Edit tour

Windows Analysis Report
ruXU7wj3X9.dll

Overview

General Information

Sample name:	ruXU7wj3X9.dll renamed because original name is a hash value
Original sample name:	d907672759069af4824b0354e9170285.dll
Analysis ID:	1591362
MD5:	d907672759069af4824b0354e9170285
SHA1:	d995544a19032e9cebdd6d76c03580a89bd7a330
SHA256:	4ad2a09b3c99f31faf5f46b2298dcf2e9c5b84a96732bffea2fcf4e2c2aa791e
Tags:	dllexeuser-mentality
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Wannacry ransomware

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6512 cmdline: loaddll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 3660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1736 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 3832 cmdline: rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvr.exe (PID: 5944 cmdline: C:\WINDOWS\mssecsvr.exe MD5: B15FB425B628062A7BB0F11DBAECF4AC)

rundll32.exe (PID: 4992 cmdline: rundll32.exe C:\Users\user\Desktop\ruXU7wj3X9.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6780 cmdline: rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvr.exe (PID: 6720 cmdline: C:\WINDOWS\mssecsvr.exe MD5: B15FB425B628062A7BB0F11DBAECF4AC)

tasksche.exe (PID: 3456 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 41C0E22D28973F312DE789C027E61D0C)

WerFault.exe (PID: 4992 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 604 MD5: C31336C1EFC2CCB44B4326EA793040F2)

mssecsvr.exe (PID: 6552 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: B15FB425B628062A7BB0F11DBAECF4AC)

svchost.exe (PID: 3148 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 2888 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 3628 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ruXU7wj3X9.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
ruXU7wj3X9.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
ruXU7wj3X9.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\mssecsvr.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\mssecsvr.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
C:\Windows\mssecsvr.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvr.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf0d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf100:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000002.1584683802.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000B.00000000.1584094306.0000000000401000.00000020.00000001.01000000.00000007.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf0d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf100:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000000.1562813019.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.1534389465.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.1560048220.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvr.exe PID: 5944	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6552	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6720	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.mssecsvr.exe.22738c8.9.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.1d4a084.5.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.0.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
8.0.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.1d7c128.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
8.2.mssecsvr.exe.1d7c128.3.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
10.2.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
10.2.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.0.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
8.2.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
11.0.tasksche.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s"
11.0.tasksche.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.22a596c.8.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
8.2.mssecsvr.exe.22a596c.8.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
10.0.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
10.0.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.2.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s"
6.2.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
11.2.tasksche.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s"
11.2.tasksche.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.1d4a084.5.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1d4a084.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.1d4a084.5.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.22738c8.9.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.22738c8.9.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.22738c8.9.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.2.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
10.0.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
10.0.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
10.0.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
8.2.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
10.2.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
10.2.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
10.2.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.0.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.0.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
8.0.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.1d59104.4.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1d59104.4.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x32520:$x1: icacls . /grant Everyone:F /T /C /Q 0x222ec:$x3: tasksche.exe 0x324fc:$x3: tasksche.exe 0x324d8:$x4: Global\MsWinZonesCacheCounterMutexA 0x32550:$x5: WNcry@2ol7 0x222c4:$x8: C:\%s\qeriuwjhrf 0x32520:$x9: icacls . /grant Everyone:F /T /C /Q 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x32450:$s3: cmd.exe /c "%s" 0x649a4:$s4: msg/m_portuguese.wnry 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.1d59104.4.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.1d59104.4.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x324fc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32524:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
10.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
10.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
10.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
10.0.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
8.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
8.0.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
10.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
10.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
10.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
10.2.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.2282948.6.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.2282948.6.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x32520:$x1: icacls . /grant Everyone:F /T /C /Q 0x222ec:$x3: tasksche.exe 0x324fc:$x3: tasksche.exe 0x324d8:$x4: Global\MsWinZonesCacheCounterMutexA 0x32550:$x5: WNcry@2ol7 0x222c4:$x8: C:\%s\qeriuwjhrf 0x32520:$x9: icacls . /grant Everyone:F /T /C /Q 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x32450:$s3: cmd.exe /c "%s" 0x649a4:$s4: msg/m_portuguese.wnry 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.2282948.6.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
8.2.mssecsvr.exe.2282948.6.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x324fc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32524:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.22a596c.8.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.22a596c.8.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
8.2.mssecsvr.exe.22a596c.8.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.0.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.0.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.0.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
6.0.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.1d7c128.3.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1d7c128.3.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry
8.2.mssecsvr.exe.1d7c128.3.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
6.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
6.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
6.2.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.1d59104.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1d59104.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2dd20:$x1: icacls . /grant Everyone:F /T /C /Q 0x1daec:$x3: tasksche.exe 0x2dcfc:$x3: tasksche.exe 0x2dcd8:$x4: Global\MsWinZonesCacheCounterMutexA 0x2dd50:$x5: WNcry@2ol7 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x2dd20:$x9: icacls . /grant Everyone:F /T /C /Q 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x2dc50:$s3: cmd.exe /c "%s" 0x601a4:$s4: msg/m_portuguese.wnry 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.1d59104.4.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x2dcfc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x2dd24:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.227e8e8.7.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.227e8e8.7.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x36580:$x1: icacls . /grant Everyone:F /T /C /Q 0x2634c:$x3: tasksche.exe 0x3655c:$x3: tasksche.exe 0x36538:$x4: Global\MsWinZonesCacheCounterMutexA 0x365b0:$x5: WNcry@2ol7 0x26324:$x8: C:\%s\qeriuwjhrf 0x36580:$x9: icacls . /grant Everyone:F /T /C /Q 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x364b0:$s3: cmd.exe /c "%s" 0x68a04:$s4: msg/m_portuguese.wnry 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.227e8e8.7.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x3655c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x36584:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.1d550a4.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.1d550a4.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x36580:$x1: icacls . /grant Everyone:F /T /C /Q 0x2634c:$x3: tasksche.exe 0x3655c:$x3: tasksche.exe 0x36538:$x4: Global\MsWinZonesCacheCounterMutexA 0x365b0:$x5: WNcry@2ol7 0x26324:$x8: C:\%s\qeriuwjhrf 0x36580:$x9: icacls . /grant Everyone:F /T /C /Q 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x364b0:$s3: cmd.exe /c "%s" 0x68a04:$s4: msg/m_portuguese.wnry 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.1d550a4.2.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x3655c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x36584:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
8.2.mssecsvr.exe.2282948.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
8.2.mssecsvr.exe.2282948.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2dd20:$x1: icacls . /grant Everyone:F /T /C /Q 0x1daec:$x3: tasksche.exe 0x2dcfc:$x3: tasksche.exe 0x2dcd8:$x4: Global\MsWinZonesCacheCounterMutexA 0x2dd50:$x5: WNcry@2ol7 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x2dd20:$x9: icacls . /grant Everyone:F /T /C /Q 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x2dc50:$s3: cmd.exe /c "%s" 0x601a4:$s4: msg/m_portuguese.wnry 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$
8.2.mssecsvr.exe.2282948.6.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x2dcfc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x2dd24:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 91 entries

Sigma Signatures

System Summary

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 3148, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T22:42:30.076941+0100	2803304	3	Unknown Traffic	192.168.2.8	49707	103.224.212.215	80	TCP
2025-01-14T22:42:32.744988+0100	2803304	3	Unknown Traffic	192.168.2.8	49709	103.224.212.215	80	TCP

ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T22:42:29.157189+0100	2830018	1	A Network Trojan was detected	192.168.2.8	49256	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ruXU7wj3X9.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/.	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0ca	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/p	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5e	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d63508	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5eaf	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d635081d	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/8	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\mssecsvr.exe	Avira: detection malicious, Label: TR/Ransom.Gen
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Patched.Gen

Multi AV Scanner detection for submitted file

Source: ruXU7wj3X9.dll	Virustotal: Detection: 88%			Perma Link
Source: ruXU7wj3X9.dll	ReversingLabs: Detection: 89%

Machine Learning detection for dropped file

Source: C:\Windows\mssecsvr.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ruXU7wj3X9.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source:

Binary string: d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb source: mssecsvr.exe, 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 0000000B.00000000.1584131463.000000000042A000.00000002.00000001.01000000.00000007.sdmp, tasksche.exe, 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmp, ruXU7wj3X9.dll, mssecsvr.exe.3.dr, tasksche.exe.10.dr

Source: C:\Windows\tasksche.exe

Code function: 11_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,

11_2_00409476

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2830018 - Severity 1 - ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) : 192.168.2.8:49256 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0842-3096-a478-d7c464a3f0ca HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736890950.7011300
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0842-32cc-b361-86c8884a5eaf HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=215a8bf8-0e2d-4579-a9e0-ffb15187690d
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0842-3207-bd07-6551d635081d HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49709 -> 103.224.212.215:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49707 -> 103.224.212.215:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.13
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.13
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.13
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.13
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 119.38.196.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.70
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.70
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.70
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.70
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 63.85.204.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.94
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.94
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.94
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.94
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 83.249.153.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.45
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.45
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.45
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.45
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1
Source: unknown	TCP traffic detected without corresponding DNS query: 27.108.78.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0842-3096-a478-d7c464a3f0ca HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736890950.7011300
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0842-32cc-b361-86c8884a5eaf HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=215a8bf8-0e2d-4579-a9e0-ffb15187690d
Source: global traffic	HTTP traffic detected: GET /?subid1=20250115-0842-3207-bd07-6551d635081d HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: global traffic	DNS traffic detected: DNS query: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633985081.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1621897874.000001F22BF53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797552361.000001F22C415000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1600032519.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633985081.000001F22BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000F.00000002.2797031764.000001F22B681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_k
Source: svchost.exe, 0000000F.00000002.2797122115.000001F22B6C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000F.00000002.2797552361.000001F22C415000.00000004.00000020.00020000.00000000.sdmp, 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.15.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: svchost.exe, 0000000F.00000003.1645563508.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620706961.000001F22BF32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1621411496.000001F22BF58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797393464.000001F22BF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620595444.000001F22BF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633412468.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620524966.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633951055.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000F.00000003.1633412468.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620524966.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633951055.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdpe
Source: svchost.exe, 0000000F.00000002.2797031764.000001F22B681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797658785.000001F22C47D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scken
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000F.00000003.1633985081.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1621897874.000001F22BF53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633985081.000001F22BF59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustbc
Source: svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustm
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net
Source: mssecsvr.exe, 00000006.00000002.1584053188.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000006.00000002.1584053188.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/.
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/8
Source: mssecsvr.exe, 00000006.00000002.1584053188.0000000000A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2225441842.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.1584037651.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d63508
Source: mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A79000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5e
Source: mssecsvr.exe, 00000006.00000002.1584053188.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/p
Source: mssecsvr.exe.3.dr	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000006.00000002.1584053188.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000002.1584053188.0000000000A80000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000003.1583298451.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A37000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/2XJ
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/X
Source: mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/b
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/s
Source: mssecsvr.exe, 00000008.00000002.2222517608.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ
Source: mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comO
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comgs
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599048340.000001F22BF57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.ecur
Source: svchost.exe, 0000000F.00000002.2797068737.000001F22B6A5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796933895.000001F22B62B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf53457
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000F.00000002.2797031764.000001F22B698000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797658785.000001F22C47D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfDM
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srfice
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796933895.000001F22B62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599152522.000001F22BF6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000F.00000003.1598718329.000001F22BF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806044
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599048340.000001F22BF57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796933895.000001F22B62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598817104.000001F22BF5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000F.00000002.2797031764.000001F22B681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfm
Source: svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000F.00000002.2797122115.000001F22B6BF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797161373.000001F22B6D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspxice

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: ruXU7wj3X9.dll, type: SAMPLE
Source: Yara match	File source: 8.2.mssecsvr.exe.1d4a084.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1d7c128.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1d59104.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.227e8e8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.1d550a4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1584683802.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.1562813019.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1534389465.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1560048220.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 5944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6720, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\mssecsvr.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: ruXU7wj3X9.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: ruXU7wj3X9.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.22738c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d4a084.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.1d7c128.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d7c128.3.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 10.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 10.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 11.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 11.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 10.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 10.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 11.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 11.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.1d4a084.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d4a084.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 10.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 10.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 10.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 10.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.1d7c128.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d7c128.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.1d59104.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d59104.4.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.227e8e8.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.227e8e8.7.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.1d550a4.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.1d550a4.2.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 8.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 8.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000B.00000000.1584094306.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team

Source: C:\Windows\tasksche.exe

Code function: 11_2_0040690A: __EH_prolog,_wcslen,_wcscpy,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,_wcscpy,_wcscpy,_wcscpy,_wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

11_2_0040690A

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvr.exe			Jump to behavior
Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\tasksche.exe	Code function: 11_2_0041B0D9	11_2_0041B0D9
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041B8B9	11_2_0041B8B9
Source: C:\Windows\tasksche.exe	Code function: 11_2_00414946	11_2_00414946
Source: C:\Windows\tasksche.exe	Code function: 11_2_00404986	11_2_00404986
Source: C:\Windows\tasksche.exe	Code function: 11_2_00429241	11_2_00429241
Source: C:\Windows\tasksche.exe	Code function: 11_2_0042727C	11_2_0042727C
Source: C:\Windows\tasksche.exe	Code function: 11_2_004283FC	11_2_004283FC
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041AC04	11_2_0041AC04
Source: C:\Windows\tasksche.exe	Code function: 11_2_00416C3F	11_2_00416C3F
Source: C:\Windows\tasksche.exe	Code function: 11_2_00401CC1	11_2_00401CC1
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041F4D4	11_2_0041F4D4
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041BCD9	11_2_0041BCD9
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041B4AD	11_2_0041B4AD
Source: C:\Windows\tasksche.exe	Code function: 11_2_00417D78	11_2_00417D78
Source: C:\Windows\tasksche.exe	Code function: 11_2_00427D04	11_2_00427D04
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041450F	11_2_0041450F
Source: C:\Windows\tasksche.exe	Code function: 11_2_0040FDFA	11_2_0040FDFA
Source: C:\Windows\tasksche.exe	Code function: 11_2_00415D9A	11_2_00415D9A
Source: C:\Windows\tasksche.exe	Code function: 11_2_00405610	11_2_00405610
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041462B	11_2_0041462B
Source: C:\Windows\tasksche.exe	Code function: 11_2_00413EE3	11_2_00413EE3
Source: C:\Windows\tasksche.exe	Code function: 11_2_0040FEF0	11_2_0040FEF0
Source: C:\Windows\tasksche.exe	Code function: 11_2_00402F2C	11_2_00402F2C
Source: C:\Windows\tasksche.exe	Code function: 11_2_004277C0	11_2_004277C0

Source: C:\Windows\tasksche.exe

Code function: String function: 0041FA9C appears 38 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456

Source: mssecsvr.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Source: mssecsvr.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive

Source: ruXU7wj3X9.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: ruXU7wj3X9.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.22738c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d4a084.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.1d7c128.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d7c128.3.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 10.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 10.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 11.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 11.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.22a596c.8.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 10.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 10.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 11.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 11.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.1d4a084.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d4a084.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.22738c8.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 10.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 10.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 10.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 10.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.1d59104.4.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 10.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 10.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 8.2.mssecsvr.exe.2282948.6.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.22a596c.8.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.1d7c128.3.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d7c128.3.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 6.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.1d59104.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d59104.4.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.227e8e8.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.227e8e8.7.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.1d550a4.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.1d550a4.2.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 8.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 8.2.mssecsvr.exe.2282948.6.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000B.00000000.1584094306.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvr.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set

Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Diagnosis
Source: tasksche.exe.10.dr	Binary string: ]\Device\HarddiskVolume2\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtxp
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\usbohci.sys
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\System32\ega.cpiKF
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\localspl.dll
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\sensrsvc.dll
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
Source: tasksche.exe.10.dr	Binary string: @\Device\HarddiskVolume2\Windows\System32\ru-RU\WinSATAPI.dll.mui
Source: tasksche.exe.10.dr	Binary string: b\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sysT
Source: tasksche.exe.10.dr	Binary string: Z\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe#
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\powercfg.exep
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\fveui.dll
Source: tasksche.exe.10.dr	Binary string: @\Device\HarddiskVolume2\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf\p
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\wercplsupport.dll
Source: tasksche.exe.10.dr	Binary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Locationp
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\GAGP30KX.SYS
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\QAGENTRT.DLL
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\inf\netmscli.PNFC
Source: tasksche.exe.10.dr	Binary string: .\Device\HarddiskVolume2\Windows\inf\netip6.PNF
Source: tasksche.exe.10.dr	Binary string: 1\Device\HarddiskVolume2\Windows\ehome\ehrecvr.exe
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\SCardSvr.dll
Source: mssecsvr.exe.3.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\umpass.sysdd
Source: tasksche.exe.10.dr	Binary string: V\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYS
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\Prefetch\VPROT.EXE-D7ED8096.pf [
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\acpipmi.sysH
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\VMBusHID.sys&
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABCO
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\amdsbs.sys\S
Source: tasksche.exe.10.dr	Binary string: T\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16rp
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\volsnap.inf_loc
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\BrSerId.sys
Source: mssecsvr.exe.3.dr	Binary string: +\Device\HarddiskVolume2\Windows\System32\ru_PTC
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\crcdisk.sys?
Source: tasksche.exe.10.dr	Binary string: [\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\keyboard.inf_loc
Source: mssecsvr.exe.3.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\net
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\mskssrv.sys
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\MTConfig.sys
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\timedate.cplp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpu320.sysH;
Source: tasksche.exe.10.dr	Binary string: F\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Shell
Source: tasksche.exe.10.dr	Binary string: t\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sys@
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\umrdp.dllSTRP
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\sppsvc.exer
Source: tasksche.exe.10.dr	Binary string: -\Device\HarddiskVolume2\Windows\inf\mshdc.PNFp
Source: tasksche.exe.10.dr	Binary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netip6.inf_locp
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\FXSSVC.exe
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sfloppy.sysR_
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\dxgkrnl.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\megasas.sys
Source: mssecsvr.exe.3.dr	Binary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLsCPU1
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\ULIAGPKX.SYS
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\ru-RU\runonce.exe.mui+
Source: tasksche.exe.10.dr	Binary string: \Device\Harddisk0\DR0p
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\ndiscap.PNF
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\bthserv.dll
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\amdk8.syslump
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvraid.sys=\(
Source: tasksche.exe.10.dr	Binary string: 8\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft$Hp
Source: mssecsvr.exe.3.dr	Binary string: 0\Device\HarddiskVolume2\Windows\System32\vds.exeH
Source: tasksche.exe.10.dr	Binary string: j\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgsched.log.lock
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\intelide.sys
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys\|$P@
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\TsUsbGD.sys
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\shredlog.cfgp
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\Windows\System32\appidpolicyconverter.exe
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\Apphlpdm.dllp
Source: tasksche.exe.10.dr	Binary string: H\Device\HarddiskVolume2\Windows\System32\SystemPropertiesPerformance.exe
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\tapisrv.dllID
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\SISAGP.SYS3
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\krnlapi.cfgp
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\rdpdr.sysGtn
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\VIAAGP.SYS.
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\errdev.sys1
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\flpydisk.sys
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\gptext.dll
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\ListSvc.dll
Source: tasksche.exe.10.dr	Binary string: ~\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Caches\{7CD55808-3D38-4DD5-90C9-62F0E6EE60D4}.2.ver0x0000000000000001.db
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\wcncsvc.dll^/
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData\RacDatabase.sdf
Source: tasksche.exe.10.dr	Binary string: U\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\fdeploy.dllW
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netserv.inf_locLNKD
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vhdmp.sys
Source: tasksche.exe.10.dr	Binary string: ?\Device\HarddiskVolume2\Program Files\AVG\UiDll\2623\icudtl.datp
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\drivers\mshidkmdf.sysDC2
Source: tasksche.exe.10.dr	Binary string: 8\Device\HarddiskVolume2\Windows\System32\PeerDistSvc.dll/
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\amdide.sysp
Source: tasksche.exe.10.dr	Binary string: @\Device\HarddiskVolume2\Windows\Prefetch\SVCHOST.EXE-80F4A784.pfMp
Source: tasksche.exe.10.dr	Binary string: F\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\AppIDp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\drmkaud.sysCP
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\errdev.sys
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\inf\nettcpip.PNFS
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\inf\netavpnt.PNF
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\MegaSR.sysDC2
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\usbohci.sys3
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\drmkaud.sys
Source: tasksche.exe.10.dr	Binary string: [\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatformU3
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\WsmSvc.dll
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\ehome\ehprivjob.exe
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\csllog.cfgLL
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\ql40xx.sys
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\lsi_scsi.sys
Source: tasksche.exe.10.dr	Binary string: m\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Myp
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\wbem\WmiApSrv.exe
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\drivers\fsdepends.sysd0`p
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\evbdx.sys
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\certprop.dll
Source: tasksche.exe.10.dr	Binary string: p\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYS\S
Source: tasksche.exe.10.dr	Binary string: W\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netrass.inf_loc
Source: tasksche.exe.10.dr	Binary string: -\Device\HarddiskVolume2\Windows\inf\input.PNFp
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\hidir.sysalH
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\w32time.dllBU
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sisraid2.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\ru-RU\duser.dll.muiIOp
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\ssdpsrv.dllTD
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvstor.sys2\
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\rasauto.dll_S
Source: tasksche.exe.10.dr	Binary string: -\Device\HarddiskVolume2\Windows\inf\oem10.PNFp
Source: tasksche.exe.10.dr	Binary string: L\Device\HarddiskVolume2\Program Files\Remote Access Host\RemoteSoundServ.exei
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\battery.inf_loc
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\MultimediaR_CPp
Source: tasksche.exe.10.dr	Binary string: +\Device\HarddiskVolume2\Windows\System32\ru1
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netsstpt.inf_locBFFRp
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sys1
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-2c059045-004a-4137-b301-6c3064f40275.tmpp
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\hcw85cir.sys
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\Tasks\WPD\$
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\bdesvc.dll^BN
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\PLA\System
Source: mssecsvr.exe.3.dr	Binary string: +\Device\HarddiskVolume2\Windows\System32\en_CPU
Source: tasksche.exe.10.dr	Binary string: O\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
Source: tasksche.exe.10.dr	Binary string: +\Device\HarddiskVolume2\ProgramData\Avg\log
Source: tasksche.exe.10.dr	Binary string: {\Device\HarddiskVolume2\Windows\Performance\WinSAT\DataStore\2016-02-02 17.08.06.946 Formal.Assessment (Initial).WinSAT.xml
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-2c059045-004a-4137-b301-6c3064f40275.tmpb
Source: tasksche.exe.10.dr	Binary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Ras
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\ipnat.sys
Source: tasksche.exe.10.dr	Binary string: .\Device\HarddiskVolume2\Windows\inf\rspndr.PNFQ0pIRp
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\Globalization\Sortingp
Source: tasksche.exe.10.dr	Binary string: 9\Device\HarddiskVolume2\Windows\System32\drivers\mpio.sys
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\iirsp.sys
Source: tasksche.exe.10.dr	Binary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cpu.inf_locCC
Source: tasksche.exe.10.dr	Binary string: -\Device\HarddiskVolume2\Windows\Globalization
Source: tasksche.exe.10.dr	Binary string: u\Device\HarddiskVolume2\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtxp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ndiscap.sysS,
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\Resources\Themes\Aero
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\circlass.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\lsi_sas.sysM
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\ehome\ehrec.exe
Source: tasksche.exe.10.dr	Binary string: Y\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\lsi_sas2.sys
Source: tasksche.exe.10.dr	Binary string: i\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update
Source: tasksche.exe.10.dr	Binary string: @\Device\HarddiskVolume2\Windows\Prefetch\DLLHOST.EXE-766398D2.pf_Tp
Source: tasksche.exe.10.dr	Binary string: 6\Device\HarddiskVolume2\Windows\System32\WinSATAPI.dllp
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\iscsiexe.dll
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\nslog.cfgS
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\tdpipe.sys
Source: tasksche.exe.10.dr	Binary string: ?\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sysS1
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\wuaueng.dll
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\1394ohci.sys
Source: tasksche.exe.10.dr	Binary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows Defender
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\inf\netsstpt.PNFwnp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\lsi_sas.sys
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\termsrv.dll
Source: tasksche.exe.10.dr	Binary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\mshdc.inf_loc
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrUsbSer.sys
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\drivers\filetrace.sysp}
Source: mssecsvr.exe.3.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\WUDFRd.sys
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\wersvc.dllTV
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-7e9df016-cbcc-4646-838e-02461299762d.tmp
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\irenum.sys
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\wscsvc.dllLNKD
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\ipfltdrv.sys
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\publog.cfgk
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_ru-ru_a13dea73a92ad990\comctl32.dll.muiME
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\schedlog.cfgp
Source: tasksche.exe.10.dr	Binary string: ;\Device\Hardd
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\KMSVC.DLLVID3PP
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\gpprnext.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpahci.sys
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\ndisuio.PNFT`
Source: tasksche.exe.10.dr	Binary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgemc.log.lockA
Source: tasksche.exe.10.dr	Binary string: q\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Contentp
Source: tasksche.exe.10.dr	Binary string: -\Device\HarddiskVolume2\Windows\inf\netnb.PNFp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\dxgkrnl.sysT
Source: tasksche.exe.10.dr	Binary string: m\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndisuio.inf_loc
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\wbengine.exe&
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\b57nd60x.sysp
Source: tasksche.exe.10.dr	Binary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avg_ru.lng>"
Source: tasksche.exe.10.dr	Binary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\MUI
Source: tasksche.exe.10.dr	Binary string: .\Device\HarddiskVolume2\Windows\inf\wfplwf.PNF
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\$Extend
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\nfrd960.sys
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\WebClnt.dllG
Source: tasksche.exe.10.dr	Binary string: Q\Device\HarddiskVolume2\Windows\Temp\avg-3778490c-65ff-4631-9fd1-8f2e97842712.tmp
Source: mssecsvr.exe.3.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vhdmp.sysskV
Source: mssecsvr.exe.3.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\viac7.sys\\._PR
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\fdPHost.dll
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\bthmodem.sys
Source: tasksche.exe.10.dr	Binary string: Q\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\RemoteAssistance(
Source: mssecsvr.exe.3.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\VIAAGP.SYSi\
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\HpSAMD.sys01CP
Source: tasksche.exe.10.dr	Binary string: T\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\hidbth.sys$H
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\gpprefcl.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\megasas.sysPD
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\evbdx.sysC
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\wpcsvc.dll
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\emclog.cfgH
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\stexstor.sys
Source: tasksche.exe.10.dr	Binary string: 9\Device\HarddiskVolume2\Windows\System32\drivers\udfs.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vsmraid.sysp
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\rasmans.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adp94xx.sys
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\usbmon.dll
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\netrasa.PNFMPARp
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netnwifi.inf_locPCF
Source: mssecsvr.exe.3.dr	Binary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs1
Source: tasksche.exe.10.dr	Binary string: X\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Error ReportingPU
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sermouse.sys
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vmbus.sysg\M
Source: tasksche.exe.10.dr	Binary string: ,\Device\HarddiskVolume2\Windows\inf\disk.PNFH
Source: tasksche.exe.10.dr	Binary string: T\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16p
Source: tasksche.exe.10.dr	Binary string: E\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\UPnPp
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\msdtc.exe}SDTL
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\aelupsvc.dll
Source: tasksche.exe.10.dr	Binary string: F\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Tcpip
Source: tasksche.exe.10.dr	Binary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\RACU5
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avg-7167c74e-f403-416d-93ad-1632477e850e.tmpp
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\netrass.PNFRCBAp
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\tssecsrv.sys
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\Windows\System32\Speech\SpeechUX\sapi.cpl
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\modem.sysTEMPb
Source: tasksche.exe.10.dr	Binary string: X\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vms3cap.sysST
Source: tasksche.exe.10.dr	Binary string: @\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sbp2port.sys
Source: tasksche.exe.10.dr	Binary string: l\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\fmw1\commonpriv.log.lockUF$
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\cmdide.sysLNKH
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\FntCache.dll
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvraid.sys
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\msdtckrm.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\elxstor.sysPT
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\Windows\Prefetch\WERFAULT.EXE-E69F695A.pfp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\iaStorV.sys
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\serenum.sysCT
Source: tasksche.exe.10.dr	Binary string: O\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData\RacWmiEventData.dat
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-49fb6b11-545c-406d-a9bb-da1ce541e50e.tmp
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\bxvbdx.sys
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\appmgmts.dll
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\regsvc.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\HdAudio.sys
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\RTSndMgr.cpl
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\mprdim.dll
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\aliide.sysH
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avg-7167c74e-f403-416d-93ad-1632477e850e.tmp`
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\auditcse.dll
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\tbssvc.dllSTE
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\wacompen.sys
Source: tasksche.exe.10.dr	Binary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\lltdio.inf_locp
Source: tasksche.exe.10.dr	Binary string: 7\Device\HarddiskVolume2\Windows\System32\drivers\wd.sys
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\Fonts\segoeuii.ttfp
Source: tasksche.exe.10.dr	Binary string: M\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Task Manager
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\DriverStore\en-USC
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\wecsvc.dll
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\modem.sysCu\|
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\TabSvc.dll
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\inf\netpacer.PNF
Source: tasksche.exe.10.dr	Binary string: Q\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: 6\Device\HarddiskVolume2\Windows\System32\p2pcollab.dllp
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\lsi_scsi.sysp
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\System32\tdh.dllp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\history.xml
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\ProgramData\Avg\AV\Chjw\avgpsi.db-journal
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\DFDWiz.exe
Source: tasksche.exe.10.dr	Binary string: N\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow CHPD p
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\netserv.PNFTMP8p
Source: tasksche.exe.10.dr	Binary string: 1\Device\HarddiskVolume2\Windows\ehome\ehsched.exe
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\volsnap.PNFR07
Source: tasksche.exe.10.dr	Binary string: 9\Device\HarddiskVolume2\Windows\System32\sqlceoledb30.dll
Source: tasksche.exe.10.dr	Binary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\MobilePC
Source: tasksche.exe.10.dr	Binary string: @\Device\HarddiskVolume2\Program Files\Windows Defender\MpSvc.dll
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\rasacd.sys
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\Windows\Prefetch\TASKHOST.EXE-7238F31D.pf
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\qwavedrv.sys
Source: tasksche.exe.10.dr	Binary string: E\Device\HarddiskVolume2\Windows\System32\drivers\rdpvideominiport.sys
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\ProgramData\Avg\AV\Chjw\avgpsi.db-journalp
Source: mssecsvr.exe.3.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\VMBusHID.sys
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\hidserv.PNF
Source: tasksche.exe.10.dr	Binary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\arc.sys
Source: tasksche.exe.10.dr	Binary string: S\Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-1870734524-1274666089-2119431859-1000
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\usbuhci.sys
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\asyncmac.sys
Source: mssecsvr.exe.3.dr	Binary string: N\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netvwififlt.inf_locCPU1AP
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\wmiacpi.sys
Source: tasksche.exe.10.dr	Binary string: c\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgemc.log
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\SessEnv.dllB_p
Source: tasksche.exe.10.dr	Binary string: N\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\SystemRestore
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\drivers\mshidkmdf.sysA
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: #\Device\HarddiskVolume2\Windows\infS
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\mrxdav.sysD
Source: tasksche.exe.10.dr	Binary string: q\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrSerWdm.sys
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\pnrpsvc.dllO
Source: tasksche.exe.10.dr	Binary string: z\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\AxInstSv.dll
Source: mssecsvr.exe.3.dr	Binary string: >\Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exeAP7PDC
Source: tasksche.exe.10.dr	Binary string: k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
Source: mssecsvr.exe.3.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\wbengine.exe
Source: mssecsvr.exe.3.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\VSSVC.exeSU
Source: tasksche.exe.10.dr	Binary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgidpdrv.log.2H
Source: tasksche.exe.10.dr	Binary string: 1\Device\HarddiskVolume2\Windows\System32\pots.dllp
Source: tasksche.exe.10.dr	Binary string: z\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
Source: tasksche.exe.10.dr	Binary string: \\Device\HarddiskVolume2\Windows\System32\ru-RU\microsoft-windows-kernel-power-events.dll.mui
Source: tasksche.exe.10.dr	Binary string: L\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Maintenance
Source: tasksche.exe.10.dr	Binary string: k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exeta
Source: tasksche.exe.10.dr	Binary string: ]\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\AMDAGP.SYS
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\dot3svc.dllPN
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\rdpdr.sysw
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\UAGP35.SYS0H
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\pnrpauto.dll
Source: tasksche.exe.10.dr	Binary string: U\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\gpscript.dll
Source: tasksche.exe.10.dr	Binary string: S\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: 1\Device\HarddiskVolume2\Windows\System32\qmgr.dll
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\scfilter.sys
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\drivers\filetrace.sys
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\upnphost.dll
Source: mssecsvr.exe.3.dr	Binary string: S\Device\HarddiskVolume2\Program Files\Common Files\AV\avast! Antivirus\userdata.cab0_TS
Source: tasksche.exe.10.dr	Binary string: .\Device\HarddiskVolume2\Windows\System32\RTCOMX
Source: tasksche.exe.10.dr	Binary string: Q\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\FDResPub.dll
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\winspool.drvp
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\terminpt.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\hidbatt.sysL
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\IPMIDrv.sysm
Source: tasksche.exe.10.dr	Binary string: \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_ru-ru_a13dea73a92ad990
Source: tasksche.exe.10.dr	Binary string: 6\Device\HarddiskVolume2\Windows\System32\defragsvc.dll
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\lpremove.exep
Source: tasksche.exe.10.dr	Binary string: i\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\fmw1\avgmsgdisp.log.2
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\viaide.systo
Source: tasksche.exe.10.dr	Binary string: i\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\fmw1\avgmsgdisp.log.3
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\hidbth.sys<\
Source: tasksche.exe.10.dr	Binary string: 6\Device\HarddiskVolume2\Windows\System32\IPBusEnum.dll
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\gatherNetworkInfo.vbs1
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\swprv.dllHM
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\qwave.dllP03HPS
Source: mssecsvr.exe.3.dr	Binary string: P\Device\HarddiskVolume2\Program Files\Common Files\AV\AVG AntiVirus Free EditionU4
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\FXSMON.dll
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\djsvs.sysD
Source: tasksche.exe.10.dr	Binary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgidpdrv.log.3
Source: mssecsvr.exe.3.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vmbus.sys
Source: tasksche.exe.10.dr	Binary string: S\Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-1870734524-1274666089-2119431859-1000H
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sysA\_^
Source: tasksche.exe.10.dr	Binary string: 8\Device\HarddiskVolume2\Windows\System32\sppuinotify.dll
Source: tasksche.exe.10.dr	Binary string: l\Device\HarddiskVolume2\Users\
Source: tasksche.exe.10.dr	Binary string: 1\Device\HarddiskVolume2\Windows\System32\msra.exe
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vms3cap.sys
Source: mssecsvr.exe.3.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\viaide.sys
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\HpSAMD.sys
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\ru-RU\rascfg.dll.mui
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\amdsata.syso
Source: tasksche.exe.10.dr	Binary string: e\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgshred.logp
Source: tasksche.exe.10.dr	Binary string: U\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\User Profile Service
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\isapnp.sys
Source: tasksche.exe.10.dr	Binary string: H\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Autochk
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrUsbMdm.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\IPMIDrv.sys
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\Mcx2Svc.dll
Source: tasksche.exe.10.dr	Binary string: V\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\TextServicesFrameworkDR
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\inf\netnwifi.PNF
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mspqm.syst
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\ru-RU\racengn.dll.muiH
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\dskquota.dll
Source: tasksche.exe.10.dr	Binary string: G\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\DefragRe
Source: tasksche.exe.10.dr	Binary string: Q\Device\HarddiskVolume2\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\AGP440.sys;
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\hidserv.inf_locp}
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\wersvc.dll
Source: tasksche.exe.10.dr	Binary string: 7\Device\HarddiskVolume2\Windows\System32\dot3gpclnt.dll
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ws2ifsl.sys._
Source: tasksche.exe.10.dr	Binary string: N\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netvwififlt.inf_loc
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\wimmount.sys
Source: tasksche.exe.10.dr	Binary string: ?\Device\HarddiskVolume2\Windows\System32\drivers\Synth3dVsc.sys
Source: tasksche.exe.10.dr	Binary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs:
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\netrast.PNFp
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\usbport.inf_locD5
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\Defrag.exe
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vsmraid.sys
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\System32\drivers\fsdepends.sysSB_PADp
Source: mssecsvr.exe.3.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys
Source: tasksche.exe.10.dr	Binary string: A\Device\HarddiskVolume2\Windows\Prefetch\AVGUIRNX.EXE-006CD133.pfp
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\tcpmon.dll
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\inf\netvwififlt.PNFF4
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sffdisk.sys0
Source: mssecsvr.exe.3.dr	Binary string: Y\Device\HarddiskVolume2\Windows\System32\Macromed\Flash\FlashUtil32_25_0_0_148_pepper.exe
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sysP
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\appidsvc.dll
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Bluetoothp
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\p2psvc.dll
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\machine.inf_loc3
Source: tasksche.exe.10.dr	Binary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\PLA_S
Source: tasksche.exe.10.dr	Binary string: 9\Device\HarddiskVolume2\Windows\System32\drivers\cdfs.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\USBSTOR.SYS
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\usbuhci.sysS
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\SyncCenter;PBI
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sys
Source: tasksche.exe.10.dr	Binary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\NetTrace
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\runonce.exe
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\seclogon.dll
Source: tasksche.exe.10.dr	Binary string: 1\Device\HarddiskVolume2\ProgramData\Avg\AV\cfgall
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\storvsc.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sfloppy.sysH
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\serial.sys
Source: mssecsvr.exe.3.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\fveui.dllPR_CPU
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\display.inf_loc DDL3 p
Source: tasksche.exe.10.dr	Binary string: e\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgsched.logh
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\System32\vds.exe
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\PerfTrackYS
Source: tasksche.exe.10.dr	Binary string: 2\Device\HarddiskVolume2\Windows\System32\VSSVC.exe
Source: tasksche.exe.10.dr	Binary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaDataI
Source: tasksche.exe.10.dr	Binary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgpal.log.lock
Source: mssecsvr.exe.3.dr	Binary string: T\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\System32\alg.exe_
Source: tasksche.exe.10.dr	Binary string: S\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsColorSystemH
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\RacRules.xml
Source: tasksche.exe.10.dr	Binary string: S\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData\RacWmiDataBookmarks.dat
Source: tasksche.exe.10.dr	Binary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\fdc.sys
Source: tasksche.exe.10.dr	Binary string: :\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RUrdd
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\ru-RU\mprmsg.dll.muip
Source: tasksche.exe.10.dr	Binary string: 9\Device\HarddiskVolume2\Program Files\AVG\Av\avgmfapx.exe
Source: tasksche.exe.10.dr	Binary string: V\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing
Source: mssecsvr.exe.3.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\SISAGP.SYSU0CS
Source: tasksche.exe.10.dr	Binary string: 6\Device\HarddiskVolume2\ProgramData\Avg\AV\DB\stats.db\/
Source: tasksche.exe.10.dr	Binary string: W\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Application Experience'B
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\nettcpip.inf_loc
Source: tasksche.exe.10.dr	Binary string: >\Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exe
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sffp_sd.sysU6
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrFiltUp.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\elxstor.sys
Source: tasksche.exe.10.dr	Binary string: j\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgshred.log.lockNOT
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\processr.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\iaStorV.sysX[
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\wmiacpi.sys@A
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\ql40xx.sys\
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\pciide.sys
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netmscli.inf_loc
Source: mssecsvr.exe.3.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\sppsvc.exe
Source: tasksche.exe.10.dr	Binary string: /\Device\HarddiskVolume2\Windows\inf\usbport.PNF
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\DriverStoreop
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndiscap.inf_loc
Source: tasksche.exe.10.dr	Binary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvstor.sysD
Source: tasksche.exe.10.dr	Binary string: .\Device\HarddiskVolume2\Windows\inf\lltdio.PNFS
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\lltdsvc.dll
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\WcsPlugInService.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\TsUsbGD.sys$
Source: tasksche.exe.10.dr	Binary string: N\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\WindowsBackup$XH
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\sdrsvc.dll
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\arcsas.sys
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\msiscsi.sysH
Source: tasksche.exe.10.dr	Binary string: c\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgpal.logPS['`
Source: tasksche.exe.10.dr	Binary string: 5\Device\HarddiskVolume2\Windows\System32\raserver.exe
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\serenum.sys2
Source: tasksche.exe.10.dr	Binary string: 0\Device\HarddiskVolume2\Windows\System32\pla.dll
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\crcdisk.sys
Source: tasksche.exe.10.dr	Binary string: X\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\NetworkAccessProtectionPM
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sffp_sd.syst+
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\cmdide.sys
Source: tasksche.exe.10.dr	Binary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\fixcfg.exes\p
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sys
Source: tasksche.exe.10.dr	Binary string: 6\Device\HarddiskVolume2\Windows\System32\bthudtask.exe
Source: tasksche.exe.10.dr	Binary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netrast.inf_loc
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\lsi_fc.sysgr
Source: tasksche.exe.10.dr	Binary string: G\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\disk.inf_locD$XHp
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\mskssrv.sysDC
Source: tasksche.exe.10.dr	Binary string: 4\Device\HarddiskVolume2\Windows\System32\Locator.exe
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\lsi_fc.sysX
Source: tasksche.exe.10.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\ql2300.sys
Source: tasksche.exe.10.dr	Binary string: +\Device\HarddiskVolume2\Windows\System32\enp
Source: tasksche.exe.10.dr	Binary string: g\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\fmw1\commonpriv.log
Source: tasksche.exe.10.dr	Binary string: j\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
Source: mssecsvr.exe.3.dr	Binary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\tdpipe.sys1APP
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\mspclock.sys
Source: tasksche.exe.10.dr	Binary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netpacer.inf_locNKA
Source: tasksche.exe.10.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ndiscap.sys,
Source: mssecsvr.exe.3.dr	Binary string: <\Device\HarddiskVolume2\Windows\System32\drivers\USBSTOR.SYSW
Source: tasksche.exe.10.dr	Binary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sffp_mmc.sys
Source: tasksche.exe.10.dr	Binary string: 3\Device\HarddiskVolume2\Windows\System32\wermgr.exeP80D

Source: mssecsvr.exe, 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, tasksche.exe, 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, ruXU7wj3X9.dll, mssecsvr.exe.3.dr, tasksche.exe.10.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@25/11@2/100

Source: C:\Windows\tasksche.exe

Code function: 11_2_00406553 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,

11_2_00406553

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		6_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		8_2_00407C40

Source: C:\Windows\tasksche.exe

Code function: 11_2_00419BB0 CoCreateInstance,

11_2_00419BB0

Source: C:\Windows\mssecsvr.exe

Code function: 6_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle,

6_2_00407CE0

Source: C:\Windows\mssecsvr.exe

Code function: 6_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

6_2_00407C40

Source: C:\Windows\mssecsvr.exe	Code function: 6_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		6_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 8_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		8_2_00408090

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:2888:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3660:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3456

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\079e2700-0cda-4fda-a92a-4c4572cca49d

Jump to behavior

Source: C:\Windows\tasksche.exe

Command line argument: @CB

11_2_00424290

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\ruXU7wj3X9.dll,PlayGame

Source: ruXU7wj3X9.dll	Virustotal: Detection: 88%
Source: ruXU7wj3X9.dll	ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\ruXU7wj3X9.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456
Source: C:\Windows\tasksche.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 604
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\ruXU7wj3X9.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 604	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\tasksche.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: ruXU7wj3X9.dll

Static file information: File size 5267459 > 1048576

Source:

Source: C:\Windows\tasksche.exe

Code function: 11_2_00425715 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

11_2_00425715

Source: C:\Windows\tasksche.exe	Code function: 11_2_0041FAE1 push ecx; ret		11_2_0041FAF4
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041A4DC push eax; ret		11_2_0041A4FA

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvr.exe			Jump to behavior
Source: C:\Windows\mssecsvr.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe			Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvr.exe			Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 6_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

6_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 11_2_0040CC10 sldt word ptr [eax]

11_2_0040CC10

Source: C:\Windows\mssecsvr.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\tasksche.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_11-15265

Source: C:\Windows\tasksche.exe

API coverage: 3.5 %

Source: C:\Windows\mssecsvr.exe TID: 6496	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6496	Thread sleep time: -184000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 2452	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 2452	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6496	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\tasksche.exe

Code function: 11_2_00409476 FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,

11_2_00409476

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvr.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.1584037651.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWCQ\
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: mssecsvr.exe, 00000006.00000002.1584053188.0000000000A66000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000006.00000002.1584053188.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2225441842.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.1584037651.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797122115.000001F22B6C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000F.00000002.2796933895.000001F22B62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXx
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: svchost.exe, 0000000F.00000002.2797577121.000001F22C457000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\tasksche.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\tasksche.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 11_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

11_2_0041E6DE

Source: C:\Windows\tasksche.exe

11_2_00425715

Source: C:\Windows\tasksche.exe	Code function: 11_2_004234CE SetUnhandledExceptionFilter,	11_2_004234CE
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041E6DE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0041E6DE
Source: C:\Windows\tasksche.exe	Code function: 11_2_0041FFDB _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0041FFDB
Source: C:\Windows\tasksche.exe	Code function: 11_2_00423F89 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	11_2_00423F89

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 604	Jump to behavior

Source: C:\Windows\tasksche.exe

Code function: 11_2_00410E50 cpuid

11_2_00410E50

Source: C:\Windows\tasksche.exe

Code function: GetLocaleInfoA,

11_2_00425EF0

Source: C:\Windows\tasksche.exe

Code function: 11_2_00411393 GetSystemTime,SystemTimeToFileTime,

11_2_00411393

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: mssecsvr.exe, 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe, 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, mssecsvr.exe.3.dr, tasksche.exe.10.dr	Binary or memory string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	4 Windows Service	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	4 Windows Service	41 Virtualization/Sandbox Evasion	LSASS Memory	1 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	11 Process Injection	1 Access Token Manipulation	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Rundll32	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ruXU7wj3X9.dll	89%	Virustotal		Browse
ruXU7wj3X9.dll	89%	ReversingLabs	Win32.Ransomware.WannaCry
ruXU7wj3X9.dll	100%	Avira	TR/AD.DPulsarShellcode.uvbfu
ruXU7wj3X9.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\mssecsvr.exe	100%	Avira	TR/Ransom.Gen
C:\Windows\tasksche.exe	100%	Avira	TR/Patched.Gen
C:\Windows\mssecsvr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/.	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0ca	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/p	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5e	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comgs	0%	Avira URL Cloud	safe
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d63508	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5eaf	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d635081d	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/8	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	0%	Avira URL Cloud	safe
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comO	0%	Avira URL Cloud	safe
https://login.ecur	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
77026.bodis.com	199.59.243.228	true	false	high
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	103.224.212.215	true	false	high
ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5eaf	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0ca	false	Avira URL Cloud: malware	unknown
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d635081d	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/8	mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdpe	svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/.	mssecsvr.exe, 00000006.00000002.1584053188.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comgs	mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustbc	svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/b	mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/scken	svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb	svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633985081.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1621897874.000001F22BF53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797552361.000001F22C415000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1600032519.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633985081.000001F22BF59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 0000000F.00000003.1633412468.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620524966.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633951055.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/X	mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF55000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb_	svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5e	mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A79000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A6C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0	mssecsvr.exe, 00000006.00000002.1584053188.0000000000A80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d63508	mssecsvr.exe, 00000008.00000002.2225441842.0000000000A7B000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2225441842.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000003.1584037651.0000000000A9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	mssecsvr.exe.3.dr	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/2XJ	mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/p	mssecsvr.exe, 00000006.00000002.1584053188.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599048340.000001F22BF57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2797122115.000001F22B6C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 0000000F.00000002.2797031764.000001F22B681000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797658785.000001F22C47D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.14.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 0000000F.00000003.1633985081.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1621897874.000001F22BF53000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633985081.000001F22BF59000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/s	mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 0000000F.00000003.1599257869.000001F22BF56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598718329.000001F22BF2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1598845700.000001F22BF52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 0000000F.00000002.2797480723.000001F22BF5F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	mssecsvr.exe, 00000006.00000002.1584053188.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000008.00000002.2225441842.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://Passport.NET/tb_k	svchost.exe, 0000000F.00000002.2797577121.000001F22C43D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comO	mssecsvr.exe, 0000000A.00000002.1585287821.0000000000A37000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/tb:pp	svchost.exe, 0000000F.00000002.2797031764.000001F22B681000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000008.00000002.2222517608.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.ecur	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trustm	svchost.exe, 0000000F.00000002.2797445609.000001F22BF37000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599077750.000001F22BF40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1599025091.000001F22BF3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 0000000F.00000003.1599134059.000001F22BF63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796979177.000001F22B65E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspxice	svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	svchost.exe, 0000000F.00000003.1645563508.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2796955541.000001F22B646000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620706961.000001F22BF32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1621411496.000001F22BF58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797480723.000001F22BF6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2797393464.000001F22BF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620595444.000001F22BF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633412468.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1620524966.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000003.1633951055.000001F22BF33000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
56.59.202.1	unknown	United States	2686	ATGS-MMD-ASUS	false
197.208.96.1	unknown	Sudan	36998	SDN-MOBITELSD	false
207.219.89.51	unknown	Canada	852	ASN852CA	false
63.85.204.70	unknown	United States	40234	RAPIDPARTSUS	false
90.207.146.1	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
150.245.56.1	unknown	United States	766	REDIRISRedIRISAutonomousSystemES	false
121.134.74.2	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
121.134.74.1	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
124.35.234.1	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
27.108.78.45	unknown	Philippines	6648	BAYAN-TELECOMMUNICATIONSBayanTelecommunicationsIncPH	false
119.38.196.2	unknown	China	38367	CNNIC-ULICNET-APUnionLifeInsuranceCoLtdCN	false
142.195.63.24	unknown	Canada	64258	DESJARDINSCA	false
119.38.196.1	unknown	China	38367	CNNIC-ULICNET-APUnionLifeInsuranceCoLtdCN	false
119.38.196.13	unknown	China	38367	CNNIC-ULICNET-APUnionLifeInsuranceCoLtdCN	false
158.206.214.1	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
221.5.28.201	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
90.207.146.203	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
27.219.109.201	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
158.206.214.229	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
129.31.49.100	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106
192.168.2.227
192.168.2.107
192.168.2.228

