	160.40.25.2	192.168.2.5
Jan 14, 2025 21:04:30.068958044 CET	50373	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.069789886 CET	50373	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.071958065 CET	50375	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.074634075 CET	445	50373	160.40.25.2	192.168.2.5
Jan 14, 2025 21:04:30.074686050 CET	50373	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.076775074 CET	445	50375	160.40.25.2	192.168.2.5
Jan 14, 2025 21:04:30.076833963 CET	50375	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.077681065 CET	50375	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:30.082525969 CET	445	50375	160.40.25.2	192.168.2.5
Jan 14, 2025 21:04:30.763792038 CET	50382	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:30.768754959 CET	445	50382	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:30.768857002 CET	50382	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:30.768934965 CET	50382	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:30.773730993 CET	445	50382	194.41.210.1	192.168.2.5
Jan 14, 2025 21:04:31.675805092 CET	445	50194	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:31.675915003 CET	50194	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:31.675967932 CET	50194	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:31.676343918 CET	50194	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:31.680731058 CET	445	50194	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:31.681080103 CET	445	50194	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:32.025346041 CET	445	50195	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:32.025562048 CET	50195	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:32.025629997 CET	50195	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:32.025666952 CET	50195	445	192.168.2.5	76.35.66.1
Jan 14, 2025 21:04:32.030354023 CET	445	50195	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:32.030422926 CET	445	50195	76.35.66.1	192.168.2.5
Jan 14, 2025 21:04:32.091801882 CET	50396	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.096630096 CET	445	50396	76.35.66.2	192.168.2.5
Jan 14, 2025 21:04:32.096738100 CET	50396	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.096788883 CET	50396	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.097136021 CET	50397	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.101782084 CET	445	50396	76.35.66.2	192.168.2.5
Jan 14, 2025 21:04:32.101843119 CET	50396	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.101888895 CET	445	50397	76.35.66.2	192.168.2.5
Jan 14, 2025 21:04:32.101948023 CET	50397	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.101989031 CET	50397	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:32.106735945 CET	445	50397	76.35.66.2	192.168.2.5
Jan 14, 2025 21:04:32.799155951 CET	50406	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:32.803947926 CET	445	50406	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:32.804034948 CET	50406	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:32.804071903 CET	50406	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:32.808794975 CET	445	50406	204.215.189.1	192.168.2.5
Jan 14, 2025 21:04:33.394820929 CET	445	50207	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:33.394922018 CET	50207	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:33.394972086 CET	50207	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:33.395020962 CET	50207	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:33.399753094 CET	445	50207	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:33.399806023 CET	445	50207	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:34.254703045 CET	445	50213	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:34.254796982 CET	50213	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:34.254839897 CET	50213	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:34.254880905 CET	50213	445	192.168.2.5	131.113.135.1
Jan 14, 2025 21:04:34.259656906 CET	445	50213	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:34.259711027 CET	445	50213	131.113.135.1	192.168.2.5
Jan 14, 2025 21:04:34.311113119 CET	50436	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.407625914 CET	445	50436	131.113.135.2	192.168.2.5
Jan 14, 2025 21:04:34.407756090 CET	50436	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.407892942 CET	50436	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.408319950 CET	50437	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.413983107 CET	445	50437	131.113.135.2	192.168.2.5
Jan 14, 2025 21:04:34.414067030 CET	50437	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.414103031 CET	445	50436	131.113.135.2	192.168.2.5
Jan 14, 2025 21:04:34.414113045 CET	50437	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.414149046 CET	50436	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:34.418862104 CET	445	50437	131.113.135.2	192.168.2.5
Jan 14, 2025 21:04:34.685713053 CET	50444	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:34.691082001 CET	445	50444	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:34.691180944 CET	50444	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:34.691200972 CET	50444	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:34.696074963 CET	445	50444	96.109.54.1	192.168.2.5
Jan 14, 2025 21:04:35.035370111 CET	445	50221	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:35.035516977 CET	50221	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:35.035543919 CET	50221	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:35.035609961 CET	50221	445	192.168.2.5	62.93.61.1
Jan 14, 2025 21:04:35.040494919 CET	445	50221	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:35.040558100 CET	445	50221	62.93.61.1	192.168.2.5
Jan 14, 2025 21:04:36.006702900 CET	445	50228	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:36.006778955 CET	50228	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:36.006845951 CET	50228	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:36.006896973 CET	50228	445	192.168.2.5	35.61.65.1
Jan 14, 2025 21:04:36.012609005 CET	445	50228	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:36.012639999 CET	445	50228	35.61.65.1	192.168.2.5
Jan 14, 2025 21:04:36.060578108 CET	50488	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.066373110 CET	445	50488	35.61.65.2	192.168.2.5
Jan 14, 2025 21:04:36.066456079 CET	50488	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.066543102 CET	50488	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.066837072 CET	50489	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.072459936 CET	445	50488	35.61.65.2	192.168.2.5
Jan 14, 2025 21:04:36.072545052 CET	50488	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.072675943 CET	445	50489	35.61.65.2	192.168.2.5
Jan 14, 2025 21:04:36.072773933 CET	50489	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.072906017 CET	50489	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:04:36.079608917 CET	445	50489	35.61.65.2	192.168.2.5
Jan 14, 2025 21:04:36.404602051 CET	50506	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:36.410557032 CET	445	50506	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:36.410748005 CET	50506	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:36.410892963 CET	50506	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:36.416663885 CET	445	50506	34.226.78.1	192.168.2.5
Jan 14, 2025 21:04:36.585709095 CET	445	50235	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:36.585823059 CET	50235	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:36.585881948 CET	50235	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:36.585923910 CET	50235	445	192.168.2.5	141.56.77.1
Jan 14, 2025 21:04:36.594249964 CET	445	50235	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:36.594261885 CET	445	50235	141.56.77.1	192.168.2.5
Jan 14, 2025 21:04:37.990421057 CET	445	50245	172.73.100.1	192.168.2.5
Jan 14, 2025 21:04:37.990508080 CET	50245	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:38.055159092 CET	445	50246	114.118.212.1	192.168.2.5
Jan 14, 2025 21:04:38.055218935 CET	50246	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:38.830076933 CET	50275	445	192.168.2.5	135.71.100.2
Jan 14, 2025 21:04:38.830197096 CET	50437	445	192.168.2.5	131.113.135.2
Jan 14, 2025 21:04:38.830234051 CET	50362	445	192.168.2.5	2.240.171.2
Jan 14, 2025 21:04:38.830260992 CET	50318	445	192.168.2.5	133.222.94.2
Jan 14, 2025 21:04:38.830353975 CET	50245	445	192.168.2.5	172.73.100.1
Jan 14, 2025 21:04:38.830379009 CET	50246	445	192.168.2.5	114.118.212.1
Jan 14, 2025 21:04:38.830404043 CET	50258	445	192.168.2.5	92.187.212.1
Jan 14, 2025 21:04:38.830435991 CET	50264	445	192.168.2.5	28.125.169.1
Jan 14, 2025 21:04:38.830519915 CET	50271	445	192.168.2.5	184.102.23.1
Jan 14, 2025 21:04:38.830527067 CET	50282	445	192.168.2.5	207.58.177.1
Jan 14, 2025 21:04:38.830528975 CET	50286	445	192.168.2.5	94.64.50.1
Jan 14, 2025 21:04:38.830591917 CET	50291	445	192.168.2.5	114.238.159.1
Jan 14, 2025 21:04:38.830609083 CET	50306	445	192.168.2.5	179.12.193.1
Jan 14, 2025 21:04:38.830630064 CET	50299	445	192.168.2.5	183.211.102.1
Jan 14, 2025 21:04:38.830656052 CET	50314	445	192.168.2.5	185.1.71.1
Jan 14, 2025 21:04:38.830671072 CET	50307	445	192.168.2.5	162.139.80.2
Jan 14, 2025 21:04:38.830699921 CET	50321	445	192.168.2.5	131.217.163.1
Jan 14, 2025 21:04:38.830753088 CET	50335	445	192.168.2.5	42.129.113.1
Jan 14, 2025 21:04:38.830758095 CET	50329	445	192.168.2.5	197.14.245.1
Jan 14, 2025 21:04:38.830771923 CET	50339	445	192.168.2.5	185.24.227.2
Jan 14, 2025 21:04:38.830797911 CET	50340	445	192.168.2.5	128.29.176.1
Jan 14, 2025 21:04:38.830818892 CET	50347	445	192.168.2.5	146.94.210.1
Jan 14, 2025 21:04:38.830848932 CET	50375	445	192.168.2.5	160.40.25.2
Jan 14, 2025 21:04:38.830913067 CET	50365	445	192.168.2.5	165.250.181.1
Jan 14, 2025 21:04:38.830931902 CET	50382	445	192.168.2.5	194.41.210.1
Jan 14, 2025 21:04:38.830960989 CET	50406	445	192.168.2.5	204.215.189.1
Jan 14, 2025 21:04:38.830985069 CET	50397	445	192.168.2.5	76.35.66.2
Jan 14, 2025 21:04:38.831022024 CET	50444	445	192.168.2.5	96.109.54.1
Jan 14, 2025 21:04:38.831073046 CET	50506	445	192.168.2.5	34.226.78.1
Jan 14, 2025 21:04:38.831151009 CET	50489	445	192.168.2.5	35.61.65.2
Jan 14, 2025 21:05:38.884409904 CET	50614	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:05:38.889245033 CET	80	50614	103.224.212.215	192.168.2.5
Jan 14, 2025 21:05:38.889326096 CET	50614	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:05:38.893014908 CET	50614	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:05:38.897794962 CET	80	50614	103.224.212.215	192.168.2.5
Jan 14, 2025 21:05:39.497503996 CET	80	50614	103.224.212.215	192.168.2.5
Jan 14, 2025 21:05:39.497572899 CET	50614	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:05:39.497607946 CET	80	50614	103.224.212.215	192.168.2.5
Jan 14, 2025 21:05:39.497653008 CET	50614	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:05:39.500302076 CET	50614	80	192.168.2.5	103.224.212.215
Jan 14, 2025 21:05:39.501585007 CET	50615	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:05:39.505073071 CET	80	50614	103.224.212.215	192.168.2.5
Jan 14, 2025 21:05:39.506459951 CET	80	50615	199.59.243.228	192.168.2.5
Jan 14, 2025 21:05:39.506558895 CET	50615	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:05:39.506653070 CET	50615	80	192.168.2.5	199.59.243.228
Jan 14, 2025 21:05:39.511478901 CET	80	50615	199.59.243.228	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 21:03:30.986998081 CET	57178	53	192.168.2.5	1.1.1.1
Jan 14, 2025 21:03:31.292540073 CET	53	57178	1.1.1.1	192.168.2.5
Jan 14, 2025 21:03:31.896061897 CET	58459	53	192.168.2.5	1.1.1.1
Jan 14, 2025 21:03:32.296783924 CET	53	58459	1.1.1.1	192.168.2.5
Jan 14, 2025 21:03:45.379348993 CET	137	137	192.168.2.5	192.168.2.255
Jan 14, 2025 21:03:46.122761965 CET	137	137	192.168.2.5	192.168.2.255
Jan 14, 2025 21:03:46.888365030 CET	137	137	192.168.2.5	192.168.2.255
Jan 14, 2025 21:03:53.229017973 CET	137	137	192.168.2.5	192.168.2.255
Jan 14, 2025 21:03:53.982120991 CET	137	137	192.168.2.5	192.168.2.255
Jan 14, 2025 21:03:54.747746944 CET	137	137	192.168.2.5	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 21:03:30.986998081 CET	192.168.2.5	1.1.1.1	0x7a8f	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 21:03:31.896061897 CET	192.168.2.5	1.1.1.1	0x3bdc	Standard query (0)	ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 21:03:31.292540073 CET	1.1.1.1	192.168.2.5	0x7a8f	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com		103.224.212.215	A (IP address)	IN (0x0001)	false
Jan 14, 2025 21:03:32.296783924 CET	1.1.1.1	192.168.2.5	0x3bdc	No error (0)	ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	77026.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 21:03:32.296783924 CET	1.1.1.1	192.168.2.5	0x3bdc	No error (0)	77026.bodis.com		199.59.243.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	103.224.212.215	80	4832	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:03:31.304311037 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 14, 2025 21:03:31.891025066 CET	365	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 20:03:31 GMT server: Apache set-cookie: __tad=1736885011.1575354; expires=Fri, 12-Jan-2035 20:03:31 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-312f-890a-41fa0d8d0e72 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	199.59.243.228	80	4832	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:03:32.302917004 CET	169	OUT	GET /?subid1=20250115-0703-312f-890a-41fa0d8d0e72 HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Jan 14, 2025 21:03:32.756167889 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 20:03:32 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: a95eefa5-1fa4-4707-a8db-f9d18c124d8c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ueEqTjsal6nWT9I6K4bLnl4LG1k2QJnO2S6s8MEvqdx6FArrz5F31qbj86iRV2snvMZ4jHyp5nHvGMo/gkqjrA== set-cookie: parking_session=a95eefa5-1fa4-4707-a8db-f9d18c124d8c; expires=Tue, 14 Jan 2025 20:18:32 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 75 65 45 71 54 6a 73 61 6c 36 6e 57 54 39 49 36 4b 34 62 4c 6e 6c 34 4c 47 31 6b 32 51 4a 6e 4f 32 53 36 73 38 4d 45 76 71 64 78 36 46 41 72 72 7a 35 46 33 31 71 62 6a 38 36 69 52 56 32 73 6e 76 4d 5a 34 6a 48 79 70 35 6e 48 76 47 4d 6f 2f 67 6b 71 6a 72 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ueEqTjsal6nWT9I6K4bLnl4LG1k2QJnO2S6s8MEvqdx6FArrz5F31qbj86iRV2snvMZ4jHyp5nHvGMo/gkqjrA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Jan 14, 2025 21:03:32.756186008 CET	696	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTk1ZWVmYTUtMWZhNC00NzA3LWE4ZGItZjlkMThjMTI0ZDhjIiwicGFnZV90aW1lIjoxNzM2ODg1MDEyLCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	103.224.212.215	80	1172	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:03:32.883703947 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 14, 2025 21:03:33.492301941 CET	365	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 20:03:33 GMT server: Apache set-cookie: __tad=1736885013.6451044; expires=Fri, 12-Jan-2035 20:03:33 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-3312-aefe-653e09ef051d content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	199.59.243.228	80	1172	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:03:33.507039070 CET	169	OUT	GET /?subid1=20250115-0703-3312-aefe-653e09ef051d HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Jan 14, 2025 21:03:33.970993996 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 20:03:33 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: 1b552dfd-00c2-4498-b795-b004aca9d862 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_r7m1muzUIpXtZEUEmbLCogsr62ykkrFl3ZUDq3KncEFaL3g1RiUFN4QslCefVoNCUX4xRZU+mMESNgmYklqL0w== set-cookie: parking_session=1b552dfd-00c2-4498-b795-b004aca9d862; expires=Tue, 14 Jan 2025 20:18:33 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 72 37 6d 31 6d 75 7a 55 49 70 58 74 5a 45 55 45 6d 62 4c 43 6f 67 73 72 36 32 79 6b 6b 72 46 6c 33 5a 55 44 71 33 4b 6e 63 45 46 61 4c 33 67 31 52 69 55 46 4e 34 51 73 6c 43 65 66 56 6f 4e 43 55 58 34 78 52 5a 55 2b 6d 4d 45 53 4e 67 6d 59 6b 6c 71 4c 30 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_r7m1muzUIpXtZEUEmbLCogsr62ykkrFl3ZUDq3KncEFaL3g1RiUFN4QslCefVoNCUX4xRZU+mMESNgmYklqL0w==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Jan 14, 2025 21:03:33.971010923 CET	696	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMWI1NTJkZmQtMDBjMi00NDk4LWI3OTUtYjAwNGFjYTlkODYyIiwicGFnZV90aW1lIjoxNzM2ODg1MDEzLCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	103.224.212.215	80	3176	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:03:33.899924040 CET	134	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache Cookie: __tad=1736885011.1575354
Jan 14, 2025 21:03:34.504657984 CET	269	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 20:03:34 GMT server: Apache location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0703-347d-85b7-a8856e518b6d content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49721	199.59.243.228	80	3176	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:03:34.515021086 CET	231	OUT	GET /?subid1=20250115-0703-347d-85b7-a8856e518b6d HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive Cookie: parking_session=a95eefa5-1fa4-4707-a8db-f9d18c124d8c
Jan 14, 2025 21:03:34.988173008 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 20:03:34 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: d7310a90-b393-4a45-b77f-a7ae66bc5be8 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_b9UsJldHW3ZOjZqfXnketC9P+B5JFNjgZwDTmeM9XnOQ8Ply7KOJFJEulHE2+UuwBYPWUXhkR0aCr2wZ3c+I4A== set-cookie: parking_session=a95eefa5-1fa4-4707-a8db-f9d18c124d8c; expires=Tue, 14 Jan 2025 20:18:34 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 62 39 55 73 4a 6c 64 48 57 33 5a 4f 6a 5a 71 66 58 6e 6b 65 74 43 39 50 2b 42 35 4a 46 4e 6a 67 5a 77 44 54 6d 65 4d 39 58 6e 4f 51 38 50 6c 79 37 4b 4f 4a 46 4a 45 75 6c 48 45 32 2b 55 75 77 42 59 50 57 55 58 68 6b 52 30 61 43 72 32 77 5a 33 63 2b 49 34 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_b9UsJldHW3ZOjZqfXnketC9P+B5JFNjgZwDTmeM9XnOQ8Ply7KOJFJEulHE2+UuwBYPWUXhkR0aCr2wZ3c+I4A==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Jan 14, 2025 21:03:34.988190889 CET	688	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYTk1ZWVmYTUtMWZhNC00NzA3LWE4ZGItZjlkMThjMTI0ZDhjIiwicGFnZV90aW1lIjoxNzM2ODg1MDE0LCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	50614	103.224.212.215	80