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591362
Start date and time:	2025-01-14 22:41:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ruXU7wj3X9.dll renamed because original name is a hash value
Original Sample Name:	d907672759069af4824b0354e9170285.dll
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@25/11@2/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.76, 40.126.32.134, 20.190.160.22, 20.190.160.14, 40.126.32.133, 40.126.32.138, 40.126.32.136, 40.126.32.72, 88.221.110.91, 2.16.100.168, 2.23.77.188, 20.189.173.21, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:42:30	API Interceptor	1x Sleep call for process: loaddll32.exe modified
16:42:38	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:43:06	API Interceptor	112x Sleep call for process: mssecsvr.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77026.bodis.com	eIZi481eP6.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	m9oUIFauYl.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	sUlHfYQxNw.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	6qqWn6eIGG.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	jgd5ZGl1vA.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	199.59.243.227
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	eIZi481eP6.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	m9oUIFauYl.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	sUlHfYQxNw.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	6qqWn6eIGG.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	jgd5ZGl1vA.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	LisectAVT_2403002A_327.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	yrBA01LVo2.exe	Get hash	malicious	Wannacry	Browse	103.224.212.215

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SDN-MOBITELSD	meth9.elf	Get hash	malicious	Mirai	Browse	41.240.40.16
	elitebotnet.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	154.98.154.65
	4.elf	Get hash	malicious	Unknown	Browse	197.208.232.126
	6.elf	Get hash	malicious	Unknown	Browse	41.241.171.237
	3.elf	Get hash	malicious	Unknown	Browse	41.241.171.247
	3.elf	Get hash	malicious	Unknown	Browse	41.95.229.209
	6.elf	Get hash	malicious	Unknown	Browse	41.95.189.166
	5.elf	Get hash	malicious	Unknown	Browse	41.95.189.164
	6.elf	Get hash	malicious	Unknown	Browse	41.241.199.3
	3.elf	Get hash	malicious	Unknown	Browse	41.95.146.6
ATGS-MMD-ASUS	YZJG8NuHEP.dll	Get hash	malicious	Wannacry	Browse	51.209.245.1
	http://monitor.linkwhat.com/tl4tl4726Qz107cK770xR10599lj360px17lb07468gl70015oV95328Kn41253VG39381FP5605427918==aru2826664	Get hash	malicious	Phisher	Browse	34.149.158.220
	hsmSW6Eifl.dll	Get hash	malicious	Wannacry	Browse	34.1.98.1
	FjSrGs0AE2.dll	Get hash	malicious	Wannacry	Browse	51.243.90.42
	m9oUIFauYl.dll	Get hash	malicious	Wannacry	Browse	34.177.88.1
	5Q6ffmX9tQ.dll	Get hash	malicious	Wannacry	Browse	48.82.13.223
	jpXNd6Kt8z.dll	Get hash	malicious	Wannacry	Browse	33.222.99.200
	527.zip	Get hash	malicious	Unknown	Browse	34.160.144.191
	527.zip	Get hash	malicious	Unknown	Browse	34.160.144.191
	Fantazy.arm4.elf	Get hash	malicious	Unknown	Browse	34.43.158.177
ASN852CA	m9oUIFauYl.dll	Get hash	malicious	Wannacry	Browse	209.29.139.1
	i686.elf	Get hash	malicious	Unknown	Browse	209.171.55.67
	spc.elf	Get hash	malicious	Unknown	Browse	104.205.84.120
	arm5.elf	Get hash	malicious	Unknown	Browse	50.93.119.96
	x86_64.elf	Get hash	malicious	Unknown	Browse	199.126.116.113
	i486.elf	Get hash	malicious	Unknown	Browse	154.5.159.104
	mips.elf	Get hash	malicious	Unknown	Browse	199.175.181.117
	mpsl.elf	Get hash	malicious	Unknown	Browse	205.206.219.230
	3.elf	Get hash	malicious	Unknown	Browse	208.38.43.109
	res.mips.elf	Get hash	malicious	Unknown	Browse	207.216.32.185

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tasksche.exe_67e7eb82189942524dcddca9cff151bf703b53fe_5f6e30d1_6d9fd5b3-2b52-4574-9c7c-6c700609d9ed\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8301359728241963
Encrypted:	false
SSDEEP:	192:BQ1fvIKS6C0BU/KmkjeT0TzuiFnZ24IO8iw6:CfAKS6JBU/Kmkje0zuiFnY4IO8iw
MD5:	FF8CA67A988E19A48A5782BD4ABFE614
SHA1:	48B67BBC92148D98FB5DDC81C387BC9E8986C253
SHA-256:	1444820D750812EC0572049144672A441B5CBA5625FFA4E4558A3223274EC866
SHA-512:	0EA7B06DC4D83803E374B75BCA32B25688A360A919CCD7DC97F8119FD7D03FF4753D9F2D1A4F884048213D21C51C79C56515B78D97C8697CB49499BDFE46D36C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.3.6.4.5.5.3.0.7.6.0.7.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.3.6.4.5.5.3.7.7.9.1.8.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.9.f.d.5.b.3.-.2.b.5.2.-.4.5.7.4.-.9.c.7.c.-.6.c.7.0.0.6.0.9.d.9.e.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.c.9.b.1.5.e.-.3.1.5.5.-.4.3.2.9.-.8.8.4.1.-.5.8.0.9.0.9.f.a.f.5.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.a.s.k.s.c.h.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.8.0.-.0.0.0.1.-.0.0.1.4.-.e.0.4.f.-.9.9.3.7.c.d.6.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.a.f.7.5.0.4.c.e.4.c.c.7.1.0.3.a.c.6.3.0.3.1.1.c.0.1.6.c.2.e.7.0.0.0.0.f.f.f.f.!.0.0.0.0.1.9.3.f.7.4.1.3.9.6.1.3.2.4.e.d.a.1.f.3.f.8.c.d.0.f.6.0.1.0.f.c.b.7.3.0.2.8.e.c.!.t.a.s.k.s.c.h.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER734C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Jan 14 21:42:33 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	38730
Entropy (8bit):	2.0442894261407027
Encrypted:	false
SSDEEP:	192:2/dRcS4yeAO5HtilBvXGap9S8ZNSn+S9z/ZSgXX:aLct5HklBNvDO+2/ZZ
MD5:	20395ABFD51E9DC88B90D238954F5F13
SHA1:	ABDCE351BE5BA323D57F7D3DC43A7AE33F456CFC
SHA-256:	EDE2CC8E1BD9354161D23D03FD3087D021253315EADC289CCF1DE7C6BFB6F07F
SHA-512:	36AE9F201C2944D37FAD54E2E13B0B503421F717A61C6872212BDA5DC8E53166A9B9CAAE682C73B82773E833C0B329ECD63446195EDCB64F555F98BF4C4D7FFE
Malicious:	false
Preview:	MDMP..a..... .......I.g.........................................&..........T.......8...........T...............z.......................x...............................................................................eJ..............GenuineIntel............T...........H.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74A4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6264
Entropy (8bit):	3.7175468913336216
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbtj36bLYyK+QE/qiv5aM4Uw89bWcsfJQSm:R6l7wVeJtj363YyK+9prw89bWcsfJQSm
MD5:	A298B843447458EDEC83BFDCB2E647F3
SHA1:	1C87E49498D4847C2D25F5C1C4228F20AF253DB8
SHA-256:	F03D0B0D21462D6C1F1C71B79AC6D48DD31757CC63DAD95AA1EE3DE90651F8CA
SHA-512:	0C4542FBB7920693A132463339A9F6A310F24EF97A82BF910DC1C592973E2BCC8DAF3F24A7856247F48981FDF74C575355DE8FAB1047E8D9C282D0862D0ED39E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74F2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86900
Entropy (8bit):	3.0785853189877406
Encrypted:	false
SSDEEP:	1536:Fa43zsD+lU2rFz57PUr272+TA+atraKcSvmPNbP:Fa43zsD+lU2rFz57PUr272+TANtraKct
MD5:	572186AB799296F2ACC9C9EE01EF33EC
SHA1:	9A04B0E261CBE5CA333B68EB4217536AEE9D19D8
SHA-256:	59C7E6A2622626F1932C7C22C930D9016441E11A7BE1F87E0CF4150786F4E6A4
SHA-512:	101312B5E2C6CCDA14E68E0FE6BA34AF4276B0A34212777F524DDFAB3FD2D3B6F182F0A9538E76227CF702B19D4C8548B0CD81900FD7FECB9A525AF77516E50B
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74F4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	4.437414937199768
Encrypted:	false
SSDEEP:	48:cvIwWl8zsBJg77aI9iNWpW8VY63Ym8M4Jh/iZFH+q8dguGr68jiQd:uIjfTI7c87VNqJliDMfGr6ciQd
MD5:	4AA5D461F6AB029078DDE63AD8E3AA46
SHA1:	41B82B7AA781D593ECCDFE5089F041A163E8F5B4
SHA-256:	62CA4B47397CDCD23764D39D1DCE7FA5BC502FDA79DFE5C3A5D3A4E21483BB16
SHA-512:	D38516480C384576EC431C450DEBFDE1EB7E0D34D43D9204F1D16B3C51842A89EADAAAE975F281A2AD39FC8C36756829A4C3436CA4746EF63316A2D6EE634FE9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="676125" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7570.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6843861499051624
Encrypted:	false
SSDEEP:	96:TiZYWhNK/a6FYYYFDW2HKYEZNltk0ibE/SxwOTn4akadMdiXI6+w3:2ZDL+fI8gsakadMdi46+w3
MD5:	99F0DFF9544529F84344F3253587A364
SHA1:	AEF60091641C1FDB70DE1DCC5A11B96C69783550
SHA-256:	49D55EE2B3D20D61A9028772C02545D448A3E00CD2D403D2281E089041D46544
SHA-512:	6CF55881692A25BE3AB955FD967C74F2C024BE5D5D7CD720654E034DD71C0DB9F7589EC7AA6E381734F55EC1B935CB7EA8714EE9971853707DCA09DD99A129FB
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.945585251880973
Encrypted:	false
SSDEEP:	96:6ZUpZsm0HwZ8FLSeXs+aiL9qcZ7KtlAD1GlNHgdkVI5F11AcNmwkVFzGz6ENhZC7:62T0QOLl8vAqcZ7K3AUNAdx5FAx9VEOj
MD5:	77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA1:	9E98ACE72BD2AB931341427A856EF4CEA6FAF806
SHA-256:	5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
SHA-512:	3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
Malicious:	false
Preview:	MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.\|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.\|.....VQ....<........... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	340
Entropy (8bit):	3.155913334944608
Encrypted:	false
SSDEEP:	6:kKRkU5+7DYUN+SkQlPlEGYRMY9z+s3Ql2DUeXJlOW1:hLkPlE99SCQl2DUeXJlOA
MD5:	4A5DFB652B01165673850A31AD5A1AA1
SHA1:	E5F5DD0A9A1173E08A61D6E8018CEF257E3A889B
SHA-256:	9D04243460A6B8A3F20D04951848F6B99493F85EDED488777060F4165AC3D70B
SHA-512:	735CA344BE8A0A2354AA5AB16004B0E1120C6337DECE4CD75AA9539B6DE24192CD5662A197ADD8B15B350B9429EBE7FBCECF6F1883A3147CD53FA6911EDFD7C8
Malicious:	false
Preview:	p...... ........y.z9.f..(....................................................... ........~..MG......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.371968148323026
Encrypted:	false
SSDEEP:	6144:cFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNiiL:sV1QyWWI/glMM6kF7kq
MD5:	A074F1BA614A40B8E5898FADF7F304D1
SHA1:	D2088489435DB2430529EEB541404F1EE77B2134
SHA-256:	AFAE0088E32A5C12FAE987C477B6696287CCB68E2B957199B3155B7DBA948D1E
SHA-512:	6BC44D7B64FDF42615296799D717451AFFA8E6F1267AF5879474A17F116F3C23D4FFE5108A943C2F06BEF824A986FAD135645CB60BFF9C11191CA46959DF4090
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...7.f...............................................................................................................................................................................................................................................................................................................................................=..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\mssecsvr.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2281472
Entropy (8bit):	7.613854014709872
Encrypted:	false
SSDEEP:	49152:QnVENPbcBVQej/1INRx+TSqTdX1HkQo6SAAw:QVOoBhz1aRxcSUDk36SAz
MD5:	B15FB425B628062A7BB0F11DBAECF4AC
SHA1:	016EBB19FB4A8D125867D63FAA200E77DF1273E7
SHA-256:	EBE31FD906BDF28945926CEE334266ABD14C7A81390C13867D1ABFDC1DC8F540
SHA-512:	0DB0B74354A5444D0A6134FAA4DDE79750AC110FEE116235B5BB908988868F171B63966D5E2ACB28319EA2138880777F284515520A5D1A945C163E35DB98EF4C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvr.exe, Author: us-cert code analysis team
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....L......................"...................@...........................P......................................................1..z...........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.........1...... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.714028216833752
Encrypted:	false
SSDEEP:	49152:DENPbcBVQej/1INRx+TSqTdX1HkQo6SAAW:DOoBhz1aRxcSUDk36SAp
MD5:	41C0E22D28973F312DE789C027E61D0C
SHA1:	193F7413961324EDA1F3F8CD0F6010FCB73028EC
SHA-256:	282AFB52E37BFB69D3016E1BB99E11AA9D6D9CB7759BA02279E44EEB9F504A9B
SHA-512:	D4196D39077E6F7AD8E402762FAD33B3CE74558FD8C34B412DDA96A118BB421927CEC5816C6D5728DE79288DFECCBA066630211043B35C16C1A165A4BEC19A37
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:
Entropy (8bit):	4.0536849397765025
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 98.32% Windows Screen Saver (13104/52) 1.29% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ruXU7wj3X9.dll
File size:	5'267'459 bytes
MD5:	d907672759069af4824b0354e9170285
SHA1:	d995544a19032e9cebdd6d76c03580a89bd7a330
SHA256:	4ad2a09b3c99f31faf5f46b2298dcf2e9c5b84a96732bffea2fcf4e2c2aa791e
SHA512:	4b95745fd90589bc154ca7a22bd5dd625332d0f7bf9a87db198e8253012871b7fb108793d7372658515ad2b4cdd12c5047ff06120d43c1de673e8e3b6d5ad6bd
SSDEEP:	49152:RnVENPbcBVQej/1INRx+TSqTdX1HkQo6SAA:1VOoBhz1aRxcSUDk36SA
TLSH:	3236F115A1E86B74E6F31EB2217B871047797E45899B928E1760A04F0C33F5CDEB2F29
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T22:42:29.157189+0100	2830018	ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	1	192.168.2.8	49256	1.1.1.1	53	UDP
2025-01-14T22:42:30.076941+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49707	103.224.212.215	80	TCP
2025-01-14T22:42:32.744988+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49709	103.224.212.215	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 22:42:22.743256092 CET	49673	443	192.168.2.8	23.206.229.226
Jan 14, 2025 22:42:22.993379116 CET	49677	80	192.168.2.8	192.229.211.108
Jan 14, 2025 22:42:23.102567911 CET	49672	443	192.168.2.8	23.206.229.226
Jan 14, 2025 22:42:29.472105980 CET	49707	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:29.476869106 CET	80	49707	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:29.476953983 CET	49707	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:29.477104902 CET	49707	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:29.481851101 CET	80	49707	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:30.076818943 CET	80	49707	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:30.076941013 CET	49707	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:30.076944113 CET	80	49707	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:30.076999903 CET	49707	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:30.186610937 CET	49707	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:30.191502094 CET	80	49707	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:30.382056952 CET	49708	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:30.386847973 CET	80	49708	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:30.386920929 CET	49708	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:30.387044907 CET	49708	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:30.391828060 CET	80	49708	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:30.843998909 CET	80	49708	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:30.844014883 CET	80	49708	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:30.844077110 CET	49708	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:30.851619005 CET	49708	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:30.851646900 CET	49708	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:31.001969099 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:31.276201010 CET	49710	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.008810997 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.108027935 CET	80	49709	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.108186007 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.108426094 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.108772993 CET	80	49710	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.108855963 CET	49710	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.109003067 CET	49710	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.111476898 CET	80	49709	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.111541986 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.113292933 CET	80	49709	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.113867998 CET	80	49710	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.352576971 CET	49673	443	192.168.2.8	23.206.229.226
Jan 14, 2025 22:42:32.711926937 CET	49672	443	192.168.2.8	23.206.229.226
Jan 14, 2025 22:42:32.733532906 CET	80	49710	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.734180927 CET	80	49710	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.734302044 CET	49710	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.737009048 CET	49710	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.738771915 CET	49711	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:32.742980957 CET	80	49710	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.743735075 CET	80	49711	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:32.743946075 CET	49711	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:32.743974924 CET	49711	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:32.744865894 CET	80	49709	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.744904041 CET	80	49709	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.744987965 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.747610092 CET	49709	80	192.168.2.8	103.224.212.215
Jan 14, 2025 22:42:32.748569012 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:32.748707056 CET	80	49711	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:32.752418041 CET	80	49709	103.224.212.215	192.168.2.8
Jan 14, 2025 22:42:32.753444910 CET	80	49712	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:32.753618002 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:32.753730059 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:32.758558989 CET	80	49712	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:33.219224930 CET	80	49711	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:33.219248056 CET	80	49711	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:33.219417095 CET	49711	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.226250887 CET	49711	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.226250887 CET	49711	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.227669001 CET	80	49712	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:33.227699041 CET	80	49712	199.59.243.228	192.168.2.8
Jan 14, 2025 22:42:33.227763891 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.227763891 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.236411095 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.236479044 CET	49712	80	192.168.2.8	199.59.243.228
Jan 14, 2025 22:42:33.292421103 CET	49713	445	192.168.2.8	119.38.196.13
Jan 14, 2025 22:42:33.297233105 CET	445	49713	119.38.196.13	192.168.2.8
Jan 14, 2025 22:42:33.297314882 CET	49713	445	192.168.2.8	119.38.196.13
Jan 14, 2025 22:42:33.298320055 CET	49713	445	192.168.2.8	119.38.196.13
Jan 14, 2025 22:42:33.299484015 CET	49714	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.303210020 CET	445	49713	119.38.196.13	192.168.2.8
Jan 14, 2025 22:42:33.303308964 CET	49713	445	192.168.2.8	119.38.196.13
Jan 14, 2025 22:42:33.304287910 CET	445	49714	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:33.304363012 CET	49714	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.304433107 CET	49714	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.306497097 CET	49715	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.309293032 CET	445	49714	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:33.309355974 CET	49714	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.311327934 CET	445	49715	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:33.311394930 CET	49715	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.311465979 CET	49715	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:33.316257000 CET	445	49715	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:34.431449890 CET	443	49706	23.206.229.226	192.168.2.8
Jan 14, 2025 22:42:34.431567907 CET	49706	443	192.168.2.8	23.206.229.226
Jan 14, 2025 22:42:35.291994095 CET	49739	445	192.168.2.8	63.85.204.70
Jan 14, 2025 22:42:35.298962116 CET	445	49739	63.85.204.70	192.168.2.8
Jan 14, 2025 22:42:35.299077034 CET	49739	445	192.168.2.8	63.85.204.70
Jan 14, 2025 22:42:35.305435896 CET	49739	445	192.168.2.8	63.85.204.70
Jan 14, 2025 22:42:35.307518959 CET	49740	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.310302973 CET	445	49739	63.85.204.70	192.168.2.8
Jan 14, 2025 22:42:35.310700893 CET	49739	445	192.168.2.8	63.85.204.70
Jan 14, 2025 22:42:35.312323093 CET	445	49740	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:35.312493086 CET	49740	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.312493086 CET	49740	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.313864946 CET	49741	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.317435980 CET	445	49740	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:35.317548037 CET	49740	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.318679094 CET	445	49741	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:35.318764925 CET	49741	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.318808079 CET	49741	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:35.323606968 CET	445	49741	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:37.307153940 CET	49767	445	192.168.2.8	83.249.153.94
Jan 14, 2025 22:42:37.312043905 CET	445	49767	83.249.153.94	192.168.2.8
Jan 14, 2025 22:42:37.312500000 CET	49767	445	192.168.2.8	83.249.153.94
Jan 14, 2025 22:42:37.312624931 CET	49767	445	192.168.2.8	83.249.153.94
Jan 14, 2025 22:42:37.312872887 CET	49768	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.317617893 CET	445	49767	83.249.153.94	192.168.2.8
Jan 14, 2025 22:42:37.317809105 CET	445	49768	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:37.317853928 CET	49767	445	192.168.2.8	83.249.153.94
Jan 14, 2025 22:42:37.317889929 CET	49768	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.317955017 CET	49768	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.319468975 CET	49769	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.322813034 CET	445	49768	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:37.322854996 CET	49768	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.324244976 CET	445	49769	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:37.324492931 CET	49769	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.324601889 CET	49769	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:37.329355001 CET	445	49769	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:39.322803974 CET	49793	445	192.168.2.8	27.108.78.45
Jan 14, 2025 22:42:39.327682972 CET	445	49793	27.108.78.45	192.168.2.8
Jan 14, 2025 22:42:39.328563929 CET	49793	445	192.168.2.8	27.108.78.45
Jan 14, 2025 22:42:39.328681946 CET	49793	445	192.168.2.8	27.108.78.45
Jan 14, 2025 22:42:39.328926086 CET	49794	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.333594084 CET	445	49793	27.108.78.45	192.168.2.8
Jan 14, 2025 22:42:39.333735943 CET	445	49794	27.108.78.1	192.168.2.8
Jan 14, 2025 22:42:39.333817959 CET	49793	445	192.168.2.8	27.108.78.45
Jan 14, 2025 22:42:39.333846092 CET	49794	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.333950043 CET	49794	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.335338116 CET	49795	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.339889050 CET	445	49794	27.108.78.1	192.168.2.8
Jan 14, 2025 22:42:39.340543985 CET	49794	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.340759993 CET	445	49795	27.108.78.1	192.168.2.8
Jan 14, 2025 22:42:39.340868950 CET	49795	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.340910912 CET	49795	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:42:39.346446991 CET	445	49795	27.108.78.1	192.168.2.8
Jan 14, 2025 22:42:41.338747025 CET	49818	445	192.168.2.8	121.134.74.17
Jan 14, 2025 22:42:41.343611002 CET	445	49818	121.134.74.17	192.168.2.8
Jan 14, 2025 22:42:41.343710899 CET	49818	445	192.168.2.8	121.134.74.17
Jan 14, 2025 22:42:41.343775034 CET	49818	445	192.168.2.8	121.134.74.17
Jan 14, 2025 22:42:41.344027042 CET	49819	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.348721027 CET	445	49818	121.134.74.17	192.168.2.8
Jan 14, 2025 22:42:41.348783970 CET	49818	445	192.168.2.8	121.134.74.17
Jan 14, 2025 22:42:41.348824978 CET	445	49819	121.134.74.1	192.168.2.8
Jan 14, 2025 22:42:41.348929882 CET	49819	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.349015951 CET	49819	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.349956036 CET	49820	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.353862047 CET	445	49819	121.134.74.1	192.168.2.8
Jan 14, 2025 22:42:41.354048014 CET	49819	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.354722023 CET	445	49820	121.134.74.1	192.168.2.8
Jan 14, 2025 22:42:41.354792118 CET	49820	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.354851007 CET	49820	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:42:41.359628916 CET	445	49820	121.134.74.1	192.168.2.8
Jan 14, 2025 22:42:43.354171038 CET	49842	445	192.168.2.8	39.85.39.22
Jan 14, 2025 22:42:43.359077930 CET	445	49842	39.85.39.22	192.168.2.8
Jan 14, 2025 22:42:43.359184027 CET	49842	445	192.168.2.8	39.85.39.22
Jan 14, 2025 22:42:43.359220028 CET	49842	445	192.168.2.8	39.85.39.22
Jan 14, 2025 22:42:43.359427929 CET	49843	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.364145041 CET	445	49842	39.85.39.22	192.168.2.8
Jan 14, 2025 22:42:43.364216089 CET	445	49843	39.85.39.1	192.168.2.8
Jan 14, 2025 22:42:43.364217043 CET	49842	445	192.168.2.8	39.85.39.22
Jan 14, 2025 22:42:43.364280939 CET	49843	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.364387989 CET	49843	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.365808964 CET	49844	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.371370077 CET	445	49843	39.85.39.1	192.168.2.8
Jan 14, 2025 22:42:43.371391058 CET	445	49844	39.85.39.1	192.168.2.8
Jan 14, 2025 22:42:43.371464968 CET	49843	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.371490002 CET	49844	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.371525049 CET	49844	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:42:43.376852989 CET	445	49844	39.85.39.1	192.168.2.8
Jan 14, 2025 22:42:45.368608952 CET	49865	445	192.168.2.8	209.76.99.172
Jan 14, 2025 22:42:45.373445988 CET	445	49865	209.76.99.172	192.168.2.8
Jan 14, 2025 22:42:45.373544931 CET	49865	445	192.168.2.8	209.76.99.172
Jan 14, 2025 22:42:45.373579025 CET	49865	445	192.168.2.8	209.76.99.172
Jan 14, 2025 22:42:45.373779058 CET	49866	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.378429890 CET	445	49865	209.76.99.172	192.168.2.8
Jan 14, 2025 22:42:45.378566027 CET	445	49865	209.76.99.172	192.168.2.8
Jan 14, 2025 22:42:45.378609896 CET	445	49866	209.76.99.1	192.168.2.8
Jan 14, 2025 22:42:45.378612041 CET	49865	445	192.168.2.8	209.76.99.172
Jan 14, 2025 22:42:45.378674030 CET	49866	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.378755093 CET	49866	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.379065990 CET	49867	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.383572102 CET	445	49866	209.76.99.1	192.168.2.8
Jan 14, 2025 22:42:45.383646011 CET	49866	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.383862019 CET	445	49867	209.76.99.1	192.168.2.8
Jan 14, 2025 22:42:45.383939028 CET	49867	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.384035110 CET	49867	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:42:45.388811111 CET	445	49867	209.76.99.1	192.168.2.8
Jan 14, 2025 22:42:47.388128042 CET	49890	445	192.168.2.8	6.99.0.142
Jan 14, 2025 22:42:47.392997026 CET	445	49890	6.99.0.142	192.168.2.8
Jan 14, 2025 22:42:47.393085003 CET	49890	445	192.168.2.8	6.99.0.142
Jan 14, 2025 22:42:47.393146992 CET	49890	445	192.168.2.8	6.99.0.142
Jan 14, 2025 22:42:47.393289089 CET	49891	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.398102999 CET	445	49891	6.99.0.1	192.168.2.8
Jan 14, 2025 22:42:47.398169994 CET	445	49890	6.99.0.142	192.168.2.8
Jan 14, 2025 22:42:47.398197889 CET	49891	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.398221016 CET	49890	445	192.168.2.8	6.99.0.142
Jan 14, 2025 22:42:47.398324966 CET	49891	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.398610115 CET	49892	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.403136015 CET	445	49891	6.99.0.1	192.168.2.8
Jan 14, 2025 22:42:47.403228998 CET	49891	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.403347969 CET	445	49892	6.99.0.1	192.168.2.8
Jan 14, 2025 22:42:47.403409004 CET	49892	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.404326916 CET	49892	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:42:47.409096003 CET	445	49892	6.99.0.1	192.168.2.8
Jan 14, 2025 22:42:49.399918079 CET	49915	445	192.168.2.8	169.120.240.150
Jan 14, 2025 22:42:49.404701948 CET	445	49915	169.120.240.150	192.168.2.8
Jan 14, 2025 22:42:49.404797077 CET	49915	445	192.168.2.8	169.120.240.150
Jan 14, 2025 22:42:49.404849052 CET	49915	445	192.168.2.8	169.120.240.150
Jan 14, 2025 22:42:49.405033112 CET	49916	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.409749985 CET	445	49915	169.120.240.150	192.168.2.8
Jan 14, 2025 22:42:49.409806013 CET	445	49916	169.120.240.1	192.168.2.8
Jan 14, 2025 22:42:49.409823895 CET	49915	445	192.168.2.8	169.120.240.150
Jan 14, 2025 22:42:49.409882069 CET	49916	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.409919024 CET	49916	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.410211086 CET	49917	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.414932013 CET	445	49917	169.120.240.1	192.168.2.8
Jan 14, 2025 22:42:49.415062904 CET	49917	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.415134907 CET	49917	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.415143013 CET	445	49916	169.120.240.1	192.168.2.8
Jan 14, 2025 22:42:49.415215969 CET	49916	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:42:49.419868946 CET	445	49917	169.120.240.1	192.168.2.8
Jan 14, 2025 22:42:51.415570974 CET	49938	445	192.168.2.8	60.253.184.204
Jan 14, 2025 22:42:51.420428038 CET	445	49938	60.253.184.204	192.168.2.8
Jan 14, 2025 22:42:51.420515060 CET	49938	445	192.168.2.8	60.253.184.204
Jan 14, 2025 22:42:51.420593023 CET	49938	445	192.168.2.8	60.253.184.204
Jan 14, 2025 22:42:51.420752048 CET	49939	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.425441980 CET	445	49938	60.253.184.204	192.168.2.8
Jan 14, 2025 22:42:51.425501108 CET	49938	445	192.168.2.8	60.253.184.204
Jan 14, 2025 22:42:51.425508976 CET	445	49939	60.253.184.1	192.168.2.8
Jan 14, 2025 22:42:51.425565004 CET	49939	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.425621033 CET	49939	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.425899982 CET	49940	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.430686951 CET	445	49939	60.253.184.1	192.168.2.8
Jan 14, 2025 22:42:51.430697918 CET	445	49940	60.253.184.1	192.168.2.8
Jan 14, 2025 22:42:51.430732965 CET	49939	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.430763006 CET	49940	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.430775881 CET	49940	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:42:51.435580969 CET	445	49940	60.253.184.1	192.168.2.8
Jan 14, 2025 22:42:53.449594021 CET	49963	445	192.168.2.8	128.38.222.36
Jan 14, 2025 22:42:53.454562902 CET	445	49963	128.38.222.36	192.168.2.8
Jan 14, 2025 22:42:53.454677105 CET	49963	445	192.168.2.8	128.38.222.36
Jan 14, 2025 22:42:53.458292961 CET	49963	445	192.168.2.8	128.38.222.36
Jan 14, 2025 22:42:53.458530903 CET	49964	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.463229895 CET	445	49963	128.38.222.36	192.168.2.8
Jan 14, 2025 22:42:53.463318110 CET	49963	445	192.168.2.8	128.38.222.36
Jan 14, 2025 22:42:53.463829994 CET	445	49964	128.38.222.1	192.168.2.8
Jan 14, 2025 22:42:53.463891983 CET	49964	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.466407061 CET	49964	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.466713905 CET	49965	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.471190929 CET	445	49964	128.38.222.1	192.168.2.8
Jan 14, 2025 22:42:53.471254110 CET	49964	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.471592903 CET	445	49965	128.38.222.1	192.168.2.8
Jan 14, 2025 22:42:53.471651077 CET	49965	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.483705997 CET	49965	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:42:53.488482952 CET	445	49965	128.38.222.1	192.168.2.8
Jan 14, 2025 22:42:54.699763060 CET	445	49715	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:54.699894905 CET	49715	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:54.699966908 CET	49715	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:54.700041056 CET	49715	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:54.704720974 CET	445	49715	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:54.704772949 CET	445	49715	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:55.462621927 CET	49987	445	192.168.2.8	78.135.150.7
Jan 14, 2025 22:42:55.467592001 CET	445	49987	78.135.150.7	192.168.2.8
Jan 14, 2025 22:42:55.468570948 CET	49987	445	192.168.2.8	78.135.150.7
Jan 14, 2025 22:42:55.468626022 CET	49987	445	192.168.2.8	78.135.150.7
Jan 14, 2025 22:42:55.468755960 CET	49988	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:42:55.473618031 CET	445	49988	78.135.150.1	192.168.2.8
Jan 14, 2025 22:42:55.473645926 CET	445	49987	78.135.150.7	192.168.2.8
Jan 14, 2025 22:42:55.473731041 CET	49987	445	192.168.2.8	78.135.150.7
Jan 14, 2025 22:42:55.473768950 CET	49988	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:42:55.474112034 CET	49989	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:42:55.478672028 CET	445	49988	78.135.150.1	192.168.2.8
Jan 14, 2025 22:42:55.478996038 CET	445	49989	78.135.150.1	192.168.2.8
Jan 14, 2025 22:42:55.479055882 CET	49988	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:42:55.479094982 CET	49989	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:42:55.479161978 CET	49989	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:42:55.483944893 CET	445	49989	78.135.150.1	192.168.2.8
Jan 14, 2025 22:42:56.678915977 CET	445	49741	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:56.679022074 CET	49741	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:56.679078102 CET	49741	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:56.679151058 CET	49741	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:56.683830023 CET	445	49741	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:56.683896065 CET	445	49741	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:57.478501081 CET	50010	445	192.168.2.8	63.102.247.7
Jan 14, 2025 22:42:57.483283043 CET	445	50010	63.102.247.7	192.168.2.8
Jan 14, 2025 22:42:57.483366013 CET	50010	445	192.168.2.8	63.102.247.7
Jan 14, 2025 22:42:57.483510971 CET	50011	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.484476089 CET	50010	445	192.168.2.8	63.102.247.7
Jan 14, 2025 22:42:57.488312006 CET	445	50011	63.102.247.1	192.168.2.8
Jan 14, 2025 22:42:57.488495111 CET	50011	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.488694906 CET	50011	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.489208937 CET	50012	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.489341021 CET	445	50010	63.102.247.7	192.168.2.8
Jan 14, 2025 22:42:57.489402056 CET	50010	445	192.168.2.8	63.102.247.7
Jan 14, 2025 22:42:57.493753910 CET	445	50011	63.102.247.1	192.168.2.8
Jan 14, 2025 22:42:57.493807077 CET	50011	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.494013071 CET	445	50012	63.102.247.1	192.168.2.8
Jan 14, 2025 22:42:57.494266987 CET	50012	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.494266987 CET	50012	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:42:57.499159098 CET	445	50012	63.102.247.1	192.168.2.8
Jan 14, 2025 22:42:57.712408066 CET	50016	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:57.717168093 CET	445	50016	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:57.717262030 CET	50016	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:57.717262030 CET	50016	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:42:57.722028971 CET	445	50016	119.38.196.1	192.168.2.8
Jan 14, 2025 22:42:58.819148064 CET	445	49769	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:58.819370031 CET	49769	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:58.819370031 CET	49769	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:58.819415092 CET	49769	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:42:58.824239016 CET	445	49769	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:58.824295998 CET	445	49769	83.249.153.1	192.168.2.8
Jan 14, 2025 22:42:59.495774984 CET	50019	445	192.168.2.8	129.31.49.100
Jan 14, 2025 22:42:59.500869989 CET	445	50019	129.31.49.100	192.168.2.8
Jan 14, 2025 22:42:59.500942945 CET	50019	445	192.168.2.8	129.31.49.100
Jan 14, 2025 22:42:59.501049995 CET	50019	445	192.168.2.8	129.31.49.100
Jan 14, 2025 22:42:59.502146006 CET	50020	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.506006002 CET	445	50019	129.31.49.100	192.168.2.8
Jan 14, 2025 22:42:59.506072998 CET	50019	445	192.168.2.8	129.31.49.100
Jan 14, 2025 22:42:59.506989002 CET	445	50020	129.31.49.1	192.168.2.8
Jan 14, 2025 22:42:59.507333994 CET	50020	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.507333994 CET	50020	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.507369041 CET	50021	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.512209892 CET	445	50021	129.31.49.1	192.168.2.8
Jan 14, 2025 22:42:59.512304068 CET	50021	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.512327909 CET	445	50020	129.31.49.1	192.168.2.8
Jan 14, 2025 22:42:59.512370110 CET	50021	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.512475014 CET	50020	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:42:59.517194986 CET	445	50021	129.31.49.1	192.168.2.8
Jan 14, 2025 22:42:59.685143948 CET	50022	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:59.689985991 CET	445	50022	63.85.204.1	192.168.2.8
Jan 14, 2025 22:42:59.690169096 CET	50022	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:59.693145037 CET	50022	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:42:59.697933912 CET	445	50022	63.85.204.1	192.168.2.8
Jan 14, 2025 22:43:00.697938919 CET	445	49795	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:00.698725939 CET	49795	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:00.699286938 CET	49795	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:00.699286938 CET	49795	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:00.704108953 CET	445	49795	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:00.704118967 CET	445	49795	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:01.509377956 CET	50023	445	192.168.2.8	25.106.82.231
Jan 14, 2025 22:43:01.514144897 CET	445	50023	25.106.82.231	192.168.2.8
Jan 14, 2025 22:43:01.514238119 CET	50023	445	192.168.2.8	25.106.82.231
Jan 14, 2025 22:43:01.514298916 CET	50023	445	192.168.2.8	25.106.82.231
Jan 14, 2025 22:43:01.514543056 CET	50024	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.519211054 CET	445	50023	25.106.82.231	192.168.2.8
Jan 14, 2025 22:43:01.519273996 CET	50023	445	192.168.2.8	25.106.82.231
Jan 14, 2025 22:43:01.519316912 CET	445	50024	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:01.519376993 CET	50024	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.519397020 CET	50024	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.519671917 CET	50025	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.524410009 CET	445	50025	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:01.524475098 CET	50025	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.524516106 CET	50025	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.524985075 CET	445	50024	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:01.525039911 CET	50024	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:01.529295921 CET	445	50025	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:01.821621895 CET	50026	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:43:01.826486111 CET	445	50026	83.249.153.1	192.168.2.8
Jan 14, 2025 22:43:01.826631069 CET	50026	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:43:01.826631069 CET	50026	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:43:01.831573009 CET	445	50026	83.249.153.1	192.168.2.8
Jan 14, 2025 22:43:02.731112957 CET	445	49820	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:02.731178999 CET	49820	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:02.762329102 CET	49820	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:02.762415886 CET	49820	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:02.767086029 CET	445	49820	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:02.767200947 CET	445	49820	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:03.524970055 CET	50027	445	192.168.2.8	157.193.184.198
Jan 14, 2025 22:43:03.529881954 CET	445	50027	157.193.184.198	192.168.2.8
Jan 14, 2025 22:43:03.532555103 CET	50027	445	192.168.2.8	157.193.184.198
Jan 14, 2025 22:43:03.532572985 CET	50027	445	192.168.2.8	157.193.184.198
Jan 14, 2025 22:43:03.532741070 CET	50028	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.537583113 CET	445	50028	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:03.537702084 CET	445	50027	157.193.184.198	192.168.2.8
Jan 14, 2025 22:43:03.537775040 CET	50027	445	192.168.2.8	157.193.184.198
Jan 14, 2025 22:43:03.537827015 CET	50028	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.537985086 CET	50028	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.538367033 CET	50029	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.543148994 CET	445	50029	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:03.544609070 CET	50029	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.544609070 CET	50029	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.546406984 CET	445	50028	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:03.549474955 CET	445	50029	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:03.566020012 CET	445	50028	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:03.568550110 CET	50028	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:03.712429047 CET	50030	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:03.717330933 CET	445	50030	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:03.717420101 CET	50030	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:03.717475891 CET	50030	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:03.722278118 CET	445	50030	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:04.757915020 CET	445	49844	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:04.758055925 CET	49844	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:04.758183002 CET	49844	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:04.758270025 CET	49844	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:04.762937069 CET	445	49844	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:04.763010979 CET	445	49844	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:05.541675091 CET	50031	445	192.168.2.8	223.39.125.12
Jan 14, 2025 22:43:05.546627045 CET	445	50031	223.39.125.12	192.168.2.8
Jan 14, 2025 22:43:05.546698093 CET	50031	445	192.168.2.8	223.39.125.12
Jan 14, 2025 22:43:05.546899080 CET	50031	445	192.168.2.8	223.39.125.12
Jan 14, 2025 22:43:05.547142029 CET	50032	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.551949978 CET	445	50032	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:05.552058935 CET	50032	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.552170038 CET	50032	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.552818060 CET	50033	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.554439068 CET	445	50031	223.39.125.12	192.168.2.8
Jan 14, 2025 22:43:05.557687044 CET	445	50033	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:05.557771921 CET	50033	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.557926893 CET	50033	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.558387995 CET	445	50032	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:05.562807083 CET	445	50033	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:05.567413092 CET	445	50031	223.39.125.12	192.168.2.8
Jan 14, 2025 22:43:05.567492962 CET	50031	445	192.168.2.8	223.39.125.12
Jan 14, 2025 22:43:05.567903996 CET	445	50032	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:05.568006039 CET	50032	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:05.777009010 CET	50034	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:05.781907082 CET	445	50034	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:05.782110929 CET	50034	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:05.782190084 CET	50034	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:05.786998034 CET	445	50034	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:06.772443056 CET	445	49867	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:06.772742033 CET	49867	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:06.772778034 CET	49867	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:06.772857904 CET	49867	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:06.777576923 CET	445	49867	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:06.777587891 CET	445	49867	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:07.556395054 CET	50035	445	192.168.2.8	152.201.76.41
Jan 14, 2025 22:43:07.561239958 CET	445	50035	152.201.76.41	192.168.2.8
Jan 14, 2025 22:43:07.561372995 CET	50035	445	192.168.2.8	152.201.76.41
Jan 14, 2025 22:43:07.561614990 CET	50035	445	192.168.2.8	152.201.76.41
Jan 14, 2025 22:43:07.561748028 CET	50036	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.566689014 CET	445	50036	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:07.566833019 CET	50036	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.566906929 CET	50036	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.567244053 CET	50037	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.567650080 CET	445	50035	152.201.76.41	192.168.2.8
Jan 14, 2025 22:43:07.567725897 CET	50035	445	192.168.2.8	152.201.76.41
Jan 14, 2025 22:43:07.571760893 CET	445	50036	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:07.571839094 CET	50036	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.572137117 CET	445	50037	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:07.572222948 CET	50037	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.572242022 CET	50037	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:07.577065945 CET	445	50037	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:07.759145021 CET	50038	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:07.764090061 CET	445	50038	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:07.764220953 CET	50038	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:07.764375925 CET	50038	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:07.769177914 CET	445	50038	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:08.776225090 CET	445	49892	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:08.776294947 CET	49892	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:08.776343107 CET	49892	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:08.776391029 CET	49892	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:08.781255007 CET	445	49892	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:08.781287909 CET	445	49892	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:09.431324005 CET	50039	445	192.168.2.8	71.121.162.168
Jan 14, 2025 22:43:09.436212063 CET	445	50039	71.121.162.168	192.168.2.8
Jan 14, 2025 22:43:09.436316967 CET	50039	445	192.168.2.8	71.121.162.168
Jan 14, 2025 22:43:09.436459064 CET	50039	445	192.168.2.8	71.121.162.168
Jan 14, 2025 22:43:09.436651945 CET	50040	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.441270113 CET	445	50039	71.121.162.168	192.168.2.8
Jan 14, 2025 22:43:09.441447973 CET	50039	445	192.168.2.8	71.121.162.168
Jan 14, 2025 22:43:09.441457987 CET	445	50040	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:09.441540956 CET	50040	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.441601038 CET	50040	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.441891909 CET	50041	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.446338892 CET	445	50040	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:09.446615934 CET	445	50040	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:09.446666956 CET	50040	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.446700096 CET	445	50041	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:09.446770906 CET	50041	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.446822882 CET	50041	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:09.451567888 CET	445	50041	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:09.774668932 CET	50042	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:09.779575109 CET	445	50042	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:09.779745102 CET	50042	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:09.779745102 CET	50042	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:09.784522057 CET	445	50042	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:10.788081884 CET	445	49917	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:10.788196087 CET	49917	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:10.788255930 CET	49917	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:10.788301945 CET	49917	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:10.793116093 CET	445	49917	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:10.793128967 CET	445	49917	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:11.184539080 CET	50043	445	192.168.2.8	57.79.44.38
Jan 14, 2025 22:43:11.189423084 CET	445	50043	57.79.44.38	192.168.2.8
Jan 14, 2025 22:43:11.189486980 CET	50043	445	192.168.2.8	57.79.44.38
Jan 14, 2025 22:43:11.192765951 CET	50043	445	192.168.2.8	57.79.44.38
Jan 14, 2025 22:43:11.192956924 CET	50044	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.197626114 CET	445	50043	57.79.44.38	192.168.2.8
Jan 14, 2025 22:43:11.197709084 CET	50043	445	192.168.2.8	57.79.44.38
Jan 14, 2025 22:43:11.197799921 CET	445	50044	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:11.197855949 CET	50044	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.201491117 CET	50044	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.202003956 CET	50045	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.206373930 CET	445	50044	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:11.206429958 CET	50044	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.206749916 CET	445	50045	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:11.206809998 CET	50045	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.209949970 CET	50045	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:11.214699030 CET	445	50045	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:11.790290117 CET	50046	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:11.795121908 CET	445	50046	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:11.795242071 CET	50046	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:11.795242071 CET	50046	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:11.800052881 CET	445	50046	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:12.773339987 CET	445	49940	60.253.184.1	192.168.2.8
Jan 14, 2025 22:43:12.773514032 CET	49940	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:12.773514032 CET	49940	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:12.773600101 CET	49940	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:12.778361082 CET	445	49940	60.253.184.1	192.168.2.8
Jan 14, 2025 22:43:12.778373003 CET	445	49940	60.253.184.1	192.168.2.8
Jan 14, 2025 22:43:12.822021008 CET	50047	445	192.168.2.8	90.207.146.203
Jan 14, 2025 22:43:12.826874018 CET	445	50047	90.207.146.203	192.168.2.8
Jan 14, 2025 22:43:12.826957941 CET	50047	445	192.168.2.8	90.207.146.203
Jan 14, 2025 22:43:12.827008009 CET	50047	445	192.168.2.8	90.207.146.203
Jan 14, 2025 22:43:12.827224016 CET	50048	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.831847906 CET	445	50047	90.207.146.203	192.168.2.8
Jan 14, 2025 22:43:12.831901073 CET	50047	445	192.168.2.8	90.207.146.203
Jan 14, 2025 22:43:12.831996918 CET	445	50048	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:12.832082033 CET	50048	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.832155943 CET	50048	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.832504988 CET	50049	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.837119102 CET	445	50048	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:12.837241888 CET	50048	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.837280989 CET	445	50049	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:12.837332964 CET	50049	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.837368011 CET	50049	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:12.842937946 CET	445	50049	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:13.790340900 CET	50050	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:13.795190096 CET	445	50050	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:13.795269966 CET	50050	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:13.795488119 CET	50050	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:13.800254107 CET	445	50050	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:14.356185913 CET	50051	445	192.168.2.8	197.208.96.223
Jan 14, 2025 22:43:14.361082077 CET	445	50051	197.208.96.223	192.168.2.8
Jan 14, 2025 22:43:14.361146927 CET	50051	445	192.168.2.8	197.208.96.223
Jan 14, 2025 22:43:14.364845991 CET	50051	445	192.168.2.8	197.208.96.223
Jan 14, 2025 22:43:14.364973068 CET	50052	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.369678974 CET	445	50051	197.208.96.223	192.168.2.8
Jan 14, 2025 22:43:14.369754076 CET	445	50052	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:14.369808912 CET	50052	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.369941950 CET	50051	445	192.168.2.8	197.208.96.223
Jan 14, 2025 22:43:14.373955011 CET	50052	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.374411106 CET	50053	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.378720045 CET	445	50052	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:14.378774881 CET	50052	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.379170895 CET	445	50053	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:14.379226923 CET	50053	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.385257006 CET	50053	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:14.390424013 CET	445	50053	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:14.872504950 CET	445	49965	128.38.222.1	192.168.2.8
Jan 14, 2025 22:43:14.872843027 CET	49965	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:14.872843027 CET	49965	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:14.872843027 CET	49965	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:14.877671957 CET	445	49965	128.38.222.1	192.168.2.8
Jan 14, 2025 22:43:14.878523111 CET	445	49965	128.38.222.1	192.168.2.8
Jan 14, 2025 22:43:15.774732113 CET	50054	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:15.775006056 CET	50055	445	192.168.2.8	142.195.63.24
Jan 14, 2025 22:43:15.779700994 CET	445	50054	60.253.184.1	192.168.2.8
Jan 14, 2025 22:43:15.779788971 CET	50054	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:15.779800892 CET	445	50055	142.195.63.24	192.168.2.8
Jan 14, 2025 22:43:15.779831886 CET	50054	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:15.779860020 CET	50055	445	192.168.2.8	142.195.63.24
Jan 14, 2025 22:43:15.779967070 CET	50055	445	192.168.2.8	142.195.63.24
Jan 14, 2025 22:43:15.781677961 CET	50056	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.784604073 CET	445	50054	60.253.184.1	192.168.2.8
Jan 14, 2025 22:43:15.785072088 CET	445	50055	142.195.63.24	192.168.2.8
Jan 14, 2025 22:43:15.785125971 CET	50055	445	192.168.2.8	142.195.63.24
Jan 14, 2025 22:43:15.786470890 CET	445	50056	142.195.63.1	192.168.2.8
Jan 14, 2025 22:43:15.786880970 CET	50057	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.787337065 CET	50056	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.787337065 CET	50056	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.791810036 CET	445	50057	142.195.63.1	192.168.2.8
Jan 14, 2025 22:43:15.791906118 CET	50057	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.791906118 CET	50057	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.792290926 CET	445	50056	142.195.63.1	192.168.2.8
Jan 14, 2025 22:43:15.795341969 CET	50056	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:15.796698093 CET	445	50057	142.195.63.1	192.168.2.8
Jan 14, 2025 22:43:16.882267952 CET	445	49989	78.135.150.1	192.168.2.8
Jan 14, 2025 22:43:16.882327080 CET	49989	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:16.882365942 CET	49989	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:16.882574081 CET	49989	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:16.887171030 CET	445	49989	78.135.150.1	192.168.2.8
Jan 14, 2025 22:43:16.887397051 CET	445	49989	78.135.150.1	192.168.2.8
Jan 14, 2025 22:43:17.104010105 CET	50058	445	192.168.2.8	109.225.95.186
Jan 14, 2025 22:43:17.108810902 CET	445	50058	109.225.95.186	192.168.2.8
Jan 14, 2025 22:43:17.108896971 CET	50058	445	192.168.2.8	109.225.95.186
Jan 14, 2025 22:43:17.111520052 CET	50058	445	192.168.2.8	109.225.95.186
Jan 14, 2025 22:43:17.111643076 CET	50059	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.116363049 CET	445	50058	109.225.95.186	192.168.2.8
Jan 14, 2025 22:43:17.116437912 CET	50058	445	192.168.2.8	109.225.95.186
Jan 14, 2025 22:43:17.116472006 CET	445	50059	109.225.95.1	192.168.2.8
Jan 14, 2025 22:43:17.116523027 CET	50059	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.119647980 CET	50059	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.119929075 CET	50060	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.124429941 CET	445	50059	109.225.95.1	192.168.2.8
Jan 14, 2025 22:43:17.124489069 CET	50059	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.124644995 CET	445	50060	109.225.95.1	192.168.2.8
Jan 14, 2025 22:43:17.124690056 CET	50060	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.127367973 CET	50060	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:17.132153034 CET	445	50060	109.225.95.1	192.168.2.8
Jan 14, 2025 22:43:17.884134054 CET	50061	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:17.888933897 CET	445	50061	128.38.222.1	192.168.2.8
Jan 14, 2025 22:43:17.889017105 CET	50061	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:17.889044046 CET	50061	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:17.893872023 CET	445	50061	128.38.222.1	192.168.2.8
Jan 14, 2025 22:43:18.353245974 CET	50062	445	192.168.2.8	158.206.214.229
Jan 14, 2025 22:43:18.358093977 CET	445	50062	158.206.214.229	192.168.2.8
Jan 14, 2025 22:43:18.358200073 CET	50062	445	192.168.2.8	158.206.214.229
Jan 14, 2025 22:43:18.358227968 CET	50062	445	192.168.2.8	158.206.214.229
Jan 14, 2025 22:43:18.358860970 CET	50063	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.363157034 CET	445	50062	158.206.214.229	192.168.2.8
Jan 14, 2025 22:43:18.363209963 CET	50062	445	192.168.2.8	158.206.214.229
Jan 14, 2025 22:43:18.363689899 CET	445	50063	158.206.214.1	192.168.2.8
Jan 14, 2025 22:43:18.363759995 CET	50063	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.363759995 CET	50063	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.364125013 CET	50064	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.369707108 CET	445	50064	158.206.214.1	192.168.2.8
Jan 14, 2025 22:43:18.369864941 CET	445	50063	158.206.214.1	192.168.2.8
Jan 14, 2025 22:43:18.369884968 CET	50064	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.369884968 CET	50064	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.370011091 CET	50063	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:18.375333071 CET	445	50064	158.206.214.1	192.168.2.8
Jan 14, 2025 22:43:18.850236893 CET	445	50012	63.102.247.1	192.168.2.8
Jan 14, 2025 22:43:18.850387096 CET	50012	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:18.850387096 CET	50012	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:18.850450039 CET	50012	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:18.855204105 CET	445	50012	63.102.247.1	192.168.2.8
Jan 14, 2025 22:43:18.855214119 CET	445	50012	63.102.247.1	192.168.2.8
Jan 14, 2025 22:43:19.100716114 CET	445	50016	119.38.196.1	192.168.2.8
Jan 14, 2025 22:43:19.100852013 CET	50016	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:43:19.100920916 CET	50016	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:43:19.100989103 CET	50016	445	192.168.2.8	119.38.196.1
Jan 14, 2025 22:43:19.105657101 CET	445	50016	119.38.196.1	192.168.2.8
Jan 14, 2025 22:43:19.105717897 CET	445	50016	119.38.196.1	192.168.2.8
Jan 14, 2025 22:43:19.165419102 CET	50065	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.170238972 CET	445	50065	119.38.196.2	192.168.2.8
Jan 14, 2025 22:43:19.170322895 CET	50065	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.170361042 CET	50065	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.170809031 CET	50066	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.175359011 CET	445	50065	119.38.196.2	192.168.2.8
Jan 14, 2025 22:43:19.175415039 CET	50065	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.175582886 CET	445	50066	119.38.196.2	192.168.2.8
Jan 14, 2025 22:43:19.175645113 CET	50066	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.175668955 CET	50066	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:19.180423021 CET	445	50066	119.38.196.2	192.168.2.8
Jan 14, 2025 22:43:19.509430885 CET	50067	445	192.168.2.8	27.219.109.201
Jan 14, 2025 22:43:19.514378071 CET	445	50067	27.219.109.201	192.168.2.8
Jan 14, 2025 22:43:19.514523029 CET	50067	445	192.168.2.8	27.219.109.201
Jan 14, 2025 22:43:19.514636993 CET	50067	445	192.168.2.8	27.219.109.201
Jan 14, 2025 22:43:19.514878988 CET	50068	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.519471884 CET	445	50067	27.219.109.201	192.168.2.8
Jan 14, 2025 22:43:19.519562006 CET	50067	445	192.168.2.8	27.219.109.201
Jan 14, 2025 22:43:19.519619942 CET	445	50068	27.219.109.1	192.168.2.8
Jan 14, 2025 22:43:19.519741058 CET	50068	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.520107031 CET	50069	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.520153999 CET	50068	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.524885893 CET	445	50069	27.219.109.1	192.168.2.8
Jan 14, 2025 22:43:19.524933100 CET	445	50068	27.219.109.1	192.168.2.8
Jan 14, 2025 22:43:19.524955988 CET	50069	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.524997950 CET	50068	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.525016069 CET	50069	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:19.529742002 CET	445	50069	27.219.109.1	192.168.2.8
Jan 14, 2025 22:43:19.885798931 CET	50071	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:19.890726089 CET	445	50071	78.135.150.1	192.168.2.8
Jan 14, 2025 22:43:19.890825033 CET	50071	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:19.952756882 CET	50071	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:19.957748890 CET	445	50071	78.135.150.1	192.168.2.8
Jan 14, 2025 22:43:20.587611914 CET	50072	445	192.168.2.8	200.251.213.139
Jan 14, 2025 22:43:20.592597008 CET	445	50072	200.251.213.139	192.168.2.8
Jan 14, 2025 22:43:20.592722893 CET	50072	445	192.168.2.8	200.251.213.139
Jan 14, 2025 22:43:20.592775106 CET	50072	445	192.168.2.8	200.251.213.139
Jan 14, 2025 22:43:20.593003988 CET	50073	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.597871065 CET	445	50073	200.251.213.1	192.168.2.8
Jan 14, 2025 22:43:20.597943068 CET	50073	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.597965002 CET	50073	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.598095894 CET	445	50072	200.251.213.139	192.168.2.8
Jan 14, 2025 22:43:20.598156929 CET	50072	445	192.168.2.8	200.251.213.139
Jan 14, 2025 22:43:20.598216057 CET	50074	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.603032112 CET	445	50074	200.251.213.1	192.168.2.8
Jan 14, 2025 22:43:20.603092909 CET	50074	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.603123903 CET	50074	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.603343964 CET	445	50073	200.251.213.1	192.168.2.8
Jan 14, 2025 22:43:20.603396893 CET	50073	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:20.607940912 CET	445	50074	200.251.213.1	192.168.2.8
Jan 14, 2025 22:43:20.903846025 CET	445	50021	129.31.49.1	192.168.2.8
Jan 14, 2025 22:43:20.903934002 CET	50021	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:20.903934002 CET	50021	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:20.904002905 CET	50021	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:20.908787012 CET	445	50021	129.31.49.1	192.168.2.8
Jan 14, 2025 22:43:20.908797979 CET	445	50021	129.31.49.1	192.168.2.8
Jan 14, 2025 22:43:21.055855036 CET	445	50022	63.85.204.1	192.168.2.8
Jan 14, 2025 22:43:21.055912018 CET	50022	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:43:21.055994987 CET	50022	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:43:21.056129932 CET	50022	445	192.168.2.8	63.85.204.1
Jan 14, 2025 22:43:21.060936928 CET	445	50022	63.85.204.1	192.168.2.8
Jan 14, 2025 22:43:21.061266899 CET	445	50022	63.85.204.1	192.168.2.8
Jan 14, 2025 22:43:21.118716002 CET	50075	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.123610020 CET	445	50075	63.85.204.2	192.168.2.8
Jan 14, 2025 22:43:21.126759052 CET	50075	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.126796961 CET	50075	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.127161026 CET	50076	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.131772041 CET	445	50075	63.85.204.2	192.168.2.8
Jan 14, 2025 22:43:21.132044077 CET	445	50076	63.85.204.2	192.168.2.8
Jan 14, 2025 22:43:21.132102013 CET	50075	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.132143021 CET	50076	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.132258892 CET	50076	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:21.136981964 CET	445	50076	63.85.204.2	192.168.2.8
Jan 14, 2025 22:43:21.603666067 CET	50077	445	192.168.2.8	207.219.89.51
Jan 14, 2025 22:43:21.608525991 CET	445	50077	207.219.89.51	192.168.2.8
Jan 14, 2025 22:43:21.608639002 CET	50077	445	192.168.2.8	207.219.89.51
Jan 14, 2025 22:43:21.608639002 CET	50077	445	192.168.2.8	207.219.89.51
Jan 14, 2025 22:43:21.608750105 CET	50078	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.613532066 CET	445	50078	207.219.89.1	192.168.2.8
Jan 14, 2025 22:43:21.613609076 CET	50078	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.613677979 CET	445	50077	207.219.89.51	192.168.2.8
Jan 14, 2025 22:43:21.613702059 CET	50078	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.613883972 CET	50077	445	192.168.2.8	207.219.89.51
Jan 14, 2025 22:43:21.613929033 CET	50079	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.618750095 CET	445	50078	207.219.89.1	192.168.2.8
Jan 14, 2025 22:43:21.618762970 CET	445	50079	207.219.89.1	192.168.2.8
Jan 14, 2025 22:43:21.618808031 CET	50078	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.618837118 CET	50079	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.618865967 CET	50079	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:21.623627901 CET	445	50079	207.219.89.1	192.168.2.8
Jan 14, 2025 22:43:21.852842093 CET	50080	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:21.857683897 CET	445	50080	63.102.247.1	192.168.2.8
Jan 14, 2025 22:43:21.860563040 CET	50080	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:21.860594988 CET	50080	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:21.865351915 CET	445	50080	63.102.247.1	192.168.2.8
Jan 14, 2025 22:43:22.540555954 CET	50081	445	192.168.2.8	150.245.56.123
Jan 14, 2025 22:43:22.545383930 CET	445	50081	150.245.56.123	192.168.2.8
Jan 14, 2025 22:43:22.545504093 CET	50081	445	192.168.2.8	150.245.56.123
Jan 14, 2025 22:43:22.545541048 CET	50081	445	192.168.2.8	150.245.56.123
Jan 14, 2025 22:43:22.545698881 CET	50082	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.550400972 CET	445	50081	150.245.56.123	192.168.2.8
Jan 14, 2025 22:43:22.550534964 CET	445	50082	150.245.56.1	192.168.2.8
Jan 14, 2025 22:43:22.550719023 CET	50082	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.550745010 CET	50082	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.551114082 CET	50083	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.556463003 CET	445	50083	150.245.56.1	192.168.2.8
Jan 14, 2025 22:43:22.556581020 CET	50083	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.556581020 CET	50083	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.558765888 CET	445	50082	150.245.56.1	192.168.2.8
Jan 14, 2025 22:43:22.561563969 CET	445	50083	150.245.56.1	192.168.2.8
Jan 14, 2025 22:43:22.567682028 CET	445	50081	150.245.56.123	192.168.2.8
Jan 14, 2025 22:43:22.567806005 CET	50081	445	192.168.2.8	150.245.56.123
Jan 14, 2025 22:43:22.567975998 CET	445	50082	150.245.56.1	192.168.2.8
Jan 14, 2025 22:43:22.568025112 CET	50082	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:22.882258892 CET	445	50025	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:22.882390976 CET	50025	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:22.894073963 CET	50025	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:22.894128084 CET	50025	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:22.899141073 CET	445	50025	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:22.899158955 CET	445	50025	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:23.210807085 CET	445	50026	83.249.153.1	192.168.2.8
Jan 14, 2025 22:43:23.210911036 CET	50026	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:43:23.210982084 CET	50026	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:43:23.211049080 CET	50026	445	192.168.2.8	83.249.153.1
Jan 14, 2025 22:43:23.215807915 CET	445	50026	83.249.153.1	192.168.2.8
Jan 14, 2025 22:43:23.215847969 CET	445	50026	83.249.153.1	192.168.2.8
Jan 14, 2025 22:43:23.274826050 CET	50084	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.279763937 CET	445	50084	83.249.153.2	192.168.2.8
Jan 14, 2025 22:43:23.279874086 CET	50084	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.279961109 CET	50084	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.280291080 CET	50085	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.284852028 CET	445	50084	83.249.153.2	192.168.2.8
Jan 14, 2025 22:43:23.284914017 CET	50084	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.285135984 CET	445	50085	83.249.153.2	192.168.2.8
Jan 14, 2025 22:43:23.285201073 CET	50085	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.285240889 CET	50085	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:23.290044069 CET	445	50085	83.249.153.2	192.168.2.8
Jan 14, 2025 22:43:23.416024923 CET	50086	445	192.168.2.8	221.5.28.201
Jan 14, 2025 22:43:23.420882940 CET	445	50086	221.5.28.201	192.168.2.8
Jan 14, 2025 22:43:23.420957088 CET	50086	445	192.168.2.8	221.5.28.201
Jan 14, 2025 22:43:23.424184084 CET	50086	445	192.168.2.8	221.5.28.201
Jan 14, 2025 22:43:23.424565077 CET	50087	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.429425001 CET	445	50086	221.5.28.201	192.168.2.8
Jan 14, 2025 22:43:23.429475069 CET	50086	445	192.168.2.8	221.5.28.201
Jan 14, 2025 22:43:23.429737091 CET	445	50087	221.5.28.1	192.168.2.8
Jan 14, 2025 22:43:23.429785967 CET	50087	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.432369947 CET	50087	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.437256098 CET	445	50087	221.5.28.1	192.168.2.8
Jan 14, 2025 22:43:23.437333107 CET	50087	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.440220118 CET	50088	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.445069075 CET	445	50088	221.5.28.1	192.168.2.8
Jan 14, 2025 22:43:23.445139885 CET	50088	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.445347071 CET	50088	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:23.450134993 CET	445	50088	221.5.28.1	192.168.2.8
Jan 14, 2025 22:43:23.915503025 CET	50089	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:23.920332909 CET	445	50089	129.31.49.1	192.168.2.8
Jan 14, 2025 22:43:23.920428038 CET	50089	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:23.920473099 CET	50089	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:23.925302982 CET	445	50089	129.31.49.1	192.168.2.8
Jan 14, 2025 22:43:24.243832111 CET	50090	445	192.168.2.8	56.59.202.209
Jan 14, 2025 22:43:24.248653889 CET	445	50090	56.59.202.209	192.168.2.8
Jan 14, 2025 22:43:24.248724937 CET	50090	445	192.168.2.8	56.59.202.209
Jan 14, 2025 22:43:24.248749018 CET	50090	445	192.168.2.8	56.59.202.209
Jan 14, 2025 22:43:24.248867035 CET	50091	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.253608942 CET	445	50091	56.59.202.1	192.168.2.8
Jan 14, 2025 22:43:24.253659964 CET	50091	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.253684998 CET	50091	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.254004002 CET	445	50090	56.59.202.209	192.168.2.8
Jan 14, 2025 22:43:24.254013062 CET	50092	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.254045010 CET	50090	445	192.168.2.8	56.59.202.209
Jan 14, 2025 22:43:24.259433031 CET	445	50091	56.59.202.1	192.168.2.8
Jan 14, 2025 22:43:24.259443998 CET	445	50092	56.59.202.1	192.168.2.8
Jan 14, 2025 22:43:24.259486914 CET	50091	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.259512901 CET	50092	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.259546041 CET	50092	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:24.264401913 CET	445	50092	56.59.202.1	192.168.2.8
Jan 14, 2025 22:43:24.946541071 CET	445	50029	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:24.946605921 CET	50029	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:24.946659088 CET	50029	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:24.946707964 CET	50029	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:24.951438904 CET	445	50029	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:24.951450109 CET	445	50029	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:25.009316921 CET	50093	445	192.168.2.8	124.35.234.12
Jan 14, 2025 22:43:25.014229059 CET	445	50093	124.35.234.12	192.168.2.8
Jan 14, 2025 22:43:25.014297962 CET	50093	445	192.168.2.8	124.35.234.12
Jan 14, 2025 22:43:25.014321089 CET	50093	445	192.168.2.8	124.35.234.12
Jan 14, 2025 22:43:25.014476061 CET	50094	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.019243956 CET	445	50094	124.35.234.1	192.168.2.8
Jan 14, 2025 22:43:25.019295931 CET	50094	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.019320011 CET	50094	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.019335032 CET	445	50093	124.35.234.12	192.168.2.8
Jan 14, 2025 22:43:25.019375086 CET	50093	445	192.168.2.8	124.35.234.12
Jan 14, 2025 22:43:25.019579887 CET	50095	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.024257898 CET	445	50094	124.35.234.1	192.168.2.8
Jan 14, 2025 22:43:25.024298906 CET	50094	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.024338007 CET	445	50095	124.35.234.1	192.168.2.8
Jan 14, 2025 22:43:25.024400949 CET	50095	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.024507046 CET	50095	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:25.029205084 CET	445	50095	124.35.234.1	192.168.2.8
Jan 14, 2025 22:43:25.100310087 CET	445	50030	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:25.100413084 CET	50030	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:25.100467920 CET	50030	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:25.100542068 CET	50030	445	192.168.2.8	27.108.78.1
Jan 14, 2025 22:43:25.105437040 CET	445	50030	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:25.105448008 CET	445	50030	27.108.78.1	192.168.2.8
Jan 14, 2025 22:43:25.165306091 CET	50096	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.170125961 CET	445	50096	27.108.78.2	192.168.2.8
Jan 14, 2025 22:43:25.170195103 CET	50096	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.170234919 CET	50096	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.170555115 CET	50097	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.175180912 CET	445	50096	27.108.78.2	192.168.2.8
Jan 14, 2025 22:43:25.175220013 CET	50096	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.175302029 CET	445	50097	27.108.78.2	192.168.2.8
Jan 14, 2025 22:43:25.175396919 CET	50097	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.175424099 CET	50097	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:25.180182934 CET	445	50097	27.108.78.2	192.168.2.8
Jan 14, 2025 22:43:25.917793036 CET	50099	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:25.922763109 CET	445	50099	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:25.922857046 CET	50099	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:25.923300028 CET	50099	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:25.928128958 CET	445	50099	25.106.82.1	192.168.2.8
Jan 14, 2025 22:43:26.929466963 CET	445	50033	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:26.929649115 CET	50033	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:26.929649115 CET	50033	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:26.929717064 CET	50033	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:26.934536934 CET	445	50033	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:26.934568882 CET	445	50033	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:27.179795027 CET	445	50034	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:27.179997921 CET	50034	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:27.179997921 CET	50034	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:27.180085897 CET	50034	445	192.168.2.8	121.134.74.1
Jan 14, 2025 22:43:27.184812069 CET	445	50034	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:27.184859037 CET	445	50034	121.134.74.1	192.168.2.8
Jan 14, 2025 22:43:27.246285915 CET	50103	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.251231909 CET	445	50103	121.134.74.2	192.168.2.8
Jan 14, 2025 22:43:27.251332045 CET	50103	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.251389027 CET	50103	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.251699924 CET	50104	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.256308079 CET	445	50103	121.134.74.2	192.168.2.8
Jan 14, 2025 22:43:27.256428003 CET	50103	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.256500959 CET	445	50104	121.134.74.2	192.168.2.8
Jan 14, 2025 22:43:27.256557941 CET	50104	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.256580114 CET	50104	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:27.261354923 CET	445	50104	121.134.74.2	192.168.2.8
Jan 14, 2025 22:43:27.962464094 CET	50107	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:27.967298031 CET	445	50107	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:27.967466116 CET	50107	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:27.967480898 CET	50107	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:27.972260952 CET	445	50107	157.193.184.1	192.168.2.8
Jan 14, 2025 22:43:28.950887918 CET	445	50037	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:28.951020002 CET	50037	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:28.951286077 CET	50037	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:28.951399088 CET	50037	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:28.956737041 CET	445	50037	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:28.956753016 CET	445	50037	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:29.132338047 CET	445	50038	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:29.132512093 CET	50038	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:29.132512093 CET	50038	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:29.132882118 CET	50038	445	192.168.2.8	39.85.39.1
Jan 14, 2025 22:43:29.137398958 CET	445	50038	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:29.137681007 CET	445	50038	39.85.39.1	192.168.2.8
Jan 14, 2025 22:43:29.199228048 CET	50116	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.204109907 CET	445	50116	39.85.39.2	192.168.2.8
Jan 14, 2025 22:43:29.204205990 CET	50116	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.204288960 CET	50116	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.205877066 CET	50117	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.209146023 CET	445	50116	39.85.39.2	192.168.2.8
Jan 14, 2025 22:43:29.209207058 CET	50116	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.210680008 CET	445	50117	39.85.39.2	192.168.2.8
Jan 14, 2025 22:43:29.210757971 CET	50117	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.210823059 CET	50117	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:29.215576887 CET	445	50117	39.85.39.2	192.168.2.8
Jan 14, 2025 22:43:29.930965900 CET	50124	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:29.935798883 CET	445	50124	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:29.935957909 CET	50124	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:29.936114073 CET	50124	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:29.940907001 CET	445	50124	223.39.125.1	192.168.2.8
Jan 14, 2025 22:43:30.836163998 CET	445	50041	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:30.837260008 CET	50041	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:30.837296009 CET	50041	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:30.837317944 CET	50041	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:30.842070103 CET	445	50041	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:30.842123032 CET	445	50041	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:31.149635077 CET	445	50042	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:31.149736881 CET	50042	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:31.149771929 CET	50042	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:31.149827003 CET	50042	445	192.168.2.8	209.76.99.1
Jan 14, 2025 22:43:31.154689074 CET	445	50042	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:31.154705048 CET	445	50042	209.76.99.1	192.168.2.8
Jan 14, 2025 22:43:31.212253094 CET	50138	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.217150927 CET	445	50138	209.76.99.2	192.168.2.8
Jan 14, 2025 22:43:31.217252016 CET	50138	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.217345953 CET	50138	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.217725992 CET	50139	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.222332001 CET	445	50138	209.76.99.2	192.168.2.8
Jan 14, 2025 22:43:31.222404957 CET	50138	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.222568989 CET	445	50139	209.76.99.2	192.168.2.8
Jan 14, 2025 22:43:31.222626925 CET	50139	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.222685099 CET	50139	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:31.227449894 CET	445	50139	209.76.99.2	192.168.2.8
Jan 14, 2025 22:43:31.962857008 CET	50149	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:31.967767954 CET	445	50149	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:31.967932940 CET	50149	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:31.967932940 CET	50149	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:31.972724915 CET	445	50149	152.201.76.1	192.168.2.8
Jan 14, 2025 22:43:32.585344076 CET	445	50045	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:32.585463047 CET	50045	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:32.585514069 CET	50045	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:32.585571051 CET	50045	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:32.590296030 CET	445	50045	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:32.590318918 CET	445	50045	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:33.196819067 CET	445	50046	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:33.196909904 CET	50046	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:33.196949959 CET	50046	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:33.197031975 CET	50046	445	192.168.2.8	6.99.0.1
Jan 14, 2025 22:43:33.201797009 CET	445	50046	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:33.201811075 CET	445	50046	6.99.0.1	192.168.2.8
Jan 14, 2025 22:43:33.259114981 CET	50175	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.263892889 CET	445	50175	6.99.0.2	192.168.2.8
Jan 14, 2025 22:43:33.263953924 CET	50175	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.263983011 CET	50175	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.264303923 CET	50176	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.268990040 CET	445	50175	6.99.0.2	192.168.2.8
Jan 14, 2025 22:43:33.269051075 CET	50175	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.269228935 CET	445	50176	6.99.0.2	192.168.2.8
Jan 14, 2025 22:43:33.269284010 CET	50176	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.269328117 CET	50176	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:33.274151087 CET	445	50176	6.99.0.2	192.168.2.8
Jan 14, 2025 22:43:33.853652000 CET	50190	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:33.859138012 CET	445	50190	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:33.859273911 CET	50190	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:33.861896038 CET	50190	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:33.867568016 CET	445	50190	71.121.162.1	192.168.2.8
Jan 14, 2025 22:43:34.214068890 CET	445	50049	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:34.214133978 CET	50049	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:34.214174986 CET	50049	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:34.214212894 CET	50049	445	192.168.2.8	90.207.146.1
Jan 14, 2025 22:43:34.219007015 CET	445	50049	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:34.219016075 CET	445	50049	90.207.146.1	192.168.2.8
Jan 14, 2025 22:43:35.163651943 CET	445	50050	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:35.164601088 CET	50050	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:35.164640903 CET	50050	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:35.164691925 CET	50050	445	192.168.2.8	169.120.240.1
Jan 14, 2025 22:43:35.169518948 CET	445	50050	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:35.169553995 CET	445	50050	169.120.240.1	192.168.2.8
Jan 14, 2025 22:43:35.235527039 CET	50241	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.241796970 CET	445	50241	169.120.240.2	192.168.2.8
Jan 14, 2025 22:43:35.242800951 CET	50241	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.243016958 CET	50241	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.243428946 CET	50243	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.248847008 CET	445	50241	169.120.240.2	192.168.2.8
Jan 14, 2025 22:43:35.249519110 CET	445	50243	169.120.240.2	192.168.2.8
Jan 14, 2025 22:43:35.249703884 CET	50241	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.249747038 CET	50243	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.249813080 CET	50243	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:35.255364895 CET	445	50243	169.120.240.2	192.168.2.8
Jan 14, 2025 22:43:35.587088108 CET	50258	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:35.592047930 CET	445	50258	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:35.592178106 CET	50258	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:35.592195034 CET	50258	445	192.168.2.8	57.79.44.1
Jan 14, 2025 22:43:35.596952915 CET	445	50258	57.79.44.1	192.168.2.8
Jan 14, 2025 22:43:35.756743908 CET	445	50053	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:35.756820917 CET	50053	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:35.756890059 CET	50053	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:35.756928921 CET	50053	445	192.168.2.8	197.208.96.1
Jan 14, 2025 22:43:35.761697054 CET	445	50053	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:35.761708021 CET	445	50053	197.208.96.1	192.168.2.8
Jan 14, 2025 22:43:37.148189068 CET	445	50054	60.253.184.1	192.168.2.8
Jan 14, 2025 22:43:37.148241997 CET	50054	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:37.148653984 CET	445	50057	142.195.63.1	192.168.2.8
Jan 14, 2025 22:43:37.148694992 CET	50057	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:38.478559017 CET	445	50060	109.225.95.1	192.168.2.8
Jan 14, 2025 22:43:38.478612900 CET	50060	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:38.556391001 CET	50066	445	192.168.2.8	119.38.196.2
Jan 14, 2025 22:43:38.556435108 CET	50085	445	192.168.2.8	83.249.153.2
Jan 14, 2025 22:43:38.556458950 CET	50076	445	192.168.2.8	63.85.204.2
Jan 14, 2025 22:43:38.556498051 CET	50104	445	192.168.2.8	121.134.74.2
Jan 14, 2025 22:43:38.556571007 CET	50149	445	192.168.2.8	152.201.76.1
Jan 14, 2025 22:43:38.556610107 CET	50139	445	192.168.2.8	209.76.99.2
Jan 14, 2025 22:43:38.556684017 CET	50117	445	192.168.2.8	39.85.39.2
Jan 14, 2025 22:43:38.556684017 CET	50097	445	192.168.2.8	27.108.78.2
Jan 14, 2025 22:43:38.556708097 CET	50054	445	192.168.2.8	60.253.184.1
Jan 14, 2025 22:43:38.556727886 CET	50057	445	192.168.2.8	142.195.63.1
Jan 14, 2025 22:43:38.556747913 CET	50060	445	192.168.2.8	109.225.95.1
Jan 14, 2025 22:43:38.556781054 CET	50061	445	192.168.2.8	128.38.222.1
Jan 14, 2025 22:43:38.556806087 CET	50064	445	192.168.2.8	158.206.214.1
Jan 14, 2025 22:43:38.556838036 CET	50069	445	192.168.2.8	27.219.109.1
Jan 14, 2025 22:43:38.556874037 CET	50071	445	192.168.2.8	78.135.150.1
Jan 14, 2025 22:43:38.556915998 CET	50079	445	192.168.2.8	207.219.89.1
Jan 14, 2025 22:43:38.556919098 CET	50074	445	192.168.2.8	200.251.213.1
Jan 14, 2025 22:43:38.556952953 CET	50080	445	192.168.2.8	63.102.247.1
Jan 14, 2025 22:43:38.556961060 CET	50083	445	192.168.2.8	150.245.56.1
Jan 14, 2025 22:43:38.556983948 CET	50088	445	192.168.2.8	221.5.28.1
Jan 14, 2025 22:43:38.557013988 CET	50089	445	192.168.2.8	129.31.49.1
Jan 14, 2025 22:43:38.557039976 CET	50092	445	192.168.2.8	56.59.202.1
Jan 14, 2025 22:43:38.557069063 CET	50095	445	192.168.2.8	124.35.234.1
Jan 14, 2025 22:43:38.557086945 CET	50099	445	192.168.2.8	25.106.82.1
Jan 14, 2025 22:43:38.557118893 CET	50107	445	192.168.2.8	157.193.184.1
Jan 14, 2025 22:43:38.557146072 CET	50124	445	192.168.2.8	223.39.125.1
Jan 14, 2025 22:43:38.557183981 CET	50190	445	192.168.2.8	71.121.162.1
Jan 14, 2025 22:43:38.557200909 CET	50176	445	192.168.2.8	6.99.0.2
Jan 14, 2025 22:43:38.557370901 CET	50243	445	192.168.2.8	169.120.240.2
Jan 14, 2025 22:43:38.557478905 CET	50258	445	192.168.2.8	57.79.44.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 22:42:29.157188892 CET	49256	53	192.168.2.8	1.1.1.1
Jan 14, 2025 22:42:29.463646889 CET	53	49256	1.1.1.1	192.168.2.8
Jan 14, 2025 22:42:30.199434042 CET	54332	53	192.168.2.8	1.1.1.1
Jan 14, 2025 22:42:30.380831957 CET	53	54332	1.1.1.1	192.168.2.8
Jan 14, 2025 22:43:01.187864065 CET	138	138	192.168.2.8	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 22:42:29.157188892 CET	192.168.2.8	1.1.1.1	0x897a	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Jan 14, 2025 22:42:30.199434042 CET	192.168.2.8	1.1.1.1	0x76a6	Standard query (0)	ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 22:42:29.463646889 CET	1.1.1.1	192.168.2.8	0x897a	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com		103.224.212.215	A (IP address)	IN (0x0001)	false
Jan 14, 2025 22:42:30.380831957 CET	1.1.1.1	192.168.2.8	0x76a6	No error (0)	ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	77026.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 22:42:30.380831957 CET	1.1.1.1	192.168.2.8	0x76a6	No error (0)	77026.bodis.com		199.59.243.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	103.224.212.215	80	5944	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 22:42:29.477104902 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 14, 2025 22:42:30.076818943 CET	365	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 21:42:30 GMT server: Apache set-cookie: __tad=1736890950.7011300; expires=Fri, 12-Jan-2035 21:42:30 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3096-a478-d7c464a3f0ca content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	199.59.243.228	80	5944	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 22:42:30.387044907 CET	169	OUT	GET /?subid1=20250115-0842-3096-a478-d7c464a3f0ca HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Jan 14, 2025 22:42:30.843998909 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 21:42:30 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: 215a8bf8-0e2d-4579-a9e0-ffb15187690d cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_K3y7p1ab8I+98kmYRIbWeLuzRY8iEMJ6IGUKN8ufGTs4Kv2r/0clZperG8XTr4m8ifXGlZMyl5d7DnDO0Vyrew== set-cookie: parking_session=215a8bf8-0e2d-4579-a9e0-ffb15187690d; expires=Tue, 14 Jan 2025 21:57:30 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4b 33 79 37 70 31 61 62 38 49 2b 39 38 6b 6d 59 52 49 62 57 65 4c 75 7a 52 59 38 69 45 4d 4a 36 49 47 55 4b 4e 38 75 66 47 54 73 34 4b 76 32 72 2f 30 63 6c 5a 70 65 72 47 38 58 54 72 34 6d 38 69 66 58 47 6c 5a 4d 79 6c 35 64 37 44 6e 44 4f 30 56 79 72 65 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_K3y7p1ab8I+98kmYRIbWeLuzRY8iEMJ6IGUKN8ufGTs4Kv2r/0clZperG8XTr4m8ifXGlZMyl5d7DnDO0Vyrew==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Jan 14, 2025 22:42:30.844014883 CET	696	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjE1YThiZjgtMGUyZC00NTc5LWE5ZTAtZmZiMTUxODc2OTBkIiwicGFnZV90aW1lIjoxNzM2ODkwOTUwLCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	103.224.212.215	80	6552	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 22:42:32.108426094 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 14, 2025 22:42:32.744865894 CET	365	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 21:42:32 GMT server: Apache set-cookie: __tad=1736890952.3577693; expires=Fri, 12-Jan-2035 21:42:32 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-3207-bd07-6551d635081d content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	103.224.212.215	80	6720	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 22:42:32.109003067 CET	134	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache Cookie: __tad=1736890950.7011300
Jan 14, 2025 22:42:32.733532906 CET	269	IN	HTTP/1.1 302 Found date: Tue, 14 Jan 2025 21:42:32 GMT server: Apache location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250115-0842-32cc-b361-86c8884a5eaf content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49711	199.59.243.228	80	6720	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 22:42:32.743974924 CET	231	OUT	GET /?subid1=20250115-0842-32cc-b361-86c8884a5eaf HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive Cookie: parking_session=215a8bf8-0e2d-4579-a9e0-ffb15187690d
Jan 14, 2025 22:42:33.219224930 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 21:42:32 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: 5daf90bf-4299-4e7e-9d5e-e1b15daf8828 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jmdmAvMt5r0bNYldCB/oebECAkGLoYQlpTX7KFxHupNuseYKwakVD5oAqLao6OOi5RkqKsmmt+MLV1MAqOgWpA== set-cookie: parking_session=215a8bf8-0e2d-4579-a9e0-ffb15187690d; expires=Tue, 14 Jan 2025 21:57:33 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6a 6d 64 6d 41 76 4d 74 35 72 30 62 4e 59 6c 64 43 42 2f 6f 65 62 45 43 41 6b 47 4c 6f 59 51 6c 70 54 58 37 4b 46 78 48 75 70 4e 75 73 65 59 4b 77 61 6b 56 44 35 6f 41 71 4c 61 6f 36 4f 4f 69 35 52 6b 71 4b 73 6d 6d 74 2b 4d 4c 56 31 4d 41 71 4f 67 57 70 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jmdmAvMt5r0bNYldCB/oebECAkGLoYQlpTX7KFxHupNuseYKwakVD5oAqLao6OOi5RkqKsmmt+MLV1MAqOgWpA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Jan 14, 2025 22:42:33.219248056 CET	688	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjE1YThiZjgtMGUyZC00NTc5LWE5ZTAtZmZiMTUxODc2OTBkIiwicGFnZV90aW1lIjoxNzM2ODkwOTUzLCJwYWdlX3VybCI6Imh0dHA6L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49712	199.59.243.228	80	6552	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 22:42:32.753730059 CET	169	OUT	GET /?subid1=20250115-0842-3207-bd07-6551d635081d HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Jan 14, 2025 22:42:33.227669001 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 14 Jan 2025 21:42:32 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: 0efd4eba-f1fe-43cd-b341-8950f1c2846c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JDoOSsl0Nm7PqpZNOv/MvpkKi45P8YYFUxqfijWWma1bYVgb2w8TaB+3EYIlQV/egIdcIOBwpr03f8DuN3P3hg== set-cookie: parking_session=0efd4eba-f1fe-43cd-b341-8950f1c2846c; expires=Tue, 14 Jan 2025 21:57:33 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 44 6f 4f 53 73 6c 30 4e 6d 37 50 71 70 5a 4e 4f 76 2f 4d 76 70 6b 4b 69 34 35 50 38 59 59 46 55 78 71 66 69 6a 57 57 6d 61 31 62 59 56 67 62 32 77 38 54 61 42 2b 33 45 59 49 6c 51 56 2f 65 67 49 64 63 49 4f 42 77 70 72 30 33 66 38 44 75 4e 33 50 33 68 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JDoOSsl0Nm7PqpZNOv/MvpkKi45P8YYFUxqfijWWma1bYVgb2w8TaB+3EYIlQV/egIdcIOBwpr03f8DuN3P3hg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Jan 14, 2025 22:42:33.227699041 CET	696	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGVmZDRlYmEtZjFmZS00M2NkLWIzNDEtODk1MGYxYzI4NDZjIiwicGFnZV90aW1lIjoxNzM2ODkwOTUzLCJwYWdlX3VybCI6I