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:05:38.893014908 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 14, 2025 21:05:39.497503996 CET	365	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 20:05:39 GMT server: Apache set-cookie: __tad=1736885139.4094942; expires=Fri, 12-Jan-2035 20:05:39 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0705-398f-94c8-f5d240e73af9 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	50615	199.59.243.228	80

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 21:05:39.506653070 CET	169	OUT	GET /?subid1=20250115-0705-398f-94c8-f5d240e73af9 HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive

Target ID:	0
Start time:	15:03:29
Start date:	14/01/2025
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll"
Imagebase:	0x360000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:03:29
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:03:29
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:03:29
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\6qqWn6eIGG.dll,PlayGame
Imagebase:	0x180000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:03:29
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",#1
Imagebase:	0x180000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:03:30
Start date:	14/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	03E8741684A2EA2AA24BAD8DA574435E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.2097891962.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:03:31
Start date:	14/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	03E8741684A2EA2AA24BAD8DA574435E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.2117428894.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2769349749.0000000002282000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2769091093.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:03:32
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\6qqWn6eIGG.dll",PlayGame
Imagebase:	0x180000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:03:32
Start date:	14/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	03E8741684A2EA2AA24BAD8DA574435E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.2140985093.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.2127384895.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:03:33
Start date:	14/01/2025
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2'061'938 bytes
MD5 hash:	1FF321DE9E6B8A865048789E18BB4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 97%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	15:03:34
Start date:	14/01/2025
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2'061'938 bytes
MD5 hash:	1FF321DE9E6B8A865048789E18BB4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	71.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F370EF0,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
CloseHandle.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

CloseHandle, xrefs: 00407D29
C:\%s\qeriuwjhrf, xrefs: 00407E12
CreateProcessA, xrefs: 00407D07
CreateFileA, xrefs: 00407D0F
WINDOWS, xrefs: 00407DF2, 00407E0D
tasksche.exe, xrefs: 00407DEA
WriteFile, xrefs: 00407D1C
kernel32.dll, xrefs: 00407CEA
/i, xrefs: 00407E8D
C:\%s\%s, xrefs: 00407DFB
D, xrefs: 00407ED3

Memory Dump Source

Source File: 00000005.00000002.2131424080.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2131359183.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131489482.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131624058.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131742561.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressHandleProcResource$CloseFile$Createsprintf$FindLoadLockModuleMoveProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4281112323-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000005.00000002.2131424080.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2131359183.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131489482.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131624058.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131742561.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000005.00000002.2131424080.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2131359183.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131489482.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131624058.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131742561.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F370EF0,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

Microsoft Security Center (2.1) Service, xrefs: 00407C90
%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000005.00000002.2131424080.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2131359183.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131489482.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131624058.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131742561.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F370EF0,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000005.00000002.2131424080.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2131359183.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131489482.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131532047.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131624058.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2131742561.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Analysis Process: mssecsvr.exePID: 1172, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	34.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F370EF0,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000007.00000002.2767523817.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2767481491.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767557127.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767919214.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767993709.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2768267765.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000007.00000002.2767523817.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2767481491.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767557127.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767919214.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767993709.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2768267765.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F370EF0,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95
Microsoft Security Center (2.1) Service, xrefs: 00407C90

Memory Dump Source

Source File: 00000007.00000002.2767523817.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2767481491.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767557127.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767919214.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767993709.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2768267765.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F370EF0,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C

Strings

tasksche.exe, xrefs: 00407DEA
D, xrefs: 00407ED3
C:\%s\%s, xrefs: 00407DFB
kernel32.dll, xrefs: 00407CEA
CloseHandle, xrefs: 00407D29
C:\%s\qeriuwjhrf, xrefs: 00407E12
WriteFile, xrefs: 00407D1C
/i, xrefs: 00407E8D
WINDOWS, xrefs: 00407DF2, 00407E0D
CreateFileA, xrefs: 00407D0F
CreateProcessA, xrefs: 00407D07

Memory Dump Source

Source File: 00000007.00000002.2767523817.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2767481491.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767557127.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767919214.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767993709.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2768267765.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000007.00000002.2767523817.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2767481491.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767557127.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767582548.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767855355.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767919214.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2767993709.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2768267765.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Analysis Process: tasksche.exePID: 5988, Parent PID: 4832COMMON

Execution Graph

Execution Coverage:	10%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 0040FEF0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 189
filecomwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410E1C: GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
Part of subcall function 00410E1C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

OleInitialize.OLE32(00000000), ref: 0040FF06

Part of subcall function 00411F56: GetCPInfo.KERNEL32(00000000,?,?,?,?,0040FF16), ref: 00411F67
Part of subcall function 00411F56: IsDBCSLeadByte.KERNEL32(00000000), ref: 00411F7B

_memset.LIBCMT ref: 0040FF22
GetCommandLineW.KERNEL32 ref: 0040FF2A
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0040FF50
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007002), ref: 0040FF62
UnmapViewOfFile.KERNEL32(00000000), ref: 0040FF8B

Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0040D610
Part of subcall function 0040D5F7: SetEnvironmentVariableW.KERNEL32(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

CloseHandle.KERNEL32(?), ref: 0040FF94
GetModuleFileNameW.KERNEL32(00000000,00439820,00000800), ref: 0040FFAE
SetEnvironmentVariableW.KERNEL32(sfxname,00439820), ref: 0040FFC0
GetLocalTime.KERNEL32(?), ref: 0040FFC6
_swprintf.LIBCMT ref: 0040FFFD
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00410011
GetModuleHandleW.KERNEL32(00000000), ref: 00410014
LoadIconW.USER32(00000000,00000064), ref: 0041002B
LoadBitmapW.USER32(00000065), ref: 0041003E
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,0040F58D,00000000), ref: 0041009D
DeleteObject.GDI32 ref: 004100FE
DeleteObject.GDI32(?), ref: 0041010A

Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
Part of subcall function 0040D64B: CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

CloseHandle.KERNEL32(000000FF), ref: 00410147
Sleep.KERNEL32(?), ref: 00410157
OleUninitialize.OLE32 ref: 0041015D

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0040FFEF
winrarsfxmappingfile.tmp, xrefs: 0040FF44
sfxname, xrefs: 0040FFBB
STARTDLG, xrefs: 0041008F
sfxstime, xrefs: 0041000C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$CharCloseDeleteLoadObjectUpperView$AddressBitmapByteCommandDialogIconInfoInitializeLeadLineLocalMappingNameOpenParamProcSleepTimeUninitializeUnmap_memset_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2890863147-3710569615
Opcode ID: e302a6a03e0c0a9aaa08beecaf1dedc93de811017ef03846853a5e8821ade7c7
Instruction ID: f6d524faf13461bd4ea8cb5a97d50562f0dad5b6822c88fd20d602f5543b7383
Opcode Fuzzy Hash: e302a6a03e0c0a9aaa08beecaf1dedc93de811017ef03846853a5e8821ade7c7
Instruction Fuzzy Hash: 5061D971A00205BFC720BFA1DC499AE7BB8EB05314F50443BF901A22A1DB7D4D95DB6E

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

CMT, xrefs: 0040355A
@, xrefs: 004034A4

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: 37295884825835a7901171c985930d0b7c01ea67690c6e0965a3387f9fb6a373
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: 37295884825835a7901171c985930d0b7c01ea67690c6e0965a3387f9fb6a373
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: 2a733cbadd2ca7cd29a11b90f53c863ddd5810a24544a1ec061ee6039bd7df5a
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Function 0040F58D Relevance: 112.7, APIs: 55, Strings: 9, Instructions: 691COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F592

Strings

<, xrefs: 0040F92E
winrarsfxmappingfile.tmp, xrefs: 0040F90B
"%s"%s, xrefs: 0040FA5E
@, xrefs: 0040F935
STARTDLG, xrefs: 0040F5AA
LICENSEDLG, xrefs: 0040FD8B
-el -s2 "-d%s" "-p%s" "-sp%s", xrefs: 0040F8F2
z8D, xrefs: 0040F8D5
__tmp_rar_sfx_access_check_%u, xrefs: 0040F836

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: "%s"%s$-el -s2 "-d%s" "-p%s" "-sp%s"$<$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp$z8D
API String ID: 3519838083-129321368
Opcode ID: a4dd4ca0380014ca9fbcc784b7d3cd6a11c13eb0733f377532361ed44e646897
Instruction ID: cc4c1e380d3e9e53cf766c3de9df5bd6880f95cbde9f973ccf433d51db550174
Opcode Fuzzy Hash: a4dd4ca0380014ca9fbcc784b7d3cd6a11c13eb0733f377532361ed44e646897
Instruction Fuzzy Hash: C732C371540248BFEB31BF619C85E9B3A68EB06304F44407BF901B61E2DB794999CB6E

Function 0040E857 Relevance: 73.9, APIs: 35, Strings: 7, Instructions: 411
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040E85C

Part of subcall function 0040D781: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0040D82F

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,00000800,?,00000000,75A85540,?,0040F541,?,00000003), ref: 0040E9A7
_wcslen.LIBCMT ref: 0040E9E2
_wcslen.LIBCMT ref: 0040E9F7
_wcslen.LIBCMT ref: 0040EA1D
_memset.LIBCMT ref: 0040EA33
SHFileOperationW.SHELL32 ref: 0040EA56
GetFileAttributesW.KERNEL32(?), ref: 0040EA63
DeleteFileW.KERNEL32(?), ref: 0040EA71
_wcscat.LIBCMT ref: 0040EB27
_wcslen.LIBCMT ref: 0040EB5F
_realloc.LIBCMT ref: 0040EB71
_wcscat.LIBCMT ref: 0040EB8B
SetWindowTextW.USER32(?,?), ref: 0040EBBC
_wcslen.LIBCMT ref: 0040EC05
_wcscpy.LIBCMT ref: 0040ED23
_wcsrchr.LIBCMT ref: 0040ED33
_wcscpy.LIBCMT ref: 0040ED52
GetDlgItem.USER32(?,00000066), ref: 0040ED6B
SetWindowTextW.USER32(00000000,?), ref: 0040ED7B
SendMessageW.USER32(00000000,00000143,00000000,%s.%d.tmp), ref: 0040ED8A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0040EDB6

Strings

%s.%d.tmp, xrefs: 0040E999, 0040EA8E, 0040ED51, 0040ED81, 0040ED97
\, xrefs: 0040ECCB
C:\Windows, xrefs: 0040E8B5
", xrefs: 0040EBE1
ProgramFilesDir, xrefs: 0040EC7D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040EC58
<br>, xrefs: 0040EB21

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$File$AttributesMessageSendTextWindow_wcscat_wcscpy$DeleteEnvironmentExpandH_prologItemOperationStrings_memset_realloc_wcsrchr
String ID: "$%s.%d.tmp$<br>$C:\Windows$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$\
API String ID: 3339014310-2533930246
Opcode ID: c81f8d7f1960366ff0ac0b138369ee3006538eb7a10c16c36d47d9a37235cbbb
Instruction ID: 0f1639a2c7fd1c8d50817f8e0d6f0902ef34777a202bf9cba062cd401a3abf5d
Opcode Fuzzy Hash: c81f8d7f1960366ff0ac0b138369ee3006538eb7a10c16c36d47d9a37235cbbb
Instruction Fuzzy Hash: F2F14EB1900219AADB20DBA1DC45BEE7378FF04314F4408BBFA15B21D1EB789A958F59

Function 0040BC32 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 240
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040BC37
_wcschr.LIBCMT ref: 0040BC4E
GetModuleFileNameW.KERNEL32(00000000,?,00000800,004335BC,0040C3B4,0041005C,00439820,0041005C,00439820), ref: 0040BC67
_wcsrchr.LIBCMT ref: 0040BC76
_wcscpy.LIBCMT ref: 0040BC8C
_malloc.LIBCMT ref: 0040BE13

Part of subcall function 00408BAE: SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
Part of subcall function 00408BAE: GetLastError.KERNEL32(?,?), ref: 00408BEE

_strncmp.LIBCMT ref: 0040BD3F
_strncmp.LIBCMT ref: 0040BD9B
_malloc.LIBCMT ref: 0040BE49

Strings

*messages***, xrefs: 0040BD6B
a, xrefs: 0040BD82
*messages***, xrefs: 0040BD39

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File_malloc_strncmp$ErrorH_prologLastModuleNamePointer_wcschr_wcscpy_wcsrchr
String ID: *messages***$*messages***$a
API String ID: 644328012-1639468518
Opcode ID: cfa50f55f05dd38727f7e2c767a8efa24f78901bf0e7e1d2db41408b4bb4ba45
Instruction ID: aa973f8903d1be904dc07ab5abbbb304e5ce1521a2ae556c165a5ca6c4136d8e
Opcode Fuzzy Hash: cfa50f55f05dd38727f7e2c767a8efa24f78901bf0e7e1d2db41408b4bb4ba45
Instruction Fuzzy Hash: 5981F2B1A002099ADB34DF64CC85BEA77A4EF10354F10417FE791B72D1DBB88A85CA9D

Function 0040C15C Relevance: 21.2, APIs: 14, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C075: _wcschr.LIBCMT ref: 0040C0A5

GetWindowRect.USER32(?,?), ref: 0040C185
GetClientRect.USER32(?,?), ref: 0040C192
GetWindowLongW.USER32(?,000000F0), ref: 0040C21E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C242
GetWindowRect.USER32(?,?), ref: 0040C24F
GetWindowTextW.USER32(?,?,00000400), ref: 0040C26E
SetWindowTextW.USER32(?,?), ref: 0040C294
GetSystemMetrics.USER32(00000008), ref: 0040C2A3
GetWindow.USER32(?,00000005), ref: 0040C2B0
GetWindowTextW.USER32(00000000,?,00000400), ref: 0040C2DD
SetWindowTextW.USER32(00000000,00000000), ref: 0040C30D
GetWindowRect.USER32(00000000,?), ref: 0040C320
SetWindowPos.USER32(00000000,00000000,00000000,00000110,00000000,00000110,00000204), ref: 0040C37D
GetWindow.USER32(00000000,00000002), ref: 0040C388

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$RectText$ClientLongMetricsSystem_wcschr
String ID:
API String ID: 4134264131-0
Opcode ID: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction ID: 46c95fab82868b9c938a6533d3e49af797eb3fa96210388a24d02bb49560b234
Opcode Fuzzy Hash: 9886efa1d7aa19233dee01def18c78a05a732e10b374928cec257c7fc49daa0d
Instruction Fuzzy Hash: 9A711671A00219EFDF10DFE8CC89AEEBBB9FB08314F048169FD15B61A0D774AA558B54

Function 0040D298 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 94
windowCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(00000068,00000000), ref: 0040D2A9
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30,00001000), ref: 0040D2D6
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0040D2E2
SendMessageW.USER32(00000000,000000C2,00000000,0042A73C), ref: 0040D2F1
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D305
SendMessageW.USER32(0040639B,0000043A,00000000,?), ref: 0040D31C
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D357
SendMessageW.USER32(0040639B,000000C2,00000000,00000456), ref: 0040D366
SendMessageW.USER32(0040639B,000000B1,05F5E100,05F5E100), ref: 0040D36E
SendMessageW.USER32(0040639B,00000444,00000001,0000005C), ref: 0040D392
SendMessageW.USER32(0040639B,000000C2,00000000,0042A810), ref: 0040D3A3

Part of subcall function 0041918B: DestroyWindow.USER32(?,75A85540,0040D2D3,?,?,?,?,?,0040D3E6,00000001,?,?,0040E2C6,0042A848,0044CF30,0044CF30), ref: 00419196

Strings

\, xrefs: 0040D315

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Window$DestroyItemShow
String ID: \
API String ID: 2996232536-2967466578
Opcode ID: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction ID: 06257c9e161764c7d53c24ae9c51dbab41789d270eb5449b748dea2bf3ac4db1
Opcode Fuzzy Hash: 099f520084dbf5fca48704fc3201186082e925487be8ae0bd6b4d09b2fa327de
Instruction Fuzzy Hash: C431B170E4025CBBEB219BA0CC4AFAEBFB9EB41714F10412AF500BA1E0D7B51D55DB59

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(riched32.dll,00000000,00439820,?,?,?,00410051), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll,?,00410051), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Function 0040DA8C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegCreateKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,C:\Windows), ref: 0040DAD9
_wcslen.LIBCMT ref: 0040DAE7
RegSetValueExW.KERNELBASE(?,?,00000000,00000001,?,?), ref: 0040DB02
RegCloseKey.KERNELBASE(?), ref: 0040DB0B

Strings

C:\Windows, xrefs: 0040DAA4, 0040DAAE
Software\WinRAR SFX, xrefs: 0040DACF

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseCreateValue_wcscpy_wcslen
String ID: C:\Windows$Software\WinRAR SFX
API String ID: 3170333323-1036045337
Opcode ID: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction ID: c04f9cf324d6fb33717342d95d48926d42d97767c878bcc2ae640bd506731f16
Opcode Fuzzy Hash: 253b5885f96daf7b7a8b4f1510ea2afe6e1404dcbc281fb2c19877bebd1cbb3e
Instruction Fuzzy Hash: 7F018476A0020CBFEB21AF90DC86EDA777CEB08388F504076B60562061DA745ED99669

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
CloseHandle.KERNELBASE(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
CloseHandle.KERNELBASE(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 29ee5acdc12332976cb057a69276285ab821669b88e8e9e7981cd7b54762f760
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Function 0040DB16 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040DA4F: _wcscpy.LIBCMT ref: 0040DA54

RegOpenKeyExW.KERNELBASE(80000001,Software\WinRAR SFX,00000000,00000001,?,?), ref: 0040DB51
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 0040DB7E
RegCloseKey.ADVAPI32(?), ref: 0040DBB7

Strings

Software\WinRAR SFX, xrefs: 0040DB47

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseOpenQueryValue_wcscpy
String ID: Software\WinRAR SFX
API String ID: 2005349754-754673328
Opcode ID: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction ID: 4c76dbbd45d9bc8f01a1638326186229006e98cd85c276784524804615dea21e
Opcode Fuzzy Hash: 5a2b69c89800e9bdd399ce0e9e4a259883a1022fe18fb91a4a4725133ef4c013
Instruction Fuzzy Hash: 29110635A0020CEBEF219F90DD45FDE7BB8EF04345F5040B6B905A2191D7B8AA94DB69

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Function 0040D5F7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0040D610
SetEnvironmentVariableW.KERNEL32(sfxpar,00000002,00000000,00000000,?,?,00000400), ref: 0040D643

Strings

sfxcmd, xrefs: 0040D60B
sfxpar, xrefs: 0040D63E

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction ID: 209d7830a902f923c059ddcb8ccd8c76eadbb62e41e0a08ffeb6939b57d6bf06
Opcode Fuzzy Hash: bac05ca2e549dd4e556f3ae34e89e1e7b45a97b9d2e2d38533528fd9b5159ab4
Instruction Fuzzy Hash: 29E0EC3660011437CA102A969C01EBB7A6CDBC1744F1000337E48A2080E979D89E8BED

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: 4d3b36c18a63bf9a6cb3bb75dabf04ddc5da56a9a0870096324c8bcc010d085f
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 89f10ec8c43f5c59ed1e48a3837198038f2aefdd0a2d009fb04471144bad9c18
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: f9e7b2a6a83c73fc1ba99619ebe61da21776ee40c69ad0e57b9b97bafc6a76b5
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNELBASE(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Function 004076AA Relevance: 6.0, APIs: 2, Strings: 1, Instructions: 792COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004076AF

Part of subcall function 00418B3D: _wcscpy.LIBCMT ref: 00418C26

_memcmp.LIBCMT ref: 00407ABB

Strings

E, xrefs: 0040808E

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memcmp_wcscpy
String ID: E
API String ID: 1926841707-3568589458
Opcode ID: 196e278f7dddb126d2dbccce5fe2abb71f5a872f6c9e6e354283e500f103bc2c
Instruction ID: c8680630b07ceb330da05956c27536b96a03d31217007f6de18683c0289c3294
Opcode Fuzzy Hash: 196e278f7dddb126d2dbccce5fe2abb71f5a872f6c9e6e354283e500f103bc2c
Instruction Fuzzy Hash: 4872B870D086849EEF25DB64C844BEA7BA55F05304F0840FFE94A6B2D2C77D7984CB6A

Function 0040D116 Relevance: 6.0, APIs: 4, Instructions: 29windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040D127
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
TranslateMessage.USER32(?), ref: 0040D142
DispatchMessageW.USER32(?), ref: 0040D14C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction ID: 62915b0a08277243b8fe4fd8ce30adb6e130eab43b2b780e39f86cd7d7c3188f
Opcode Fuzzy Hash: db1d2709ee26d26a19af258b04a512226032370801fdef34d6f208b0e00134af
Instruction Fuzzy Hash: 9FE0ED72E0112AA7CB20ABE19C0CDDB7F6CEE062517404021BD05E2015D638D116C7F5

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: d8064b72c640e36a82a0b68421302acdf3e8c056939b4e9f8210efc5c70c758b
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_000111DD,?,00000000,?), ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Function 004126F0 Relevance: 4.6, APIs: 3, Instructions: 110COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0041276B
_malloc.LIBCMT ref: 00412785

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_memset.LIBCMT ref: 004127D8

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_malloc_memset
String ID:
API String ID: 3965744532-0
Opcode ID: aecc41870ac87d010834a5c488dea66f27f1e28d46d9c5665e17219ed6a13b4d
Instruction ID: 1154a5c9599e5537b836a1002f89e902606abe80a59ae87693d08389c363c3d7
Opcode Fuzzy Hash: aecc41870ac87d010834a5c488dea66f27f1e28d46d9c5665e17219ed6a13b4d
Instruction Fuzzy Hash: 05410470905745ABEB25EE38D6C47DBB7D0AF14304F20482FE5A6D3281C7B8A9E4C718

Function 00408AA9 Relevance: 4.6, APIs: 3, Instructions: 104fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?,?,00000001,?), ref: 00408AC5
WriteFile.KERNEL32(00000001,?,00004000,?,00000000,?,?,0040BB41,?,?,00000000,?,?,004124ED,?,?), ref: 00408B01
WriteFile.KERNELBASE(00000001,?,00000000,?,00000000,?,?,?,?,?,0040BB41,?,?,00000000,?,?), ref: 00408B2D

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction ID: f20fcf70e75a5c6d44a32b1c4255a65a5bf54a4d93884812af3801fc7a684339
Opcode Fuzzy Hash: 2630e5a33cfd0af18d09aa74bbfd8346207367a51011a650ef626fa881f46d74
Instruction Fuzzy Hash: 9B31C371300204AFDB209F65CA44BAB77A9EB94310F04813FF996E72C1DB78A905DF29

Function 004092C9 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 0040A08A: _wcslen.LIBCMT ref: 0040A090

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?), ref: 004092F9
CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000800,00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?), ref: 00409328
GetLastError.KERNEL32(00000000,00000000,?,?,?,0040941E,?,00000001,00000000,?,?,?,?,?,?,004067A5), ref: 00409341

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction ID: 5cfd1deac55777c6f3d5c0bdf32a3cf990456680eccb4e8d5c114054f7fd3324
Opcode Fuzzy Hash: e440fb91986ed667ecea05b8623b67f22d0563812c7c3dc4cd5ad5119d8de580
Instruction Fuzzy Hash: DD01C031100204A5DB216A664C42BBB37589B4EB84F88447BFD41F62D2CB7C9C92D97E

Function 0040E2D7 Relevance: 4.6, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E2DC
_wcscpy.LIBCMT ref: 0040E2FC

Part of subcall function 00410D16: _wcslen.LIBCMT ref: 00410D2C
Part of subcall function 00410D16: _wcscpy.LIBCMT ref: 00410D42

_wcscpy.LIBCMT ref: 0040E31A

Part of subcall function 00407150: __EH_prolog.LIBCMT ref: 00407155

Part of subcall function 00407074: __EH_prolog.LIBCMT ref: 00407079

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_wcscpy$_wcslen
String ID:
API String ID: 2067596392-0
Opcode ID: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction ID: 34baa23ef678cdf00172776f2fc4f6da7b22e3ce89fab18911e310d79256e735
Opcode Fuzzy Hash: aa5c2ab907567c22763022a3e14260f934ba444c4f603d8b7408ac10fc9ad921
Instruction Fuzzy Hash: E7112675906294AED705EBA4AC427CD7BA0DB16318F1040AFF444A2292CFB91A90DB6E

Function 00401768 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040176D

Strings

CMT, xrefs: 004017D6

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction ID: 903a9e83ebfadd1395375551f57b58f4375dbb7200b7f1b09ca9293e13445996
Opcode Fuzzy Hash: c5dcd452fd1e4eeec7eacad65d6409f1913b512c17b790326e9b6827e8618ada
Instruction Fuzzy Hash: C5210275600144AFCB05EF6488908AEBBB9EF44314B00C06FF866773E2CB389E01DB68

Function 00401106 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 0040115B

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

Maximum allowed array size (%u) is exceeded, xrefs: 0040112C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __vswprintf_c_l_realloc
String ID: Maximum allowed array size (%u) is exceeded
API String ID: 620378156-979119166
Opcode ID: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction ID: b98885df3920ffeceb53ce79d7a953b92e5ea0a83a6506546a83ec3ee512e677
Opcode Fuzzy Hash: dce6db5a0bfaf73c63961f3884acddfac192c2d93569977231d8791de2d42667
Instruction Fuzzy Hash: 8D014F353006056FD728EA25D89193BB3E9EB88764310483FF99B97791EA39BC548718

Function 00401417 Relevance: 3.3, APIs: 2, Instructions: 264COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040141C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e8d4131a6c0ab78f129bbdc20b8640a8360fcb8037d97d2b6f97067a7eefdc9b
Instruction ID: 1df30631c7f2331ab9bb659be56b51083ca38efb3ea41a431c6c341c2f7f2518
Opcode Fuzzy Hash: e8d4131a6c0ab78f129bbdc20b8640a8360fcb8037d97d2b6f97067a7eefdc9b
Instruction Fuzzy Hash: D7A1A370904B44AFDB31DB38C8447ABB7E5AB45304F14482FE4A7A72E1D779A881CB59

Function 00408923 Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000002,00000000,00000000,?,?,?,-00000011,?,00408777,?,-00000011,?), ref: 004089A5
CreateFileW.KERNEL32(?,000000FF,?,00000000,00000002,00000000,00000000,?,?,00000800,?,?,?,-00000011,?,00408777), ref: 004089DA

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction ID: 01d84b190ee352a3a297c1effa4f932d2cea621e1ee0f9c6dc0f58f94aa457de
Opcode Fuzzy Hash: a074d9b34406725a99dd7798f6dc6781e4ed09d04832e0e73d262d8c08033346
Instruction Fuzzy Hash: F621E6B1000709AFDB20AF28CD41AEA7BA9EB04324F00853EF5D5972D1CA799D859B59

Function 004012EA Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004012EF

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

_wcslen.LIBCMT ref: 00401391

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_wcslen
String ID:
API String ID: 2367413355-0
Opcode ID: 11f42ef8cdaa0769df478fd29a00db720605d229e9827037435442823eb81be9
Instruction ID: 0a298500d8bcfa7ff7c3c7c798daa7998fe1fc2396f24876ea38c2992963b511
Opcode Fuzzy Hash: 11f42ef8cdaa0769df478fd29a00db720605d229e9827037435442823eb81be9
Instruction Fuzzy Hash: 43218131C04219AADF11AF95D8019EFBBBAEF44704F10402FF815B26B1D7791951DB99

Function 0040E75F Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040E764

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401768: __EH_prolog.LIBCMT ref: 0040176D

_malloc.LIBCMT ref: 0040E7CC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog_memset$AllocateHeap_malloc
String ID:
API String ID: 47157355-0
Opcode ID: 8a0e236cf4d95a6c185fe36cf45249ef349d68e2c77d2ed9baa34b65b141d772
Instruction ID: 028989472a53044f7525bc0779393b56fb6d8ddec0b6eee1d5d0b7402cf9aefd
Opcode Fuzzy Hash: 8a0e236cf4d95a6c185fe36cf45249ef349d68e2c77d2ed9baa34b65b141d772
Instruction Fuzzy Hash: 09217F72800259EFCF15EFA5D8819EEB7B4BF08308F10456FE006B3291E7385A44DB69

Function 00408BAE Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001), ref: 00408BE1
GetLastError.KERNEL32(?,?), ref: 00408BEE

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction ID: 02e03e75e993c9a8a945b97f90e28c3a97864ede8bf9f3e31abc9cd0b64ad5c5
Opcode Fuzzy Hash: 401041f812e38b2c9cc7bc658f647880eeddc778264b755613b9ad4916800595
Instruction Fuzzy Hash: 540145B2706204BFE7209B788D458AB36ADCB84334B14423FB192E33C1EA749D00527D

Function 0040C3BF Relevance: 3.0, APIs: 2, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

LoadStringW.USER32(?,-004335D5,00000200), ref: 0040C410
LoadStringW.USER32(?,-004335D5,00000200), ref: 0040C422