Target ID:	0
Start time:	16:42:27
Start date:	14/01/2025
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll"
Imagebase:	0x3e0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:42:27
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:42:27
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:42:27
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\ruXU7wj3X9.dll,PlayGame
Imagebase:	0x2c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:42:27
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",#1
Imagebase:	0x2c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:42:27
Start date:	14/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	B15FB425B628062A7BB0F11DBAECF4AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.1534389465.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.1534540990.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvr.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvr.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvr.exe, Author: us-cert code analysis team
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:42:30
Start date:	14/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	B15FB425B628062A7BB0F11DBAECF4AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.1560048220.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000000.1560193255.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.2225953882.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.2226237017.0000000002282000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:42:30
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\ruXU7wj3X9.dll",PlayGame
Imagebase:	0x2c0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:42:30
Start date:	14/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	B15FB425B628062A7BB0F11DBAECF4AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.1584683802.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000000.1562813019.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000000.1562935692.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.1584859851.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:42:32
Start date:	14/01/2025
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	2'061'938 bytes
MD5 hash:	41C0E22D28973F312DE789C027E61D0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000000.1584094306.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
Antivirus matches:	Detection: 100%, Avira
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:42:32
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:42:32
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3456 -ip 3456
Imagebase:	0x7b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:42:32
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 604
Imagebase:	0x7b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:42:33
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	65.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F8D0EF0,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00407E61
CloseHandle.KERNEL32(00000000), ref: 00407E68
CreateProcessA.KERNEL32 ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