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction ID: edfc175873420c56a2918f30daf07abd917a54f8fc7c105ac48efc03a3cacc81
Opcode Fuzzy Hash: 72945bf23e6ae9cf9b0fab0a5a9e43b8bd420b2efeca12c7a5d03f8341522d8c
Instruction Fuzzy Hash: 200186722012107FD6209F19AC85F577BEDEB99351F10543AB900D32A1D6359C01876C

Function 00408F4B Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000001,00000000,?,?,?,?,00408FD1,00000000,00000000,00000000,?,00407DE2,?,?), ref: 00408F9E
GetLastError.KERNEL32(00408FD1,00000000,00000000,00000000,?,00407DE2,?,?,?,?,?,?,?,?), ref: 00408FAA

Part of subcall function 00408E03: __EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFileH_prologLastPointer
String ID:
API String ID: 4236474358-0
Opcode ID: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction ID: 31f7e80921147255a447777291f97898e209bd40052f61b908ef1a5d0e3b9beb
Opcode Fuzzy Hash: fcb39ab4431aa7e293366899b2db99d4a95afe2178fb6d1211a042b2fb6e45d7
Instruction Fuzzy Hash: 1E019631200306DBCF248F64CD046AE776ABF813A5F14463EF8A1A22D0DB78D951DA55

Function 0041A89A Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

__CxxThrowException@8.LIBCMT ref: 0041A8F9

Part of subcall function 0041216A: std::exception::exception.LIBCMT ref: 00412174

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID:
API String ID: 1264268182-0
Opcode ID: 652451197443050397a994e0f1a437ce7b6bc5e6c303dc83bd53091e5d1b5587
Instruction ID: 42064790ed8d2a037bfba99cbedd4ff18ff19c5b52db1d8e26b3e688ef0b8114
Opcode Fuzzy Hash: 652451197443050397a994e0f1a437ce7b6bc5e6c303dc83bd53091e5d1b5587
Instruction Fuzzy Hash: 64F0E23160021972CB047B22ED46ACE37586F01728B10403BFC1199192DFAC9ADA919E

Function 004090E4 Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,-00000011,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000,?), ref: 004090FC
DeleteFileW.KERNEL32(?,?,?,00000800,?,0040877F,?,?,00000001,?,?,?,?,?,?,00000000), ref: 00409126

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction ID: c332a15ca0b0e5e82477794df9822c7aeed54c7470201c7e9f38434531037f1b
Opcode Fuzzy Hash: 0a42f7c6465a65df2585c125a2f12a68c0d7bb240ddda169d7c29578124ac562
Instruction Fuzzy Hash: DBE02B3114122AA7EB00A620DC01FDA3B5C9F043C0F0440737C80E71D1DB75DCE0D9A4

Function 00409041 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409059
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,?,004092AE,?,00406796,?,?,?,?), ref: 00409081

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction ID: f0aa2148c7acefeba2e85b7bc3a11c2245577506fd5686bf0be3bfe97b3e7ecd
Opcode Fuzzy Hash: b25c0f1027ae8764d85bcc1b21548e8f0eb716d18d4362393a4ff3fac8f95358
Instruction Fuzzy Hash: BBE092326101186ACB10A669DC00BDE379D9BC83E5F0401B3BE44E32D5DAB4DD95CBA5

Function 0040DDFF Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040DE2D
SetDlgItemTextW.USER32(00000065,?), ref: 0040DE44

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction ID: 335ddef7e6713e4d0d4f603cdcadd61df7388e1f4a4116fbf7552c9c9eb2c210
Opcode Fuzzy Hash: 8034b9b9aa660211ead63cdf03b6a57d34fff27c13a9ae0071d7a28958d0b1e9
Instruction Fuzzy Hash: 02F0EC75A0420866E711B7A1CC07F9B36589B09789F04047FB601760F3D9795564479A

Function 00410EDB Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00410F17,00409FF4), ref: 00410EE8
GetProcessAffinityMask.KERNEL32(00000000), ref: 00410EEF

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction ID: ae3045e16ef29d64dcafac8e7d0c22bbd438388315c71f77e1501110187c073f
Opcode Fuzzy Hash: 5b6efae98f4fd143c9c11739b7a9d49426725563ed325c59bf560736ad01bde8
Instruction Fuzzy Hash: 86E08672A1020AA78F2897A0CD4A9EF32ACEB01215700087BE503C1640EAF8D5D24629

Function 004060C9 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 004060DE
ShowWindow.USER32(00000000), ref: 004060E5

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction ID: 00e924dde3bcd55588ca107b376b403c6fb897f844ebcc5e5070703d20151260
Opcode Fuzzy Hash: 76029219059209f4090a36f07538af165f69a2de4b0c3b600f66da5fa765a026
Instruction Fuzzy Hash: E7C01232258241FFCB020BB0DC09E2ABBA8ABA5312F10CD68B4A5C1160C23AC024DB22

Function 00402C8B Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402C90

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2adb2e46dfa9c528ebc340105a31a2d546adb33428178d20608c313c98083781
Instruction ID: d2613427887af626ac15b725df06f6c4975e9b849f4698f9cbfae21a5c634ed1
Opcode Fuzzy Hash: 2adb2e46dfa9c528ebc340105a31a2d546adb33428178d20608c313c98083781
Instruction Fuzzy Hash: 8E615870505B40AADB34DB39C999BEBB7E4AF51304F00456FF4AB622C2CBBC2944DB59

Function 0040935F Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 004093C6

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction ID: d4505bb1f71f0a7630b1187c5dc073957316d7994076f763c5609016dbc7fb68
Opcode Fuzzy Hash: eec277942e391c224009335c7c4fdbf9ccf01f1ad50b69e55fa7bc55e694a795
Instruction Fuzzy Hash: 1821F9705412146ADF209BA5C8817EF73A8AF09744F104067FD84E71C2E6BC9DC58799

Function 004071DF Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004071E4

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 64ae09b8b7d6d911e9fbb323825e8f5681d7d5dd0d1dbfba22af46c2c3ac0037
Instruction ID: 0e7476b061c64c38a033d28293548f621ad6c4fedd1d6d7b32e1dff298444af0
Opcode Fuzzy Hash: 64ae09b8b7d6d911e9fbb323825e8f5681d7d5dd0d1dbfba22af46c2c3ac0037
Instruction Fuzzy Hash: F611E336D04216A7CB21AE69D881BAF7774AB84724F00427FF910772C0C77CAD4186AE

Function 004155EF Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004155F4

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorFreeH_prologHeapLast___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 2675452811-0
Opcode ID: 8497dd6851e15abeade78bc1a96ba9a899c127afdb4d8d4cff6b23ee0cc24447
Instruction ID: af90cb06349abb904c7e908c808b67ca80216b7905dff4050bf1b7fec03d4104
Opcode Fuzzy Hash: 8497dd6851e15abeade78bc1a96ba9a899c127afdb4d8d4cff6b23ee0cc24447
Instruction Fuzzy Hash: DA117871210740DAC325FF76DA636DBB7B0AF24304F40091EA06B525D2EFB8BA44CA19

Function 00407150 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00407155

Part of subcall function 0040B8E3: __EH_prolog.LIBCMT ref: 0040B8E8

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Part of subcall function 0041768A: __EH_prolog.LIBCMT ref: 0041768F

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction ID: 4fa22713ff1b1cd4263d7298948381a35fc14f9b7bb01a12f51cc5b8ed2a70ee
Opcode Fuzzy Hash: f4a0015dd81c6367a1e3723969d7ed7b71eec4aecea33b784c0cc5c9c2fc540f
Instruction Fuzzy Hash: B401ADB2A107009AC7109FAAC44029AF7E9FF94310F00842FE459D3390D7B8A9408B59

Function 00408E03 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408E08

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction ID: bd93042bfc1aad2116d0877f42dabf9818625296a81febac24436190ec2c14aa
Opcode Fuzzy Hash: 863cc4a6e1e3a3a4d87e432309fddcfd3b8ff728f9b2f9572ac3dc0eeb2e4462
Instruction Fuzzy Hash: 33F04F35B00214AFD7149F58C889FADB7B5EF48724F208159E912A73D1CB749D008A54

Function 00405512 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405517

Part of subcall function 0040A026: __EH_prolog.LIBCMT ref: 0040A02B

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction ID: fa77f21fc7194b1e08a14eb3a2c561e3cb85337c9bb77c22dcaa42305da5d14c
Opcode Fuzzy Hash: 8d7273e43c00e3d352773117abe9a80c711290f191c18f656fba03e9df2d1900
Instruction Fuzzy Hash: A2013130901694DAD715EBA5D1157DDB7B49F14308F00449FE456532C3DFF82B84CB66

Function 004096BC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

Part of subcall function 0040A0A4: _wcspbrk.LIBCMT ref: 0040A0B5

FindClose.KERNELBASE(00000000,00000800,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004096EC

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseFind_wcspbrk
String ID:
API String ID: 2190230203-0
Opcode ID: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction ID: c5db38677187ea9b8dec244fb3c8af9ff7d0a6647eff614e001a313c4cd0766c
Opcode Fuzzy Hash: 85123c6e94d2e517bbdffd63dea6bf8ab785228859dafa86eb4c7b41f0ab578b
Instruction Fuzzy Hash: 21F09635005380ABCA225B658404AC77B945F55365F048A1EB1F9621D7C279545ADB26

Function 00407074 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00407079

Part of subcall function 004155EF: __EH_prolog.LIBCMT ref: 004155F4

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b7d3c8e010c571e5a6642b72fc2b2d393aaf48cfcd88e5119046994b0af1dfd5
Instruction ID: da238740c98ae75ebc3f5927faf798116ad114c2e9bc9b884e51ec1b39bdab83
Opcode Fuzzy Hash: b7d3c8e010c571e5a6642b72fc2b2d393aaf48cfcd88e5119046994b0af1dfd5
Instruction Fuzzy Hash: D1E06D32A11610ABC715AB29C4066EEF3B9EFC0728F10422FA062636C1DBB86D418659

Function 00410DDE Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00410E13

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction ID: ce8ef4de1523c5d0242b00cb845f3d850d1a93a8e5a83f46045a12d46b5ed054
Opcode Fuzzy Hash: 99114e7ac6e4293e68323f01352a3d081b9a398302f12d6f006bb62c0eb9cb63
Instruction Fuzzy Hash: 62D0C23170015022CA213B2B2815BEE56194F81724F0900BFB501622E38EAC09C281EE

Function 00409720 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00409741

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction ID: 57c48ace6bef99692c10c7cc37c4410ce12e8001caaa4568d5ee7d388360cf58
Opcode Fuzzy Hash: c61d5f3dc6c1f9b97ffe444c65296dc1c5881d1e0fbf0653a527c25b506bb31f
Instruction Fuzzy Hash: D7E0CD729053406AD371751D9C04F579AD85B95725F14C82FB089A32C3C1BC5C51C759

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Function 00408C5A Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00408CDA,?,00408EB0,?,00000000,?,?,00000000), ref: 00408C66

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction ID: 2361e1c995e4a541e26ad64c94d2af3b89e31d8e4072a4a2db2c19a8efa4df55
Opcode Fuzzy Hash: b9077224b9f88db5cd0ce6d94ac7233058a1c10921077028cad7c3ce69d3e2a2
Instruction Fuzzy Hash: 8EC0127151610056DF2046385A8845B376687433667789FF9E071D12E5CB3ECC56B025

Function 0040D513 Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0040D530

Part of subcall function 0040D116: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0040D127
Part of subcall function 0040D116: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0040D138
Part of subcall function 0040D116: TranslateMessage.USER32(?), ref: 0040D142
Part of subcall function 0040D116: DispatchMessageW.USER32(?), ref: 0040D14C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$DispatchItemPeekSendTranslate
String ID:
API String ID: 4142818094-0
Opcode ID: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction ID: 888b2871e718dea131dfcf0ec1cbc21fe8f041a13ed789b986bd41985b0bed4c
Opcode Fuzzy Hash: 7040c51d5953534f53b945be8071fa726febfab1a70e776a765f2f75df90e843
Instruction Fuzzy Hash: FDC01235240300ABE7117B50DD07F1A3A62BB88B09F808039BA81380F2CEB648369A0A