C:\%s\%s, xrefs: 00407DFB
tasksche.exe, xrefs: 00407DEA
CreateProcessA, xrefs: 00407D07
/i, xrefs: 00407E8D
kernel32.dll, xrefs: 00407CEA
WriteFile, xrefs: 00407D1C
C:\%s\qeriuwjhrf, xrefs: 00407E12
WINDOWS, xrefs: 00407DF2, 00407E0D
CloseHandle, xrefs: 00407D29
D, xrefs: 00407ED3
CreateFileA, xrefs: 00407D0F

Memory Dump Source

Source File: 00000006.00000002.1583682879.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1583670741.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583699901.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583748040.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressHandleProcResource$CloseFile$Createsprintf$FindLoadLockModuleMoveProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4281112323-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000006.00000002.1583682879.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1583670741.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583699901.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583748040.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000006.00000002.1583682879.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1583670741.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583699901.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583748040.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F8D0EF0,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

Microsoft Security Center (2.1) Service, xrefs: 00407C90
%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95

Memory Dump Source

Source File: 00000006.00000002.1583682879.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1583670741.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583699901.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583748040.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F8D0EF0,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000006.00000002.1583682879.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1583670741.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583699901.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583712259.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583748040.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1583843452.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Analysis Process: mssecsvr.exePID: 6552, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	34.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F8D0EF0,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000008.00000002.2222819230.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2222722451.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2222846933.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223377103.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223636351.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000008.00000002.2222819230.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2222722451.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2222846933.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223377103.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223636351.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F8D0EF0,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

Microsoft Security Center (2.1) Service, xrefs: 00407C90
mssecsvc2.1, xrefs: 00407C95
%s -m security, xrefs: 00407C50

Memory Dump Source

Source File: 00000008.00000002.2222819230.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2222722451.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2222846933.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223377103.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223636351.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F8D0EF0,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C

Strings

CloseHandle, xrefs: 00407D29
C:\%s\qeriuwjhrf, xrefs: 00407E12
tasksche.exe, xrefs: 00407DEA
CreateFileA, xrefs: 00407D0F
CreateProcessA, xrefs: 00407D07
/i, xrefs: 00407E8D
kernel32.dll, xrefs: 00407CEA
WriteFile, xrefs: 00407D1C
C:\%s\%s, xrefs: 00407DFB
D, xrefs: 00407ED3
WINDOWS, xrefs: 00407DF2, 00407E0D

Memory Dump Source

Source File: 00000008.00000002.2222819230.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2222722451.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2222846933.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223377103.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223636351.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000008.00000002.2222819230.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2222722451.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2222846933.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223023575.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223330577.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223377103.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223636351.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000008.00000002.2223913366.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Analysis Process: tasksche.exePID: 3456, Parent PID: 6720COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	1183
Total number of Limit Nodes:	22

Executed Functions

Function 0041EDF7 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0041EE0C

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction ID: eb53d8fa6b9c670d76401f9b6e634384cdf5b6bc28e7f080834842f41bea832e
Opcode Fuzzy Hash: 6c78c704c61e396e770c5c9d5bf39bc32bfab303bf8d18d204e2a82309729daa
Instruction Fuzzy Hash: E6D05E366503485ADB106F716C09B763BDCD384396F104436BC1DC6150F775C5A09A48

Non-executed Functions

Function 0040690A Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 294
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040690F
_wcslen.LIBCMT ref: 00406978
_wcscpy.LIBCMT ref: 004069E4
_wcslen.LIBCMT ref: 004069F0

Part of subcall function 00406553: GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
Part of subcall function 00406553: OpenProcessToken.ADVAPI32(00000000), ref: 00406569
Part of subcall function 00406553: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
Part of subcall function 00406553: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
Part of subcall function 00406553: GetLastError.KERNEL32 ref: 004065A8
Part of subcall function 00406553: CloseHandle.KERNEL32(?), ref: 004065B7

Part of subcall function 0040935F: _wcsncpy.LIBCMT ref: 004093C6

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000001), ref: 00406A7B
CloseHandle.KERNEL32(00000000), ref: 00406A8C
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000001), ref: 00406A99
_wcscpy.LIBCMT ref: 00406AE5
_wcscpy.LIBCMT ref: 00406B09
_wcscpy.LIBCMT ref: 00406B55
_wcscpy.LIBCMT ref: 00406B7E
CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00406BA4
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00406BCF
CloseHandle.KERNEL32(00000000), ref: 00406BDA
GetLastError.KERNEL32 ref: 00406BEC
RemoveDirectoryW.KERNEL32(00000000), ref: 00406C21
DeleteFileW.KERNEL32(00000000), ref: 00406C29

Strings

UNC\, xrefs: 004069B5
SeCreateSymbolicLinkPrivilege, xrefs: 00406931
\??\, xrefs: 00406993
SeRestorePrivilege, xrefs: 00406927

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _wcscpy$CloseCreateFileHandle$DirectoryErrorLastProcessToken_wcslen$AdjustControlCurrentDeleteDeviceH_prologLookupOpenPrivilegePrivilegesRemoveValue_wcsncpy
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 295717069-3508440684
Opcode ID: 655c0a61d8b82d499dd3f58a43e7c4c4e2890c798905acfbacee841f114c5236
Instruction ID: 0b044a0677013c3ee0dedeb9ad72db73be6c8eb7e300feb6a7d55a674be6f19f
Opcode Fuzzy Hash: 655c0a61d8b82d499dd3f58a43e7c4c4e2890c798905acfbacee841f114c5236
Instruction Fuzzy Hash: 56B1B471A00215AFDF21EF64CC45BDA77B8EF04304F00446AF95AF7281D778AAA4CB69

Function 00402F2C Relevance: 9.3, APIs: 3, Strings: 2, Instructions: 544COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402F35
_memcmp.LIBCMT ref: 00402FFD
_memcmp.LIBCMT ref: 004032D7

Strings

CMT, xrefs: 0040355A
@, xrefs: 004034A4

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memcmp$H_prolog
String ID: @$CMT
API String ID: 212800410-3935043585
Opcode ID: 61c5d66ef6b3c3ec8c684f9c378d980735cbcf4a3664b2141919c77b1943b8bf
Instruction ID: 4535b6ba2d5654eb70152741eafeedd3820f65e0183003bc7b62017ff8f1088e
Opcode Fuzzy Hash: 61c5d66ef6b3c3ec8c684f9c378d980735cbcf4a3664b2141919c77b1943b8bf
Instruction Fuzzy Hash: 252215715006849FDB24DF24C891BDA3BE5AF14308F08057FED4AEB2C6DB799588CB69

Function 00406553 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?), ref: 00406562
OpenProcessToken.ADVAPI32(00000000), ref: 00406569
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00406589
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000000,00000000,00000000), ref: 0040659E
GetLastError.KERNEL32 ref: 004065A8
CloseHandle.KERNEL32(?), ref: 004065B7

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3398352648-0
Opcode ID: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction ID: 201d4201c496fcfd48e74424a9b99b2c6b7fcfb09556bcb8571a25bcb240e8ee
Opcode Fuzzy Hash: c4d8732f7f1e2046f43f8b45a71e1742e44d7c33346580acd03521233585be14
Instruction Fuzzy Hash: A0011DB1600209FFDB209FA4DC89EAF7BBCAB04344F401076B902E1255D775CE259A75

Function 00401CC1 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 769COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401CC6
_strlen.LIBCMT ref: 00402237

Part of subcall function 00411B3C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,00001FFF,?,?,004022BC,00000000,?,00000800,?,00001FFF,?), ref: 00411B58

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00402393

Strings

CMT, xrefs: 004023B6

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 7561139a40a2308f1242d88f2ee417ec418e5e9db844fe187d82227f014771d0
Instruction ID: 47e58a6222a9c82a3371e9f2a391d10810198bea5a194d1edf5ea2ede1dda2e7
Opcode Fuzzy Hash: 7561139a40a2308f1242d88f2ee417ec418e5e9db844fe187d82227f014771d0
Instruction Fuzzy Hash: 8B6201709006849FCF25DF64C8947EE7BB1AF14304F0844BEE986BB2D6DB795985CB28

Function 00409476 Relevance: 7.6, APIs: 5, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094A4
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 004094D4
GetLastError.KERNEL32(?,?,00000800,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 004094DE
FindNextFileW.KERNEL32(000000FF,?,00000800,?,?,?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000), ref: 00409508
GetLastError.KERNEL32(?,004096E5,000000FF,?,?,?,?,00408411,?,?,00000000,?,00000800), ref: 00409516

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: be36d6b55009a5335f7a155e3552942ef4af6ff6bde46a6133a67c12a447a1f9
Instruction ID: 852f22f8762d0aaf1b59ecd7198268998001e7cc0733578d9edc4610c3c70bd0
Opcode Fuzzy Hash: be36d6b55009a5335f7a155e3552942ef4af6ff6bde46a6133a67c12a447a1f9
Instruction Fuzzy Hash: 2E414071500648ABCB21DF29CC84ADA77F8AF48350F10466AF9AEE2291D774AEC1DB14