Function 00408C47 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,004080D7,?,?,?,?,?,?), ref: 00408C4A

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction ID: 463f2a0b6f7528456a39aa395305c1415068e572747894341c9f749ccc5f34b3
Opcode Fuzzy Hash: 372b206049e22359e890f019f69c17f88631756899d3b8a56b0e056d033f7bf1
Instruction Fuzzy Hash: 80B012703E0006878E102B30CD084143910D71130630041B0600AC6061CB13C0135611

Function 00419C88 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0040D8E5,0042A65C,00000000,?,00000006,?,00000800), ref: 00419C8C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction ID: 2a7281b05ebb75ae791a00df68b116ffeccc810d55834c007acaed3bb23dd98c
Opcode Fuzzy Hash: 35c8f440b0c787f752f8f5ff34d68e699b4f54a7e8ae052c3817328c3539a25c
Instruction Fuzzy Hash: 50A012302940064F8A100B30CC0D82577506760702F0096307002C10A4CB304430A505

Function 00408A32 Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,759220B0,00000000,0040868D,?,?,?,?,00407427,?,00000000,?,00000800,?,?,?), ref: 00408A4D

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction ID: ad6283f58ebf58fc73997c28fab75cfea7daa8eae0e70c9973603df5d86841c1
Opcode Fuzzy Hash: b21f32aa194ba9df83e0161a33b0e827325d82f6e4b9bdb228d687f297159138
Instruction Fuzzy Hash: 55F027706427044FD73056384A4879333D85B16331F049B2FD8E2A3BC0CB7898894E64

Non-executed Functions

Function 0040DE5E Relevance: 52.8, APIs: 27, Strings: 3, Instructions: 291windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0040DED8
DestroyIcon.USER32(00000000), ref: 0040DEE3
EndDialog.USER32(?,00000006), ref: 0040DEEB

Strings

%s %s, xrefs: 0040E07C, 0040E183
%s %s %s, xrefs: 0040E003, 0040E124
REPLACEFILEDLG, xrefs: 0040DE76

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: DestroyDialogIconItemMessageSend
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 3309745630-1840816070
Opcode ID: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction ID: 1ca02d43f13477766b0e0b2ecc80fe6690186a1d560daa565d76ee57e1f32e2a
Opcode Fuzzy Hash: 16eeae55bdc9405558cec747ebfcc07caac1c70e605718ffa483f40035c658e6
Instruction Fuzzy Hash: 56A18272A4021CABEB21DFE0CC85FEF776DEB04704F440476BA05E60D1D6789E5A8B65

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

SeRestorePrivilege, xrefs: 00406927
UNC\, xrefs: 004069B5
\??\, xrefs: 00406993
SeCreateSymbolicLinkPrivilege, xrefs: 00406931

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 61ce2a1e948bc651cc5c71645e7a660e15ad332992f425926efc10dd858bd714
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 61ce2a1e948bc651cc5c71645e7a660e15ad332992f425926efc10dd858bd714
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Function 004106F4 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

__byteswap_ulong.LIBCMT ref: 00410726
__byteswap_ulong.LIBCMT ref: 00410739
__byteswap_ulong.LIBCMT ref: 0041074C
__byteswap_ulong.LIBCMT ref: 0041075F
__byteswap_ulong.LIBCMT ref: 00410772
__byteswap_ulong.LIBCMT ref: 00410785
__byteswap_ulong.LIBCMT ref: 00410798
__byteswap_ulong.LIBCMT ref: 004107AB
__byteswap_ulong.LIBCMT ref: 004107BE
__byteswap_ulong.LIBCMT ref: 004107D1
__byteswap_ulong.LIBCMT ref: 004107E4
__byteswap_ulong.LIBCMT ref: 004107F7
__byteswap_ulong.LIBCMT ref: 0041080C
__byteswap_ulong.LIBCMT ref: 0041081F
__byteswap_ulong.LIBCMT ref: 00410832
__byteswap_ulong.LIBCMT ref: 00410845

Strings

@Z@, xrefs: 00410928, 00410930, 00410944, 00410961

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __byteswap_ulong
String ID: @Z@
API String ID: 2309504477-3109265564
Opcode ID: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction ID: 1dc3a99616fea8f09d0a2898b21a56a39af3494018e3c7a499627515aa5f83aa
Opcode Fuzzy Hash: 3d995ba0cc5bd3afd1912a8f52df84b91350d78957cf3c3d8552aa4fe151a300
Instruction Fuzzy Hash: 869119B1A006148FCB24DF5AC881A9EB7F1FF48308F1445AEE59AE7721D734E9948F48

Function 0040CEB6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

Strings

Crypt32.dll, xrefs: 0040CEBF
CryptUnprotectMemory, xrefs: 0040CEDF
CryptProtectMemory, xrefs: 0040CED7

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2238633743-1753850145
Opcode ID: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction ID: 6e3b8f00ce2f8e0fa430b510b5536735c08c44b91adf59875fbb0715622b898a
Opcode Fuzzy Hash: 5fe6950aaff99067424b8bdf76d8a3167c7df5a56d66711809a8faa92a841fba
Instruction Fuzzy Hash: 7EE092306003119FD7319F79EC44B03BBE89F94B10B14846FE984E3250C6B8D4518B5D

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: a938faf7c17183071b0639e51388f91889b5cef4979cfb0538ab3c6a938d128c
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: a938faf7c17183071b0639e51388f91889b5cef4979cfb0538ab3c6a938d128c
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Function 0040D155 Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0040D17B
GetNumberFormatW.KERNEL32(00000400,00000000,?,004300CC,?,?), ref: 0040D1CA

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction ID: 2e86bd0250e0b4fef5c8dc12a3830970d19becb9d4c55c3472b337e1343b8b10
Opcode Fuzzy Hash: fae0c5bc4c9ea969901553f08fe9413b92117c2e4d377c34b7ff725826ea960f
Instruction Fuzzy Hash: DB017C35600248AEE710DFA4EC41FAAB7FCEF09714F005426FA04EB1A0D3B89915CB6D

Function 00410178 Relevance: 2.8, Strings: 2, Instructions: 289COMMON

Download Yara Rule

Strings

<D, xrefs: 004101A8
DD, xrefs: 004101FD

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: <D$DD
API String ID: 0-3036587789
Opcode ID: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction ID: 59a02f745f793eb532b4d9e305735a670a6f692f985c4356a20c5044c607aa25
Opcode Fuzzy Hash: a120047ceaa170e9019935171625ae5ad03bfb54992e95746f25c16dbdc0a917
Instruction Fuzzy Hash: E8D15D72A0061ACFCF14CF58D884599B3B1FF8C308B2685ADE919AB245D731BA56CF94

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 19fe713726019c3973d82b14b26a9fc68d02c60563561d4d82d0835d1efeca77
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Function 0040CA52 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040CAEC

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction ID: e1f0199fda650a5869103b9083c5b7a650503f912fa59dbaeb4dd54c60283149
Opcode Fuzzy Hash: f170c41e67568dbb41c50a43ec108573c349a1076046e87b2a713adcc681154b
Instruction Fuzzy Hash: 0721F672704209DFD724CF28D4817AA7BE5AB19300F10892FD896E73C2C678E9458B49

Function 00409C06 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00409C2B

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction ID: d7c6bb9a1732f6c2eece22a2b410928bcf9985e9f3444315991ea75afaaef588
Opcode Fuzzy Hash: 1145292b874a8e7a56bde58bed546469a1a499fc1dbdbc0264d61b52db470385
Instruction Fuzzy Hash: E4F0F4B1A041088FDB28CF18E992A99B7F5A748305F1002A5D619D3390DA78AE81CF69

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Function 00416C3F Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 345b0d20b664bc5a7c067b8b85495d146ce8f508c18b5b2458494fa8c5d0ce26
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Function 00415D9A Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 55f74d88c168b2656ab75066bc4e011c1757566443c1fcad1fbcf06b528a1986
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Function 0041BCD9 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Function 0041B8B9 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Function 0041B4AD Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Function 0041B0D9 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Function 0041462B Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Function 0040CB23 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction ID: 755fc568a246bd0a3aab6df15388740ae6706893d1001b075bd9344283f82762
Opcode Fuzzy Hash: 10288e97197f0ad943ca35c4742294250ec2590f5ea2a5543df369fbf88b7a0a
Instruction Fuzzy Hash: FFC151B48182D9AECF01DFA5D4A09FEBFF4AF1A240B0950DAE5D5A7252C234D720DB64

Function 0040C756 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction ID: cc05d4957c3f93bbff5645bcbd2bf23a73745bdaee5f26767fd414b38deba9ac
Opcode Fuzzy Hash: e054519032d673b283cd141de9047936413c4ec94c95275afdf7b1c1e6e7c11b
Instruction Fuzzy Hash: 7281E35220E2E18EE71AC73C14E96F63FA11F72100B2EA2EEC4CD4F6D7D665051AD729

Function 0040C4FF Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction ID: ff0af43037c4d522a8ee791cbe8e93d8d44487ff0532052a3f1666816209b0e9
Opcode Fuzzy Hash: aae54acdac3927cc066ee4afd89015ce1ad81bcf754d871dab6d471837bf2d3e
Instruction Fuzzy Hash: CF51F874804298AACF11CFA4C4D05FDBFB0EF5A328F6955BFD8857B282C2356646CB94

Function 0041450F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Function 00405610 Relevance: .1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Function 0040A3DC Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040A403
_wcsncpy.LIBCMT ref: 0040A43A
_wcscpy.LIBCMT ref: 0040A444

Strings

UNC, xrefs: 0040A487
\\?\, xrefs: 0040A434, 0040A479, 0040A4E5, 0040A53D

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen_wcsncpy
String ID: UNC$\\?\
API String ID: 677062453-253988292
Opcode ID: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction ID: cd13f9bd72fca169d524aa050727d65a10ef4dcd9f377a8cbe6755f4863ba3db
Opcode Fuzzy Hash: 2abde0defb8e8217f0e08e38dadbd9202aa69e0edf90a9fc0407522747aefdaa
Instruction Fuzzy Hash: 7441AF7294131476DB20AA618C82AEB33687F55748F04442FF954732C2E7BCD6A586AB

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009,?,<html>,00000006), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

utf-8"></head>, xrefs: 004197D5
</html>, xrefs: 00419821
<html>, xrefs: 004197BE, 004197C3, 004197FB
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscat$Global_wcslen$AllocAllocateByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4158105118-4209811716
Opcode ID: b13132087b6157768e62f45c8a46c0f1663856c825173c1b80b74b9a5b241520
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: b13132087b6157768e62f45c8a46c0f1663856c825173c1b80b74b9a5b241520
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Function 0040E46C Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 174windowCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0040E489
_memset.LIBCMT ref: 0040E4A4
ShellExecuteExW.SHELL32(?), ref: 0040E59A
IsWindowVisible.USER32(?), ref: 0040E5D3
ShowWindow.USER32(?,00000000), ref: 0040E5E1
WaitForInputIdle.USER32(?,000007D0), ref: 0040E5EF
GetExitCodeProcess.KERNEL32(?,?), ref: 0040E60C
CloseHandle.KERNEL32(?), ref: 0040E62B
ShowWindow.USER32(?,00000001), ref: 0040E684

Strings

.exe, xrefs: 0040E636
z(D, xrefs: 0040E53A
.inf, xrefs: 0040E557

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_memset_wcslen
String ID: .exe$.inf$z(D
API String ID: 3215649069-3601587883
Opcode ID: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction ID: 3e26098100528e53db86749210a7047ac1cc05a8490cbdb1dbf577081e62715c
Opcode Fuzzy Hash: bed88ef6189cab0bc2363a68129e730fc28d238946ac4723ee352b551c7a999f
Instruction Fuzzy Hash: 8051B571910258BADF31AFA2EC405AE7BB4EF11304F444C7BE841B72E1E77999A5CB09

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000,00000000,?,?), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32(00000030), ref: 00419A8E

GetWindowRect.USER32(?,?), ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32(00000000,00000000), ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32(00000000,RarHtmlClassName,00000000,40000000,?,?,?,?,00000000), ref: 00419B3B
ShowWindow.USER32(?,00000005,?), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 16e1c11b631fea3f24aabbe380a880f14a925712ab14143eb1e2f30964cb5bb4
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 16e1c11b631fea3f24aabbe380a880f14a925712ab14143eb1e2f30964cb5bb4
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: 446a76bb310dad6e5806d0052d9e568853349a282fe8c87d623ef543e340e0f8
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,00000200), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,00419EBD), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32(00000000,?), ref: 00419DC0

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
DecodePointer, xrefs: 0041E8A2
EncodePointer, xrefs: 0041E88E

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Function 0040F0C2 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0040F152
_wcscpy.LIBCMT ref: 0040F171
_wcschr.LIBCMT ref: 0040F17F
_wcscpy.LIBCMT ref: 0040F19F
_wcscpy.LIBCMT ref: 0040F229
_wcscpy.LIBCMT ref: 0040F2E1
_wcscpy.LIBCMT ref: 0040F35E

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

SHChangeNotify.SHELL32(00001000,00000005,00000000,00000000), ref: 0040F3F0

Strings

.lnk, xrefs: 0040F321, 0040F331
", xrefs: 0040F157

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$ChangeNotify_wcschr_wcsncpy
String ID: "$.lnk
API String ID: 1911921660-4024015082
Opcode ID: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction ID: e9d5912a6b4b3542aee3cadb88dbd3b5a863ff0206024957ce050cac0ef3000c
Opcode Fuzzy Hash: bb3ca6cd81c2d3ad9077df71b8a1193f574709db9a1feafa84c70d00a6701fe0
Instruction Fuzzy Hash: 5191227280022899DF35DBA5CC49EEEB37CBB44304F4405BBE509F7181EB789AD98B59

Function 0040EEC9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?), ref: 0040EEE6

Part of subcall function 0040A116: _wcslen.LIBCMT ref: 0040A11C
Part of subcall function 0040A116: _wcscat.LIBCMT ref: 0040A13B

_swprintf.LIBCMT ref: 0040EF22

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

SetDlgItemTextW.USER32(?,00000066,?), ref: 0040EF44
_wcschr.LIBCMT ref: 0040EF77
_wcscpy.LIBCMT ref: 0040EFBB
_wcscpy.LIBCMT ref: 0040EFE4
_wcscpy.LIBCMT ref: 0040EFF7
MessageBoxW.USER32(?,00000000,00000000,00000024), ref: 0040F027
EndDialog.USER32(?,00000001), ref: 0040F049

Strings

%s%s%d, xrefs: 0040EEFF, 0040EF19

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy$DialogItemMessagePathTempText__vswprintf_c_l_swprintf_wcscat_wcschr_wcslen
String ID: %s%s%d
API String ID: 1897388972-1000756122
Opcode ID: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction ID: 7c5ef0a1406295de31e953a15a9408ca88d5d0b5476cb7747de3243763a4baae
Opcode Fuzzy Hash: f75e7cfbeccc15e09081c60efc06442c44850a7c3c336a2ff36c1e07c701c860
Instruction Fuzzy Hash: 325176728001199BDB21DF61DC44BEE77B8FB04308F0445BBEA09E7191E7789AE98F59

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

 , xrefs: 00419292
, xrefs: 0041922D
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209
<br>, xrefs: 00419255

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy_wcslen$AllocateHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2405444336-406990186
Opcode ID: ef4270a2c62554232e7dcaf25c2b62ab2229b7f12839ff23f0a1ced700b27f0b
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: ef4270a2c62554232e7dcaf25c2b62ab2229b7f12839ff23f0a1ced700b27f0b
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Function 0040F47B Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000080,00000001,?), ref: 0040F4E4
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0040F4F9
GetDlgItem.USER32(?,00000065), ref: 0040F508
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0040F51D
GetSysColor.USER32(0000000F), ref: 0040F521
SendMessageW.USER32(?,00000443,00000000,00000000), ref: 0040F531
SetForegroundWindow.USER32(?), ref: 0040F54B
EndDialog.USER32(?,00000001), ref: 0040F57E

Strings

LICENSEDLG, xrefs: 0040F487

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: MessageSend$Item$ColorDialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3794146707-2177901306
Opcode ID: d29b6d15fe2784098a0e22a55afb32f4fb9deba78a5e36aabb146d1ab528ff85
Instruction ID: 7fefae372e04e04a7da23b2667bfd905224a5402d39c62195e2e2b0091848963
Opcode Fuzzy Hash: d29b6d15fe2784098a0e22a55afb32f4fb9deba78a5e36aabb146d1ab528ff85
Instruction Fuzzy Hash: E521F9312002047BDB31AF61EC45E5B3B6DEB89B10F408436FE15B51E2D6798955CB2C

Function 0040DBC1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0040DBE1
GetClassNameW.USER32(00000000,?,00000800), ref: 0040DC1A

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

GetWindowLongW.USER32(00000000,000000F0), ref: 0040DC38
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0040DC4F
GetObjectW.GDI32(00000000,00000018,?), ref: 0040DC5E

Part of subcall function 00419E13: GetDC.USER32(00000000), ref: 00419E1F
Part of subcall function 00419E13: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00419E2E
Part of subcall function 00419E13: ReleaseDC.USER32(00000000,00000000), ref: 00419E3C

Part of subcall function 00419DD0: GetDC.USER32(00000000), ref: 00419DDC
Part of subcall function 00419DD0: GetDeviceCaps.GDI32(00000000,00000058), ref: 00419DEB
Part of subcall function 00419DD0: ReleaseDC.USER32(00000000,00000000), ref: 00419DF9

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0040DC85
DeleteObject.GDI32(00000000), ref: 0040DC90
GetWindow.USER32(00000000,00000002), ref: 0040DC99

Strings

STATIC, xrefs: 0040DC20

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction ID: 65505d2462e9bd66d8f24c48bff8a2f322d46b7930d969d63ebb67ecbc3f0dac
Opcode Fuzzy Hash: 9567939a25e22092ccbfb99d506bbc14daa15c8c25c728e04901b5a25124ff52
Instruction Fuzzy Hash: B321F132A40204BBEB21AB90CC46FEF77B8AF41B50F404026FD04B61C1CBB89D86D66D

Function 0040BF1D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0040BF8C
_strlen.LIBCMT ref: 0040BFBD
_swprintf.LIBCMT ref: 0040BFDF
_wcschr.LIBCMT ref: 0040C004
_wcsncpy.LIBCMT ref: 0040C038
_wcsrchr.LIBCMT ref: 0040C049
_wcscpy.LIBCMT ref: 0040C067

Strings

%08x, xrefs: 0040BFD4

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _strlen$_swprintf_wcschr_wcscpy_wcsncpy_wcsrchr
String ID: %08x
API String ID: 3224783807-3682738293
Opcode ID: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction ID: 07d0537aec3a1dd66ebb0c57739ff8632de72c66deae5d09d2d4ff76284a4df6
Opcode Fuzzy Hash: 2200e9e523ffbcd5ccc4f85804e7305beb7f218704d283e0c38cbcae486b8257
Instruction Fuzzy Hash: 4841E832500219AADB24AB64CC85AFF32ACDF40754F54413BB915E71C1DB7DDD80C6AE

Function 0040A8A1 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0040A76A: _wcsrchr.LIBCMT ref: 0040A77E

_wcslen.LIBCMT ref: 0040A8D7
_wcscpy.LIBCMT ref: 0040A90C

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

_wcslen.LIBCMT ref: 0040A94C
_wcscpy.LIBCMT ref: 0040A9BE

Strings

exe, xrefs: 0040A8E8
rar, xrefs: 0040A906
sfx, xrefs: 0040A8F7
.rar, xrefs: 0040A8B8

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$_wcscpy$_wcsncat_wcsrchr
String ID: .rar$exe$rar$sfx
API String ID: 1023950463-630704357
Opcode ID: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction ID: 29a0ca65efafee0ddffcc544de8f71498ac5d95f7ded716494b7ad5447c572c4
Opcode Fuzzy Hash: 9e98728e43a4f5731da7381b6b017391db5884caad39c64eb22fb19538172cba
Instruction Fuzzy Hash: 233106B170431056C3206B259C46A7B63A8DF05794B264C3BF882BB1E1E77C98E2925F

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32(?), ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204,?), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: RtlFreeHeap.NTDLL(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: 748e2987246eabe4ea9cf9adf1aa4bbad94aab04b0c2a3b2d0d409a63cb1e23e
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: 748e2987246eabe4ea9cf9adf1aa4bbad94aab04b0c2a3b2d0d409a63cb1e23e
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Function 004084EE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00408535

Part of subcall function 0040A5DB: _wcslen.LIBCMT ref: 0040A5E1

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,00000000,000000FF,00409CA8,?,00000000,?,00409DC2,00000000,-00000002,?,00000000,?), ref: 00411E76

_swprintf.LIBCMT ref: 004085CD

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen_wcsncpy
String ID: rtmp%d
API String ID: 506780119-3303766350
Opcode ID: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: a91559be58acffd0dc5b452dff065d579de74766ff3e95af3a762548e6537785
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Function 0040AA7D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0040AAA4

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

_wcschr.LIBCMT ref: 0040AAC2
_wcschr.LIBCMT ref: 0040AAD2
_wcsncpy.LIBCMT ref: 0040AAF8

Strings

%s.%d.tmp, xrefs: 0040AA82
%c:\, xrefs: 0040AA9A

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf_wcsncpy
String ID: %c:\$%s.%d.tmp
API String ID: 2474501127-1021493711
Opcode ID: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction ID: b4756b8e91951cb7d51e69898c9cc4431ccaeceaeab60524178106c8bdd82eb4
Opcode Fuzzy Hash: da4b65786035d2197ed7d49f53fcd311549ea47fe36f06ac93baee63d6beaa20
Instruction Fuzzy Hash: 8101042320431169DA20EB769C45C6B73ACDFD93A0B00883FF584E31C1EA78D4A0C27B

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32(?), ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Function 00419EA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 184comCOMMON

Download Yara Rule

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32(00000000,00000000), ref: 00419E8F

GetObjectW.GDI32(00000200,00000018,?), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,00000000,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,00000200,00419EBD), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,00000200), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,00000200,00419EBD,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,00419EBD), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32(00000000,?), ref: 00419DC0

Strings

(, xrefs: 00419FA5

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: (
API String ID: 189428636-3887548279
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

</p>, xrefs: 00419549
</style>, xrefs: 004195B3
<style>, xrefs: 00419598
<br>, xrefs: 00419560

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AllocateHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 4208083856-1200123991
Opcode ID: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 84057df06bfe7753af8be449b5ed96cf61f8b1a65555f0712547b90151fa4e6f
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00409C06: GetVersionExW.KERNEL32(?), ref: 00409C2B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: b334752188d409053c41308d043ef773f1ba1375d33674074c65fffa3be1e0d1
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Function 0040D92D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040D941

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcslen.LIBCMT ref: 0040D981
_wcscat.LIBCMT ref: 0040D998
_wcslen.LIBCMT ref: 0040D99E
_wcscpy.LIBCMT ref: 0040D9CC