Function 0041E6DE Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00423F3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00423F53
UnhandledExceptionFilter.KERNEL32(0042BA78), ref: 00423F5E
GetCurrentProcess.KERNEL32(C0000409), ref: 00423F7A
TerminateProcess.KERNEL32(00000000), ref: 00423F81

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction ID: 77c401cdca4814435c65699ef26cb777055d8c499ed0f7a386f9586c05fd5705
Opcode Fuzzy Hash: 4de6ed279e9cf42e89259ac0ebda5d4927e8938d534c68d964197d147836f072
Instruction Fuzzy Hash: 6F21C0B8A10208DFE710DF25F8496597BA0FB1A315F90117BE90887271EBB5599ECF0E

Function 00411393 Relevance: 3.0, APIs: 2, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004113A0
SystemTimeToFileTime.KERNEL32(?,?), ref: 004113AE

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Time$System$File
String ID:
API String ID: 2838179519-0
Opcode ID: 8b41b73f9ed514a8c44b67b99f577e355d9a9caacecf0c2d81d78613dc21446f
Instruction ID: 009d3124f8f1828f67e1715082a9abbe2f578115a5d0f640413b949eddbc0e26
Opcode Fuzzy Hash: 8b41b73f9ed514a8c44b67b99f577e355d9a9caacecf0c2d81d78613dc21446f
Instruction Fuzzy Hash: 2DE0E67690021DAFCB10DF94D945CDEBBFCEB48214F400465DD82E3200EA30E655CB95

Function 00417D78 Relevance: 2.6, APIs: 1, Instructions: 1055COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00417DB5

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction ID: ca8e397051957a2ab45e24d4035287d6273771f133136d8253d7927585564b75
Opcode Fuzzy Hash: f2ddf0237e8c887b9397686041efde03e6b7465c6b8aca2acf299e0ee70c85ec
Instruction Fuzzy Hash: 5692D5709087859FCB29CF34C4D06E9BBF1AF55308F18C5AED8968B342D738A985CB59

Function 00414946 Relevance: 2.0, APIs: 1, Instructions: 478COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 00414A21

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _realloc
String ID:
API String ID: 1750794848-0
Opcode ID: 3f896a36bcdedd16947d6d0e695f173bb51ee08cdd737608f26534185599a9a2
Instruction ID: 2a1397d1efbb1e156a4ddc1088eaf27e515a490876f5f290c2ff2c2445328417
Opcode Fuzzy Hash: 3f896a36bcdedd16947d6d0e695f173bb51ee08cdd737608f26534185599a9a2
Instruction Fuzzy Hash: 0B02E5B1A106069BCB1DCF28C5916E9B7E1FF85304F24852ED556CBA85D338F9E1CB88

Function 00413EE3 Relevance: 1.8, APIs: 1, Instructions: 267COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00413F73

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction ID: 3562be7dcc5a33f83423fe2ddc28cf6e78eed116dec30ec79901489c8d2199a3
Opcode Fuzzy Hash: 9c54e9cdedc4d1f5f0a70ee5fbfd421263a38b40d6fcac4ed0c82430486a0b60
Instruction Fuzzy Hash: CBA11472A00208EBDB04DF65C581BED77B5AB94304F24447FE942EB282C77C9AC2DB59

Function 00419BB0 Relevance: 1.6, APIs: 1, Instructions: 89comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0042B1F8,00000000,00000001,0042B148,?), ref: 00419BC9

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction ID: e9337f94160ec10d5a134cda80235c1f61728acff05639409476ed3799cc72ed
Opcode Fuzzy Hash: 291608a549582a43ab036b31c95ed53b806bcf03129be81fab9f556b712dc9f9
Instruction Fuzzy Hash: FC311875A00209EFCF04CFA0C898DAA7BB9EF49304B204499F942DB250D739EE51DBA4

Function 004234CE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002348C), ref: 004234D3

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction ID: 1b01da781a1f42b14bf088c4285091799bc00e9a7c54fca4454c541a30810ab4
Opcode Fuzzy Hash: c83ebaee86b923b47ec218d74108a47e8bb0214f05dc8ef17ebda85afd4cada2
Instruction Fuzzy Hash: 539002603521104746112BB06C1D51565A17F48617BD104A5B401C5054DA598621551B

Function 00404986 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

gj, xrefs: 004049DD

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction ID: d9eb52a2d6ff44a43e3580116b86408f9a206631cbab7b39ea8bb55ae5343344
Opcode Fuzzy Hash: 8e8f698dc4288f7cd721a7a81a634b87765ee1de91585cf515aab87a68fe5fee
Instruction Fuzzy Hash: 81C126B2D002289BDF44CF9AD8405EEFBF2BFC8310F2AC1A6D81477615D6346A529F91

Function 0040FDFA Relevance: .9, Instructions: 929COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f40a36ed80e7fa84ae32882f285ae408a2c48f212789fbf0ffe7819f4ee8d6
Instruction ID: ccfbe87dc01bca8481d5bc7e89d2e7a56772373bde9bbd99eab17f8220eb3834
Opcode Fuzzy Hash: 19f40a36ed80e7fa84ae32882f285ae408a2c48f212789fbf0ffe7819f4ee8d6
Instruction Fuzzy Hash: C352B87284D3D60FD7279B704A6A1D5BFA0AA13310B1D06CFC4E18B5A3D29D99CAC35E

Function 00416C3F Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0de7a046ec34b83bbc3033ab6ae0e99f87698ffc0b25ddf2edfa9e03facaa23f
Instruction ID: ec473c390e775c3513d1f4c5f902ffdbdf11d251c2712a84011b28fca20aaef5
Opcode Fuzzy Hash: 0de7a046ec34b83bbc3033ab6ae0e99f87698ffc0b25ddf2edfa9e03facaa23f
Instruction Fuzzy Hash: 5F72E770A087459FCB29CF24C5D0AE9BBF1EF55304F1584AED99A8B342D338E985CB58

Function 00415D9A Relevance: .8, Instructions: 795COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e66e87e45e33e9b6c354f5b6263b5aa39b97c7922118d9d558ebbb9b9929d35
Instruction ID: 136bcfac07b0c46142f126060f48d767d5d9002a5a6c7f55271a6c6e067ee92a
Opcode Fuzzy Hash: 8e66e87e45e33e9b6c354f5b6263b5aa39b97c7922118d9d558ebbb9b9929d35
Instruction Fuzzy Hash: 8C72B070A04645DFCB19CF68C5806EDBBB1FF45308F2981AED8598B742C339E991CB59

Function 0040FEF0 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebf441c70ff6532865c288c87f3bce7e5014ce8903a4a7d139da48b9e85dfb4
Instruction ID: 0e00f547d9c9432e6b2b80a4b4e8710aa94bb2d64e29154f4667ae4663dd4859
Opcode Fuzzy Hash: 6ebf441c70ff6532865c288c87f3bce7e5014ce8903a4a7d139da48b9e85dfb4
Instruction Fuzzy Hash: 6112EC7284D3D94FDB279B704A6A1D67F60AA23300B2D05CFC5D18B5A3D2AD89C6C35E

Function 0041BCD9 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: fa64fecedd4ee0fbc6ebc6d5fd45eff142ec883d8ec5514f9c97111b8272a84e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 93D18E73C0E9B34A8735812D84582BBEE62AFD175031EC3E2DCE42F389D62B5D9196D4

Function 0041B8B9 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 1a9104bdc18b99a6bc3a57d880f0b00b8efb4b2948f4f82757f4a36a4691901f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 8DD18E73D1E9B30A8735812D80682ABEE62AFD175031EC3E2DCE42F389D72B5D9195D4

Function 0041B4AD Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 29e0c2194e43b481a6c61040bafb45c2199937250b84d4f9493dc4b244529513
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 24C16E73C0E9B30A8736812D81685ABEE62AFD175031FC3A2DCE42F389D36B5D9195D4

Function 0041B0D9 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2db7ca3506525dcc090db9a2522c638e963424884ad3e69ae6d01f57f6380b46
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 7AC17173D0E9B3068735812E84686ABEE62AFD175031FC3E29CE42F389D32B5D9495D4

Function 0041462B Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction ID: 3d3811311c0e96151038b15cdb33c9c3baef1538c920ea216c41a1bce0e780a6
Opcode Fuzzy Hash: 74c5e34f9abefec6387e3142de93532e06a17bc948433487153fd85e66a9dea7
Instruction Fuzzy Hash: DC812731600644ABDB14EF29C590BFD73A5EB92318F20842FE9569B2C2C77CD9C2CB59

Function 0040CC10 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5bf5cecdb1f64457438b731ed3817205f980e215465e163cae759f501b06fa
Instruction ID: 9df8b40ebdd558454bc31cf35b4b069549cd357de740422902aa7ddb2246d643
Opcode Fuzzy Hash: 2f5bf5cecdb1f64457438b731ed3817205f980e215465e163cae759f501b06fa
Instruction Fuzzy Hash: EB51A46104FBC19FC313977488666817FB56E13124B1E8AEBC0C9CF4B3E659594ADB32

Function 0041450F Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction ID: 1b781f1f23d015917a337ea3c6206954a5313e6084e2437016288461132a8366
Opcode Fuzzy Hash: 51b2d21a1de5244f25583c5063fbcf28c6649e746e5830653507aa8b0461497a
Instruction Fuzzy Hash: EF312372A10605ABCB04DF38C4912DEBBE2EF81308F14812FD865DB782D37DA945CB94

Function 00405610 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction ID: 2ccb413243c8e3f3810094ea986113c02d7a387cc67c693c5ca68079d889c8bb
Opcode Fuzzy Hash: 866ee34adc6fec30ee19582cd252525266032b464ccb2f20f1e66a817629a287
Instruction Fuzzy Hash: 2821D872A106716BD7048F65EC8412733A2D7CA3617DB4237DF445B3B1D135B922CAE8

Function 00410E50 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8242d2adca0ee77033965afe3d9840a22183be55bece64a87820915d62a16758
Instruction ID: 4356a253f76cc5610e9bc1f537dddfa62eb33724237590aeb4e51f1bbf9acff9
Opcode Fuzzy Hash: 8242d2adca0ee77033965afe3d9840a22183be55bece64a87820915d62a16758
Instruction Fuzzy Hash: 35F0AE725007059AE7109F5998467D777F8EB10704F14C81FD556F62C0C2F8D5C1CB85

Function 00419779 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0041979F
_malloc.LIBCMT ref: 004197AC

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: HeapAlloc.KERNEL32(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 004197C5
_wcscat.LIBCMT ref: 004197D0
_wcscat.LIBCMT ref: 004197DB
_wcscat.LIBCMT ref: 00419816
_wcscat.LIBCMT ref: 00419827
_wcslen.LIBCMT ref: 00419840
GlobalAlloc.KERNEL32(00000040,-00000009), ref: 00419851
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,-00000106,00000000,00000000), ref: 00419872
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 0041989A

Strings

<html>, xrefs: 004197BE, 004197C3, 004197FB
utf-8"></head>, xrefs: 004197D5
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004197CA
</html>, xrefs: 00419821

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _wcscat$AllocGlobal_wcslen$ByteCharCreateHeapMultiStreamWide_malloc_wcscpy
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3841325325-4209811716
Opcode ID: 858a996e26029bd60ca6401db7a314eaf989d6b4d57c198e73a70fd8604f7e50
Instruction ID: 9750a07ada00fadd6417d4a808c8c0194c88b3581ecb1a923ba5d07fa5d26e01
Opcode Fuzzy Hash: 858a996e26029bd60ca6401db7a314eaf989d6b4d57c198e73a70fd8604f7e50
Instruction Fuzzy Hash: 1C312A32900205BBDB11BB659C95EEF77789F42724F14415FF810AB2C6DB7C8E81836A

Function 00419A9D Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(?,00000000), ref: 00419AB7

Part of subcall function 00419A36: LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
Part of subcall function 00419A36: RegisterClassExW.USER32(00000030), ref: 00419A8E

GetWindowRect.USER32(?,?), ref: 00419AD8
GetParent.USER32(?), ref: 00419AEB
MapWindowPoints.USER32(00000000,00000000), ref: 00419AF0
DestroyWindow.USER32(?), ref: 00419AFE
GetParent.USER32(?), ref: 00419B1C
CreateWindowExW.USER32(00000000,RarHtmlClassName,00000000,40000000,?,?,?,?,00000000), ref: 00419B3B
ShowWindow.USER32(?,00000005), ref: 00419B6D
SetWindowTextW.USER32(?,00000000), ref: 00419B77
ShowWindow.USER32(00000000,00000005), ref: 00419B8D
UpdateWindow.USER32(?), ref: 00419B96

Strings

RarHtmlClassName, xrefs: 00419B35

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 80ed833fde46ef0684476050259e54a8f734e03cc260d1f6d230bab863c7ff7f
Instruction ID: a0655035169e6554100d25c4e6de203faa719369231219c5c88fda93c074337e
Opcode Fuzzy Hash: 80ed833fde46ef0684476050259e54a8f734e03cc260d1f6d230bab863c7ff7f
Instruction Fuzzy Hash: 0331B035600604EFCB319F65EC48EAFBBB9FF44700F10451AF91692260D735AD51DBA9

Function 00405164 Relevance: 21.1, APIs: 14, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00405182
_wcslen.LIBCMT ref: 0040518A
_wcscpy.LIBCMT ref: 0040519A
_wcslen.LIBCMT ref: 004051A0
_wcscpy.LIBCMT ref: 004051B8
_wcslen.LIBCMT ref: 004051BE
_wcscpy.LIBCMT ref: 004051CD
_wcslen.LIBCMT ref: 004051D3
_memset.LIBCMT ref: 004051E8
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405234
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 0040523C
CommDlgExtendedError.COMDLG32(?,?,?,?,?,000000A2), ref: 00405244
GetSaveFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405260
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,000000A2), ref: 00405268

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: FileName_wcscpy_wcslen$OpenSave$CommErrorExtended_memset
String ID:
API String ID: 3496903968-0
Opcode ID: e74642d2070660b170970d878bf29844ae1157b468b04acc2c75ad1758c26d21
Instruction ID: 017447a648ceccb586da1f31f92202068c03838f3088d87860c47b682a039f1a
Opcode Fuzzy Hash: e74642d2070660b170970d878bf29844ae1157b468b04acc2c75ad1758c26d21
Instruction Fuzzy Hash: D531D775901618ABCB11AFA5DC45ACF7BB8EF04314F00002AF904B7281DB38DA958FAE

Function 00419D0B Relevance: 19.6, APIs: 13, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00419D17
CreateCompatibleDC.GDI32(00000000), ref: 00419D27
CreateCompatibleDC.GDI32(?), ref: 00419D2E
GetObjectW.GDI32(?,00000018,?), ref: 00419D3C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00419D5E
SelectObject.GDI32(00000000,?), ref: 00419D71
SelectObject.GDI32(?,?), ref: 00419D7C
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
SelectObject.GDI32(00000000,?), ref: 00419DA4
SelectObject.GDI32(?,?), ref: 00419DAC
DeleteDC.GDI32(00000000), ref: 00419DB5
DeleteDC.GDI32(?), ref: 00419DBA
ReleaseDC.USER32(00000000,?), ref: 00419DC0

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapReleaseStretch
String ID:
API String ID: 3950507155-0
Opcode ID: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction ID: fe64683af8def945f8560e9c967618457674570685148338231d72a037962566
Opcode Fuzzy Hash: c5f4d7ef721d9f2cf6d28cde0393e927751e3943138dffdaa34ce4f2faff49d0
Instruction Fuzzy Hash: C021A076900218FFCF129FA1DC48DDEBFBAFB48350B104466F914A2120C7369A65EFA4

Function 0041E854 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,0042D8A0,0000000C,0041E98F,00000000,00000000,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0041E866
__crt_waiting_on_module_handle.LIBCMT ref: 0041E871

Part of subcall function 00421465: Sleep.KERNEL32(000003E8,00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 00421471
Part of subcall function 00421465: GetModuleHandleW.KERNEL32(00000000,?,0041E7B7,KERNEL32.DLL,?,0041E803,?,0041FE78,0041A9BA,?,?,?,0041A9BA,00000000,?), ref: 0042147A

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0041E89A
GetProcAddress.KERNEL32(0041A9BA,DecodePointer), ref: 0041E8AA
__lock.LIBCMT ref: 0041E8CC
InterlockedIncrement.KERNEL32(?), ref: 0041E8D9
__lock.LIBCMT ref: 0041E8ED
___addlocaleref.LIBCMT ref: 0041E90B

Strings

KERNEL32.DLL, xrefs: 0041E860, 0041E865, 0041E870
EncodePointer, xrefs: 0041E88E
DecodePointer, xrefs: 0041E8A2

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction ID: 28857185edf288c115030afddfc21b3ad53991f12277c54fa87cb1ac16e0dfb5
Opcode Fuzzy Hash: d8a1d3b64ce03b740c9770e28a10d8a3d1cb693a8f1fd6d09f99049fe87b25f8
Instruction Fuzzy Hash: 82119071A40701AFD720AF36D805B9EBBE0AF44314F60456FE8A997290CB78A981CF5D

Function 004191D8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 004191E3
_malloc.LIBCMT ref: 004191F1

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: HeapAlloc.KERNEL32(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

_wcscpy.LIBCMT ref: 0041920F
_wcslen.LIBCMT ref: 00419215
_wcscpy.LIBCMT ref: 0041925D

Strings

, xrefs: 0041922D
 , xrefs: 00419292
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00419209
<br>, xrefs: 00419255

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _wcscpy_wcslen$AllocHeap_malloc
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 4203449756-406990186
Opcode ID: b9a7af0f39a4056f62aa7d377c459f50f8166c19c0f532a011f788f3a39773f3
Instruction ID: 0e02d37120f5dc5c9773bcbd7ae744d1444ccd80410fa70afd17435bf81929d8
Opcode Fuzzy Hash: b9a7af0f39a4056f62aa7d377c459f50f8166c19c0f532a011f788f3a39773f3
Instruction Fuzzy Hash: BF21FB76904304BBDB20AB54DC41ADAB3B4EF45314B20445BE455A7390E7BC9ED1839E

Function 0041963B Relevance: 13.6, APIs: 9, Instructions: 133
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00419654
GetTickCount.KERNEL32 ref: 0041966F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00419683
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00419694
TranslateMessage.USER32(?), ref: 0041969E
DispatchMessageW.USER32(?), ref: 004196A8
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000204), ref: 00419748
ShowWindow.USER32(?,00000005), ref: 00419753
SetWindowTextW.USER32(?,00000000), ref: 0041975D

Part of subcall function 0041A506: __lock.LIBCMT ref: 0041A524
Part of subcall function 0041A506: ___sbh_find_block.LIBCMT ref: 0041A52F
Part of subcall function 0041A506: ___sbh_free_block.LIBCMT ref: 0041A53E
Part of subcall function 0041A506: HeapFree.KERNEL32(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
Part of subcall function 0041A506: GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Message$Window$CountTick$DispatchErrorFreeHeapLastPeekShowTextTranslate___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 1762286965-0
Opcode ID: 0459753bd330617b9bf5afbe23bb0f5f6ffb8490f7f9503ea0c887863e27fb98
Instruction ID: 0fcf3197ed2ac79a16e8f935243f891c0de6f754acb5965f6be033bd159a0870
Opcode Fuzzy Hash: 0459753bd330617b9bf5afbe23bb0f5f6ffb8490f7f9503ea0c887863e27fb98
Instruction Fuzzy Hash: F4412871A00219EFCB10EFA5C8989DEBB79FF49751B10846AF905D7250D738DE81CBA4

Function 0041A060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30
librarycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(riched32.dll), ref: 0041A07B
LoadLibraryW.KERNEL32(riched20.dll), ref: 0041A084
OleInitialize.OLE32(00000000), ref: 0041A08B
InitCommonControlsEx.COMCTL32(?), ref: 0041A0A3
SHGetMalloc.SHELL32(0044F800), ref: 0041A0AE

Strings

riched32.dll, xrefs: 0041A076
riched20.dll, xrefs: 0041A07D

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CommonControlsInitInitializeMalloc
String ID: riched20.dll$riched32.dll
API String ID: 448729520-3294723617
Opcode ID: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction ID: d62a9b991739124620cbbd73e07a01740528edc951963754c9102d88a2026b42
Opcode Fuzzy Hash: 8624e4f240296107261ce0a47b5d27c571c626025523bcd3f0aeccd25934cca6
Instruction Fuzzy Hash: EFF08271B00318AFD7209FA5DC0EB9ABBE8EF40766F50442DE54593250DBB8A4458BA9

Function 004192D0 Relevance: 12.1, APIs: 8, Instructions: 71
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004192E2
GetTickCount.KERNEL32 ref: 004192E7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00419316
TranslateMessage.USER32(?), ref: 00419324
DispatchMessageW.USER32(?), ref: 0041932E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041933B
GetTickCount.KERNEL32 ref: 00419341
VariantInit.OLEAUT32(?), ref: 0041934E

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Message$CountTick$DispatchInitPeekTranslateVariant
String ID:
API String ID: 4242828014-0
Opcode ID: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction ID: 9cb0af2a0f3e63d9aa0a53d062aebc77c377528e3d470f830326fa06e80cb38f
Opcode Fuzzy Hash: 3739eaef324a12835188418d8e4db8062592f3b82a480bdb7c4c47042269d501
Instruction Fuzzy Hash: C121F7B1E00208AFDB10DFE4D888EEEBBBCEF48305F504866F911E7250D6799E458B61

Function 00419EA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 184
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00419E75: GetDC.USER32(00000000), ref: 00419E79
Part of subcall function 00419E75: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00419E84
Part of subcall function 00419E75: ReleaseDC.USER32(00000000,00000000), ref: 00419E8F

GetObjectW.GDI32(?,00000018,?), ref: 00419ECD
CoCreateInstance.OLE32(0042B208,00000000,00000001,0042B100,?,?,?), ref: 00419EFD

Part of subcall function 00419D0B: GetDC.USER32(00000000), ref: 00419D17
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(00000000), ref: 00419D27
Part of subcall function 00419D0B: CreateCompatibleDC.GDI32(?), ref: 00419D2E
Part of subcall function 00419D0B: GetObjectW.GDI32(?,00000018,?), ref: 00419D3C
Part of subcall function 00419D0B: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00419D5E
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419D71
Part of subcall function 00419D0B: SelectObject.GDI32(?,?), ref: 00419D7C
Part of subcall function 00419D0B: StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00419D9A
Part of subcall function 00419D0B: SelectObject.GDI32(00000000,?), ref: 00419DA4
Part of subcall function 00419D0B: SelectObject.GDI32(?,?), ref: 00419DAC
Part of subcall function 00419D0B: DeleteDC.GDI32(00000000), ref: 00419DB5
Part of subcall function 00419D0B: DeleteDC.GDI32(?), ref: 00419DBA
Part of subcall function 00419D0B: ReleaseDC.USER32(00000000,?), ref: 00419DC0

Strings

(, xrefs: 00419FA5

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Object$CreateSelect$Compatible$DeleteRelease$BitmapCapsDeviceInstanceStretch
String ID: (
API String ID: 189428636-3887548279
Opcode ID: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction ID: d8cf3f11634150c5eb1370622c6fe0712570af28e2ae67cdae83cea958a68594
Opcode Fuzzy Hash: 2c95d850f981d7af9c5ed3b9bf4fae1c522e7595f6c5569b0b0a1ef1f992ee39
Instruction Fuzzy Hash: 21610875A00209EFCB00DFA5D888EEEBBB9FF89704B10845AF815EB250D7759E51CB64

Function 0041947D Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00419489
_malloc.LIBCMT ref: 00419493

Part of subcall function 0041CF3E: __FF_MSGBANNER.LIBCMT ref: 0041CF61
Part of subcall function 0041CF3E: __NMSG_WRITE.LIBCMT ref: 0041CF68
Part of subcall function 0041CF3E: HeapAlloc.KERNEL32(00000000,-0000000F,00000001,00000000,00000000,?,004212F4,00000000,00000001,00000000,?,0041EF2D,00000018,0042D930,0000000C,0041EFBE), ref: 0041CFB5

Strings

</p>, xrefs: 00419549
<br>, xrefs: 00419560
<style>, xrefs: 00419598
</style>, xrefs: 004195B3

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: AllocHeap_malloc_wcslen
String ID: </p>$</style>$<br>$<style>
API String ID: 1868046988-1200123991
Opcode ID: 11f98262dd591ee340f2e045aac2cbee0ec90665085e5cd499b590bf6392889c
Instruction ID: 25e48dc46573b9320602deb0b34776bf62bfe2b29788b043e296d39cf0375d11
Opcode Fuzzy Hash: 11f98262dd591ee340f2e045aac2cbee0ec90665085e5cd499b590bf6392889c
Instruction Fuzzy Hash: 69412477645212B5DB315B1998217FA73A69F01754F68401BED81B32C0E76C8EC2C26D

Function 004113F1 Relevance: 10.6, APIs: 7, Instructions: 134timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?,?,?,?), ref: 00411425
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00411435
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00411441
SystemTimeToFileTime.KERNEL32(?,?), ref: 0041144F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411459
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000001), ref: 004114A6
SystemTimeToFileTime.KERNEL32(?,?), ref: 00411523

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: dda2a11e6d76ed0c02cb1e5d6795d5acba6154e9d991bab1c61d1e0689a93e9c
Instruction ID: 2321c29e0176793db35fe244bdb3b2ca835dfa759224b44d16608c614d02fbda
Opcode Fuzzy Hash: dda2a11e6d76ed0c02cb1e5d6795d5acba6154e9d991bab1c61d1e0689a93e9c
Instruction Fuzzy Hash: 40410AB1E00218AFCB14DFA9C8849EEB7F9FF48314B14852FE946E7240D778A945CB64

Function 004084EE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004084F3
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00408516
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00408535

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,004054EE,00000000,?,00000000,?,?), ref: 00411E76

MoveFileW.KERNEL32(?,00000000), ref: 00408639
MoveFileW.KERNEL32(00000000,?), ref: 0040867C

Part of subcall function 00410B9C: _wcsncpy.LIBCMT ref: 00410BB3

Strings

rtmp%d, xrefs: 004085BA

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString_wcsncpy
String ID: rtmp%d
API String ID: 2942086052-3303766350
Opcode ID: 59297f0ed4bdc37ef1d7502774a7e984916758b9c8b31d55678aaee556d0cc2f
Instruction ID: 086441498323e4bc326e09acd5d1366d0aff3811eaae5beb392a373780c828d6
Opcode Fuzzy Hash: 59297f0ed4bdc37ef1d7502774a7e984916758b9c8b31d55678aaee556d0cc2f
Instruction Fuzzy Hash: DE415E71901218AACB20EB61CE45EDF777CAF00394F0008ABB585B7181EA7D9B959E68

Function 0040680A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040680F

Part of subcall function 00402C8B: __EH_prolog.LIBCMT ref: 00402C90

SetFileSecurityW.ADVAPI32(00000000,00000007,?,?,?,?,00000000,?,00406EF5,?,?,?,?,0040773A,?,?), ref: 00406897
SetFileSecurityW.ADVAPI32(?,00000007,?,00000000,?,00000800,?,0040773A,?,?,?,?,?,00000000,0040839C,?), ref: 004068BE

Strings

SeSecurityPrivilege, xrefs: 00406852
SeRestorePrivilege, xrefs: 00406867
@Oiu0hu, xrefs: 0040688C

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: FileH_prologSecurity
String ID: @Oiu0hu$SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2167059215-3865491934
Opcode ID: e93da029cabc767ec1c392023e62d2c0e7b38da0f3cec8ffbaba9f3ed0ece07f
Instruction ID: e80266907105dbdc6ea336272c15ef3f26093cba4c1f52b7c6092cd65192489b
Opcode Fuzzy Hash: e93da029cabc767ec1c392023e62d2c0e7b38da0f3cec8ffbaba9f3ed0ece07f
Instruction Fuzzy Hash: 8D219372901259BEDF21AF55DC01BAF77689B04758F00803BF802B62C1C7BC8A559BAD

Function 00411541 Relevance: 9.1, APIs: 6, Instructions: 104timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,004116A7,?,?), ref: 00411592
LocalFileTimeToFileTime.KERNEL32(004116A7,?), ref: 004115BE
FileTimeToSystemTime.KERNEL32(004116A7,?), ref: 004115D4
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004115E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115F2
SystemTimeToFileTime.KERNEL32(?,?), ref: 004115FC

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$Specific
String ID:
API String ID: 3144155402-0
Opcode ID: 25928130b54ac9dd7b7fac3ffeb54b87ab731dc14cadb33affbf70a2fa674ade
Instruction ID: daaaa78088cd12f13caf2716ff388f37494b9d87aa27411613d97d80370a29eb
Opcode Fuzzy Hash: 25928130b54ac9dd7b7fac3ffeb54b87ab731dc14cadb33affbf70a2fa674ade
Instruction Fuzzy Hash: 92313276D001199BCB14DFD4C840AEFB7B9FF48710F04452AE946E3250E634A945CBA9

Function 0041DD85 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0041DDAD

Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3E4
Part of subcall function 0041A3D6: __getptd.LIBCMT ref: 0041A3F2

__getptd.LIBCMT ref: 0041DDB7

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DDC5
__getptd.LIBCMT ref: 0041DDD3
__getptd.LIBCMT ref: 0041DDDE
_CallCatchBlock2.LIBCMT ref: 0041DE04

Part of subcall function 0041A47B: __CallSettingFrame@12.LIBCMT ref: 0041A4C7

Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEBA
Part of subcall function 0041DEAB: __getptd.LIBCMT ref: 0041DEC8

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction ID: e3df1943845817192d3dafa627097d3dc4affc0cfff12b6418408f9c93a4c95a
Opcode Fuzzy Hash: 5eb10d2cb4eb5e2da6c5453d1fe4c56248c4e16d68a7da2668f442ad0aab7930
Instruction Fuzzy Hash: 9E1126B1D00209DFDF00EFA1C445AED7BB0FF04318F10806AF854AB251DB389A519B59

Function 00405F3C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405F41
_memset.LIBCMT ref: 00405FA4
_memset.LIBCMT ref: 00405FB0
_memset.LIBCMT ref: 00405FCE

Strings

r, xrefs: 00405F4A, 00405F66

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset$H_prolog
String ID: r
API String ID: 3013590873-3291565091
Opcode ID: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction ID: fcb346f71e1c6521d09fa93fcec7134e0802dca7d1a5d7d76298086db4932847
Opcode Fuzzy Hash: adb95f05f7a194937a5df8f484bb6bf36145664ded8c6b0a2324601c3f7e7fd4
Instruction Fuzzy Hash: 880144B17417407AD220EB669C46FEBBAA8DB85B18F00041FB255661C2C7FC5941CA9D

Function 0041DAD4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041DAEE

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DAFF
__getptd.LIBCMT ref: 0041DB0D

Strings

MOC, xrefs: 0041DAE0
csm, xrefs: 0041DAE7

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction ID: 7ce874268d128f0e9cc5e4e4439fd54cca852ebc00a18d755191ea46e2ae681e
Opcode Fuzzy Hash: ff76af2ab1f2bc655f60c8d28124db9f091a0a07b538bc98cf4441336e04e070
Instruction Fuzzy Hash: 8EE048755141048FDB50976AC445FA93394EB48318F1504A7E80CC7353D77CE8C0558B

Function 00421BA7 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00421BB3

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__amsg_exit.LIBCMT ref: 00421BD3
__lock.LIBCMT ref: 00421BE3
InterlockedDecrement.KERNEL32(?), ref: 00421C00
InterlockedIncrement.KERNEL32(00741690), ref: 00421C2B

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: ebc1e90ea7ebb2cd7a70d9e2b8ecced687c6613aa7d00b2615dd79ed11a35268
Instruction ID: 6d4d6cab2ca80c9586acdc371c3e58b42f7918e3e726cea937426c24952e9619
Opcode Fuzzy Hash: ebc1e90ea7ebb2cd7a70d9e2b8ecced687c6613aa7d00b2615dd79ed11a35268
Instruction Fuzzy Hash: 8401C439B40731ABC728AF56A40679E7760BF10724F94012BE804AB3A1CB3C6991DBDD

Function 0041A506 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041A524

Part of subcall function 0041EFA3: __mtinitlocknum.LIBCMT ref: 0041EFB9
Part of subcall function 0041EFA3: __amsg_exit.LIBCMT ref: 0041EFC5
Part of subcall function 0041EFA3: EnterCriticalSection.KERNEL32(0041A9AB,0041A9AB,?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001), ref: 0041EFCD

___sbh_find_block.LIBCMT ref: 0041A52F
___sbh_free_block.LIBCMT ref: 0041A53E
HeapFree.KERNEL32(00000000,00000000,0042D658,0000000C,0041EF84,00000000,0042D930,0000000C,0041EFBE,00000000,0041A9AB,?,00425448,00000004,0042DB18,0000000C), ref: 0041A56E
GetLastError.KERNEL32(?,00425448,00000004,0042DB18,0000000C,0042133E,00000000,0041A9BA,00000000,00000000,00000000,?,0041E966,00000001,00000214), ref: 0041A57F

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction ID: 0c17081243acc93c5e04f74f5850e91c5e9c62578e05a8caa74c22d26ff5c9bd
Opcode Fuzzy Hash: 1eba3eb2bfd23f5b1e043426ba5b029f38dd9947a11c8dba489f2cac3b6c6ae4
Instruction Fuzzy Hash: 1D01847194A215BBDB306BB29C067DE3B65AF00798F10012BFC0496291DB3C86D19A5E

Function 00411E81 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00411E89
_wcslen.LIBCMT ref: 00411E9A
_wcslen.LIBCMT ref: 00411EAA
_wcslen.LIBCMT ref: 00411EB8
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?), ref: 00411ED5

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction ID: fd224344e63f22d7e065bf6fa160c6ce473b51916626f6dd2966927fcf662de7
Opcode Fuzzy Hash: a78696411e0fb58170a85e42f91a72465e9b1cb7d1a352a10a0ff52bf1fcbbb8
Instruction Fuzzy Hash: 5FF02436148148BFDF126F92EC01CDE3F26DB81375B244027FE298A0A0D635C9A29789

Function 00411119 Relevance: 7.5, APIs: 5, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041102B: ResetEvent.KERNEL32(?,00000200,?,?,00405016), ref: 00411051
Part of subcall function 0041102B: ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00411061

ReleaseSemaphore.KERNEL32(?,00000020,00000000,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411135
CloseHandle.KERNEL32(00000003,00000003,?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411156
DeleteCriticalSection.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 0041116C
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411178
CloseHandle.KERNEL32(?,?,0044F590,00411241,?,00401024,?,?,0040128E), ref: 00411180

Part of subcall function 00410EA0: WaitForSingleObject.KERNEL32(?,000000FF,0041106E,?), ref: 00410EA6
Part of subcall function 00410EA0: GetLastError.KERNEL32(?), ref: 00410EB2

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 0382d21baac6a1741122a34ea6855b84d6e50229a7b3d3c8aab95350a1ea80c2
Instruction ID: 628da898c48b8095e2505876ae832dd6733ab043d372e65b09dbeb3e2adc3a3f
Opcode Fuzzy Hash: 0382d21baac6a1741122a34ea6855b84d6e50229a7b3d3c8aab95350a1ea80c2
Instruction Fuzzy Hash: F9F06275101704AFD7206B70DC45BD7BBA5EB0A354F00042AF7AA41120CB7768A19B29

Function 00416790 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 381COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00416795

Part of subcall function 004129F9: _realloc.LIBCMT ref: 00412A51

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

_memset.LIBCMT ref: 004169F6
_memset.LIBCMT ref: 00416BB0

Strings

, xrefs: 00416992

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset$H_prolog_malloc_realloc
String ID:
API String ID: 1826288403-3916222277
Opcode ID: e35177213208d61a0a763407be839d455d7b5a86de6920380dbe57b4c94731d4
Instruction ID: b2eea235d821e150737843ebb12b5e68f22e0a3d12c725fcd3f3b3fef6346f43
Opcode Fuzzy Hash: e35177213208d61a0a763407be839d455d7b5a86de6920380dbe57b4c94731d4
Instruction Fuzzy Hash: 92E1BF71A007499FCB10EF65C980BEEB7B1FF14304F11482EE956A7281DB39E991CB59

Function 00418B3D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00418C26
_wcscpy.LIBCMT ref: 00418C86
_wcscpy.LIBCMT ref: 00418D2D

Strings

T, xrefs: 00418CEF

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _wcscpy
String ID: T
API String ID: 3048848545-3187964512
Opcode ID: 764e4e8a4f4e8074cd2997a40fed6d08be93389de6c886212a83cd10804fca37
Instruction ID: 08ee224434b4342d1c159c2c22343cdeaadf414e9d08c0d11a019e9d32988bbe
Opcode Fuzzy Hash: 764e4e8a4f4e8074cd2997a40fed6d08be93389de6c886212a83cd10804fca37
Instruction Fuzzy Hash: 99910871600744AFDF24DF64C884BEAB7F8AF15304F0445AFE95997282CB78AAC4CB65

Function 00406D02 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00406D07
_wcscpy.LIBCMT ref: 00406D3A

Part of subcall function 00410BC9: _wcslen.LIBCMT ref: 00410BCF
Part of subcall function 00410BC9: _wcsncat.LIBCMT ref: 00410BE8

SetFileTime.KERNEL32(?,?,?,?,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000), ref: 00406E78

Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(00000000,00000000,75573110,00000001,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090A8
Part of subcall function 0040908D: SetFileAttributesW.KERNEL32(?,00000000,00000000,?,00000800,?,0040933D,00000000,?,?,0040941E,?,00000001,00000000,?,?), ref: 004090D5

Strings

:, xrefs: 00406D70

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: File$Attributes$H_prologTime_wcscpy_wcslen_wcsncat
String ID: :
API String ID: 326910402-336475711
Opcode ID: f5173041702b61483f3d104a7baf222bf5bcfa3b9d9a113727e24170d826f752
Instruction ID: 6639f4f99703ce1112f5787d69d8c123706ab186ca62756c3ad703d048bc38cc
Opcode Fuzzy Hash: f5173041702b61483f3d104a7baf222bf5bcfa3b9d9a113727e24170d826f752
Instruction Fuzzy Hash: D0417F71905258AAEB20EB64CC55EEE737CAF04344F0040ABB556B71C2DB78AF94CF69

Function 0041254D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 004125BE
_memset.LIBCMT ref: 004125C7

Strings

, xrefs: 0041256C

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_memset
String ID:
API String ID: 3963884845-3916222277
Opcode ID: f121cb723b88151b8d7c29095ae3e5beb5fa647253e82d4155322dd225e1007f
Instruction ID: ba4e6bc0ef6041dd665025fb65f45a384477b48ee7e133f8ed84bbd0a598a512
Opcode Fuzzy Hash: f121cb723b88151b8d7c29095ae3e5beb5fa647253e82d4155322dd225e1007f
Instruction Fuzzy Hash: 60110671E01218BACB14EFA9CAD55DEB776FF54344F10406BE405E7241D6B85BD2CB88

Function 00410F29 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B), ref: 00410F62
CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 00410F6C
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 00410F7E

Strings

Thread pool initialization failed., xrefs: 00410F96

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction ID: 3f206ddc5264aa259e24750db78c3e6b08f6c9018291aa2998b68a3e9789e537
Opcode Fuzzy Hash: 5d2de00027b14f6e07390935bc826641c20494178e34cc3b56ee4834533d8747
Instruction Fuzzy Hash: FF115EB1600301AFD3305F659886BE7BBE8FB55315F60482FF6DAC6240D6B458C1CB18

Function 004050E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004050F5
SHBrowseForFolderW.SHELL32(?), ref: 00405130

Strings

A, xrefs: 00405129

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: BrowseFolderMalloc
String ID: A
API String ID: 3812826013-3554254475
Opcode ID: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction ID: 7c691baa3b27f7502734ebd35b11d26621297010b335108cc4fc530f71bfb90e
Opcode Fuzzy Hash: 38b49180d38aa256d497848d66ef1996a2da1d611468f43139da5b44fce9136b
Instruction Fuzzy Hash: F0010572900619EBDB11CFA4D909BEF7BF8EF49311F204466E805EB240D779DA058FA5

Function 0041E132 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0041E145

Part of subcall function 0041E0A0: ___BuildCatchObjectHelper.LIBCMT ref: 0041E0D6

_UnwindNestedFrames.LIBCMT ref: 0041E15C
___FrameUnwindToState.LIBCMT ref: 0041E16A

Strings

csm, xrefs: 0041E141, 0041E156, 0041E169, 0041E187, 0041E197

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction ID: 59b9ad28f981bea14fd5052789bebdc6dccf333051ec123e92fb5a6599f75b08
Opcode Fuzzy Hash: ffb5442ac62a4f85a48ef68d244cd4b92cff39c7c80ea712eb3c4bba393a9d17
Instruction Fuzzy Hash: 14012479401109BBDF126E52CC45EEB3F6AEF09398F044016FD1815261DB3AA8B1EBA9

Function 00423463 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0041D860), ref: 00423468
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00423478

Strings

KERNEL32, xrefs: 00423463
IsProcessorFeaturePresent, xrefs: 00423472

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction ID: 925bd1e911d968a2cf7935e923f91739ef174afc765d351c528eb22c7f6e48fa
Opcode Fuzzy Hash: 7ab99d9e72488d8bf21e4bf78f78cc33f843bd022a3d825351adfd90e0f12518
Instruction Fuzzy Hash: C7F03060B00A1AD2DB116FA1BC1A67F7B78FB80742FD105D1D6D5E0084DF7885B1D38A

Function 00419CB2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00419CC9
SHAutoComplete.SHLWAPI(?,00000010), ref: 00419D00

Part of subcall function 00411E60: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,000000FF,004054EE,00000000,?,00000000,?,?), ref: 00411E76

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00419CF0

Strings

EDIT, xrefs: 00419CD4, 00419CD9, 00419CEC

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction ID: c03662b206b47bf0f9187f3c1687b62eae72e09aaad69f108c393d7fbd584eff
Opcode Fuzzy Hash: b027ed5b97d113a91e8e700dc85ec23dd11054ff1df16afbaa6f3d453c1c9159
Instruction Fuzzy Hash: 3CF0E232300219BBDB305A15AD05FEB36BC9F86B40F840066FE01E2280EB68D84285BA

Function 00419A36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00419A6D
RegisterClassExW.USER32(00000030), ref: 00419A8E

Strings

0, xrefs: 00419A4C
RarHtmlClassName, xrefs: 00419A84

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction ID: b9ed7023dc6f3226d58ddf2044dfc6b29f2317d5cd4a011e6e0fd8f9270d308a
Opcode Fuzzy Hash: 191bbc33d2b33050640957ba9683b50acfea39c34108bf4aa43fc12e5a7eb183
Instruction Fuzzy Hash: 81F0F2B1D00228ABCB019F9AD844AEEFBF8FF98304F10805BE500B6250D7B916018FA9

Function 00410E1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00410E21
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00410E31

Strings

kernel32, xrefs: 00410E1C
SetDllDirectoryW, xrefs: 00410E2B

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: SetDllDirectoryW$kernel32
API String ID: 1646373207-2052158636
Opcode ID: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction ID: d1dc000951ac042e8af12af71ac4f40d64c7c6d3e89629ddd7054994e9706fe8
Opcode Fuzzy Hash: 613fa81eedf6cfefe4bb79f79fd7d80da4da150b27e50d1fb967e6d6e35de1a2
Instruction Fuzzy Hash: 2BD0A7B03243215797282B729C1AB2B65584B50F027944D3E7E0AC0080CA6DC0A0853F

Function 00409135 Relevance: 6.1, APIs: 4, Instructions: 128filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,?,?,00407536,?,?,?), ref: 004091CD
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00407536,?,?,?,?), ref: 00409204
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00407536,?,?,?,?), ref: 00409275
CloseHandle.KERNEL32(?,?,00407536,?,?,?,?), ref: 0040927E

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction ID: 149005b1c5d3a5dbb79089aff48ec9cca0dae1d541df05bff41c4f18bd56acf5
Opcode Fuzzy Hash: 6a8276f57ee53cdbc91cc020f39a17d418f5c9fb0df3296a94224ec9e042af11
Instruction Fuzzy Hash: 1141A131A00248BEEF12DBA4CC49FEE7BB89F05304F1445AAF851BB2D2C6789E45D755

Function 004087C3 Relevance: 6.1, APIs: 4, Instructions: 104fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,-00000001,00000000,00000802,00000000,?,00000000,00406E59,00000000,00000005,?,00000011), ref: 00408854
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 0040885D
CreateFileW.KERNEL32(?,-7FFFF7FE,?,00000000,00000003,00000000,00000000,?,?,00000800,?,00000000,00406E59,00000000,00000005,?), ref: 00408895
GetLastError.KERNEL32(?,00000000,00406E59,00000000,00000005,?,00000011,00000000,?,00000000,?,0000003A,00000802,?,00000000,00000802), ref: 00408899

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: af91fa9e31fc35479b06de1e2718df4f2ae689f678c6a4dec4fb7829a965a613
Instruction ID: e5fec55928a071c2e3d1b6f10086eb5e0cd4d8e33465c7e2028d9d916ffc9c2f
Opcode Fuzzy Hash: af91fa9e31fc35479b06de1e2718df4f2ae689f678c6a4dec4fb7829a965a613
Instruction Fuzzy Hash: 083169725047449BE7309B20CD05BEB77D4AB80318F104A2EF9D0A33C2DBBE9548D75A

Function 00401822 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00401827

Part of subcall function 00405F3C: __EH_prolog.LIBCMT ref: 00405F41
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FA4
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FB0
Part of subcall function 00405F3C: _memset.LIBCMT ref: 00405FCE

_memset.LIBCMT ref: 0040196A
_memset.LIBCMT ref: 00401979
_memset.LIBCMT ref: 00401988

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset$H_prolog$_malloc
String ID:
API String ID: 4233843809-0
Opcode ID: 501c6eee4a7241d63770c4c2f1de26fd54ae9709b4e94646da0b45a51fa4183c
Instruction ID: 211b101a5e2dbba32f2c8dae62910ed897794103f7d8a7f2ed724c9505602145
Opcode Fuzzy Hash: 501c6eee4a7241d63770c4c2f1de26fd54ae9709b4e94646da0b45a51fa4183c
Instruction Fuzzy Hash: 865127B1445F809EC321DF7988916D7FFE0AF29314F84496E91FE93282D7352658CB29

Function 00424FCE Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00425002
__isleadbyte_l.LIBCMT ref: 00425036
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,?,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 00425067
MultiByteToWideChar.KERNEL32(00000080,00000009,0041A9BA,00000001,00000000,00000000,?,?,?,?,0041A9BA,00000000,?), ref: 004250D5

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction ID: 432046cfce088e341913eb2016d1b5e66f5b1b0e2666f0ac1bd271c546b36d2c
Opcode Fuzzy Hash: 5ede48c89caf3767bd10844c4e2adb50473344288511d083f5bbcd5d287f352f
Instruction Fuzzy Hash: C831D131B00265EFDB20DF64EC809BA7BA0EF41310F5685AAE4618B2D1D735D981DB99

Function 00413CE8 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00413CED
_memset.LIBCMT ref: 00413D11
_memset.LIBCMT ref: 00413D8D
_malloc.LIBCMT ref: 00413DC0

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset$H_prolog_malloc
String ID:
API String ID: 1600808285-0
Opcode ID: 75873b8bc138ad3d6f3cbaf08acd952bbb3a9c6cdc0421f6e50df2b8bea4b983
Instruction ID: 702ce421a693160a9893d7f58a622c69960126b9ff2eeb296b605b135dd4a1ff
Opcode Fuzzy Hash: 75873b8bc138ad3d6f3cbaf08acd952bbb3a9c6cdc0421f6e50df2b8bea4b983
Instruction Fuzzy Hash: F831D4B1E01215ABDB14AF65D9057EB76A8FF14319F10013FE105E7281E7789E9087ED

Function 00408CA0 Relevance: 6.1, APIs: 4, Instructions: 59fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CB1
ReadFile.KERNEL32(?,?,?,00000000,00000000,004335AC,?,00000000,?,?,00408EB0,?,00000000,?,?,00000000), ref: 00408CC9
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D01
GetLastError.KERNEL32(?,00408EB0,?,00000000,?,?,00000000), ref: 00408D1C

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction ID: b149f771e66fe820b49a3db0cdc04a66bbf6f60059da98a6e892905e95da3d99
Opcode Fuzzy Hash: c1fed62a9ea2a8515d50b02984c21f09fd940ae1629289a4c1ded04f954c3d6f
Instruction Fuzzy Hash: B411A734504608EFEB205B50DA4096A37A8FF71374B10863FE996A52D1DE3DCD41DF2A

Function 00413097 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00412F1C: _memset.LIBCMT ref: 00412F36

_memset.LIBCMT ref: 004130CD
_memset.LIBCMT ref: 004130E0
_memset.LIBCMT ref: 00413120
_memset.LIBCMT ref: 00413