Strings

}, xrefs: 0040D970

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$AllocateHeap_malloc_wcscat_wcscpy
String ID: }
API String ID: 2020890722-4239843852
Opcode ID: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction ID: a9b9a9eb170ff11f00d7125a4cd00596761e48c06437fb6caf1dcbb108c8f9f0
Opcode Fuzzy Hash: 87a1d4075c0fbabaaf42ee75a1288eb88e4c448287557cbd43c96a9187b86b14
Instruction Fuzzy Hash: 6111B771D0131A59EB25ABE08CC57DB72B8DF00354F10007BE645E22D1EBBC9A99C39D

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: f90245df41cc322dafe52bf530a12eef1bc8a67292351d8d3269b2ac88901438
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Function 0040D64B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,?,?,?,00000400), ref: 0040D6AC
CharUpperW.USER32(?,?,?,?,?,00000400), ref: 0040D6D3

Strings

z8D, xrefs: 0040D71F
-, xrefs: 0040D696

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CharUpper
String ID: -$z8D
API String ID: 9403516-4016828469
Opcode ID: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction ID: 6cb870ea5eaa954c7fe556a8e422e29c236d8a0fbf71e72dd1f5d8a9bc66e192
Opcode Fuzzy Hash: 6e6643a8c5453ab08bb62a8daeba662149a01c951e73f69a55f52de3d79d5015
Instruction Fuzzy Hash: FE21A5B9C0011995DB60B7E98D48BBB66A8FB41304F144177E548B32D2EA7CDECC8B6D

Function 0040680A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeRestorePrivilege, xrefs: 00406867
SeSecurityPrivilege, xrefs: 00406852

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FileH_prologSecurity
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-639343689
Opcode ID: 72cefa14781493d3ceb14cba897e291cfc2eee12fd1132a67d2d49c664862da8
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: 72cefa14781493d3ceb14cba897e291cfc2eee12fd1132a67d2d49c664862da8
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Function 0040E1B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040E1E8
DialogBoxParamW.USER32(GETPASSWORD1,?,0040D477,?,00000007), ref: 0040E22C

Strings

GETPASSWORD1, xrefs: 0040E221
z8D, xrefs: 0040E26A
z8D, xrefs: 0040E1CE

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1$z8D$z8D
API String ID: 3157717868-3779298832
Opcode ID: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction ID: 2ec29a5f94ea44b227bd1a9c17bea14e87d691145e51ce1093468d312523c58d
Opcode Fuzzy Hash: 8a5930b9f1bd4a7920270691445133db6bb9d1af5357342886f90841ecad1a96
Instruction Fuzzy Hash: B71159717002445BEB21DF62AC80B973B99AB08765F08007BFD446B2D1C7BC8CA0C76D

Function 0040D3EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0040D431
GetDlgItemTextW.USER32(?,00000066,00000800), ref: 0040D447
SetDlgItemTextW.USER32(?,00000065,?), ref: 0040D461
SetDlgItemTextW.USER32(?,00000066), ref: 0040D46C

Strings

RENAMEDLG, xrefs: 0040D3FD

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: RENAMEDLG
API String ID: 1770891597-3299779563
Opcode ID: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction ID: a809f9c23db95260371581c6ee5cd384337b37eb9584205a8113e0e6bfd29c9a
Opcode Fuzzy Hash: 762bcebfea9f2beca08e3ffb6bbc5115bfac0753acb3b7587415e25b8287d6f5
Instruction Fuzzy Hash: 6F01D836A4421877DB205F949C41FBB3B69E705F50F544036FA01B61D0C6BAA8269BAE

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

MOC, xrefs: 0041DAE0
csm, xrefs: 0041DAE7

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(02151690), ref: 00421C2B

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: c07a23924f397adfee97157b358641d3c25638586169e8846753b2e06e7a59ec
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: c07a23924f397adfee97157b358641d3c25638586169e8846753b2e06e7a59ec
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,00000000,?,?,00000000,?,00409F60,__rar_,00000000,00000006,00000000,?,00000800), ref: 00411ED5

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Function 0040272E Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 405COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00402A44

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _swprintf
String ID: ;%u
API String ID: 589789837-535004727
Opcode ID: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: 8d6632be75e15c05decfb529c35803f2aea70f16b1fc9be6edc689b65e1f5e46
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: e5527970fedf9361396c35484b990f069b2c3a7e4f541cdd1bc40a5546d77403
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: e5527970fedf9361396c35484b990f069b2c3a7e4f541cdd1bc40a5546d77403
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 7b9b9af83664cc87fe2d3df4d2851bf5f64a8acbd8ca5ef161931a2b21923617
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,75923110,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: 5e0e7d49851dca55c4deade094d134f4ea512213999111766949daa2ff960fa4
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Function 0040D53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0040D5BE
GetDlgItemTextW.USER32(?,00000065,?,?), ref: 0040D5D3
SetDlgItemTextW.USER32(?,00000065,?), ref: 0040D5E8

Strings

ASKNEXTVOL, xrefs: 0040D54D

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: ASKNEXTVOL
API String ID: 1770891597-3402441367
Opcode ID: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction ID: 7c41b1936654f57e10877f1e9afce92132798bffb5e44c1de30f76ec9c95968c
Opcode Fuzzy Hash: a8a6f44b6775d0cd3294368f2a4b23b4347bfb04fbb05bfaf2c83a68a4392c99
Instruction Fuzzy Hash: 23118135600104BBDB219FA49C45F663775EB0A718F044036FE01FA1E0D77AD825AB59

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: 653566bfccebebc550ca30b6af37db387d4266e4fa5bc9fcb69beb97700c845e
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Function 0040D477 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 0040D4BE
GetDlgItemTextW.USER32(?,00000065,?,00000080), ref: 0040D4D6
SetDlgItemTextW.USER32(?,00000066,?), ref: 0040D504

Strings

GETPASSWORD1, xrefs: 0040D489

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ItemText$Dialog
String ID: GETPASSWORD1
API String ID: 1770891597-3292211884
Opcode ID: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction ID: 3eed9e1ab7e5d8a1da33783b11a95132ac7616313df89bdc2d2bc64375715bf5
Opcode Fuzzy Hash: 2c39065e7e84a8441d2400259efe6a077f35be0b7a0eee454e8495a0c984ab02
Instruction Fuzzy Hash: 4F11CE329001187ADB219FA1AC44EFB3A6DEF59754F404036FD05B20D0C67CD96A96AA

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Function 0040E6CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 0040E72A
REPLACEFILEDLG, xrefs: 0040E714, 0040E746

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction ID: 0892b1485419df81b4422e2148389c4265d0283c5dc75372e36aae0ff2247616
Opcode Fuzzy Hash: 9dc2c4e2a994375845b1e54b9a4a57574d7f38f83bee2a11927b5ffac3eaf025
Instruction Fuzzy Hash: AF017576604204BFC712AB55EC44A167BD5E74A751F040837F901E32B0D3764865DB6E

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Function 0040C0F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0040C105
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 0040C114

Strings

RTL, xrefs: 0040C10D, 0040C112, 0040C146
LTR, xrefs: 0040C124, 0040C129, 0040C138

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: LTR$RTL
API String ID: 3537982541-719208805
Opcode ID: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction ID: 3bee6f5c2cd76a6cf6446ed83b6680fa0d6a216d229c8f919e909fc3329ffe0a
Opcode Fuzzy Hash: f2852aa2e9ae8da3690023ec4cfec567c4dc869793b37f459442400b2d93c3ba
Instruction Fuzzy Hash: 69F0243238026467DA2067756C4AFE72B7CAB81310F44057AB605E71C1CFA8D499CBEE

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

IsProcessorFeaturePresent, xrefs: 00423472
KERNEL32, xrefs: 00423463

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32(00000030), ref: 00419A8E

Strings

0, xrefs: 00419A4C
RarHtmlClassName, xrefs: 00419A84

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,0040FF03,00000001), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

SetDllDirectoryW, xrefs: 00410E2B
kernel32, xrefs: 00410E1C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,?,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED,?,?,?), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00409901,?,?,?,0040BB60,?,?,00000000,?), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00409901,?,?,?,0040BB60,?,?,00000000,?,?,004124ED), ref: 00410F7E

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Function 00411A8F Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D5,00000200), ref: 0040C410
Part of subcall function 0040C3BF: LoadStringW.USER32(?,-004335D5,00000200), ref: 0040C422

_swprintf.LIBCMT ref: 00411AB8

Part of subcall function 0040BC16: __vswprintf_c_l.LIBCMT ref: 0040BC29

GetLastError.KERNEL32(?), ref: 00411AC0
MessageBoxW.USER32(?,00000000,00000096,00000035), ref: 00411AE2
SetLastError.KERNEL32(00000000), ref: 00411AEF

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastLoadString$Message__vswprintf_c_l_swprintf
String ID:
API String ID: 2205000856-0
Opcode ID: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction ID: 7f3341f69499fe42e6dffd8e50f304e55c87ac1a4f55305a7eb793650ce5b90b
Opcode Fuzzy Hash: 68bc4feaeb3ec1ded5fc4cddc0e8f758a38e28cbc6004bdae2a7d7facef01b9c
Instruction Fuzzy Hash: 74F02732140114ABF71137E08C4AECA379CFB087C5F000277FA01F21A2EA79996487BD

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Function 00409DF7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00409E24
_wcslen.LIBCMT ref: 00409F1F

Strings

__rar_, xrefs: 00409F56

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcslen
String ID: __rar_
API String ID: 176396367-2561138058
Opcode ID: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction ID: 2f22db44ea277558b4e0ddbd7bf004989f9b0852302f55cc0e1d63be076b661c
Opcode Fuzzy Hash: cc00e60038d7e5b00a294da67532c8ff9d8da0984a3b6968a0dc5b622ff721b3
Instruction Fuzzy Hash: 2E41A176A0021966DF21AA65CC81BEF336DAF54384F08087BF905B31D3D63DCD9187A9

Function 0040CEF5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0040CEB6: LoadLibraryW.KERNEL32(Crypt32.dll,00000020,0040CF0E,00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?), ref: 0040CEC4
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0040CEDD
Part of subcall function 0040CEB6: GetProcAddress.KERNEL32(00438800,CryptUnprotectMemory), ref: 0040CEE9

GetCurrentProcessId.KERNEL32(00000020,?,?,00405D3C,?,00000020,00000001,00000000,?,00000010,?,?,?,00000001,?,?), ref: 0040CF7C

Strings

CryptUnprotectMemory failed, xrefs: 0040CF75
CryptProtectMemory failed, xrefs: 0040CF3C

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: AddressProc$CurrentLibraryLoadProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 137661620-396321323
Opcode ID: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction ID: d47b55f9d8946329b2d763cf1c5c736fe64ad30a662938a08eea1033a11e378d
Opcode Fuzzy Hash: fe221cb1f1ebd7538222251a67e743d79676efd4ab4d459fbc5578979eb1af3c
Instruction Fuzzy Hash: C411C171304213AFDB09AF349CD197F6756CB41B14724423FF902AA2C2DA388C41529E

Function 0040A19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0040A1B5
_wcspbrk.LIBCMT ref: 0040A1FD

Strings

?*<>|", xrefs: 0040A1F7

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: _wcschr_wcspbrk
String ID: ?*<>|"
API String ID: 3305141221-226352099
Opcode ID: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction ID: fc4717308da4314e5704a136f2044a521342e33b833bb001f63317f55d448289
Opcode Fuzzy Hash: 7f6a6c1d5428e83731d2b65d13748a0e82632fc7d37b167bce2bcb03fdaf0a03
Instruction Fuzzy Hash: 1DF0F42912832254DE38A6659805AB333D49F15784F60447FE8D2BA2C2EA3D8CE3C16F

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00410FD9,?,?,00411197,?,?,?,?,?,004111E6), ref: 00410EA6
GetLastError.KERNEL32(?,?,?,?,?,004111E6), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 0000000A.00000002.3363237315.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.3363199926.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363282311.000000000042A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363319064.000000000044F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000A.00000002.3363433671.0000000000452000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_tasksche.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6qqWn6eIGG.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\eee.exe

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
6qqWn6eIGG.dll

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre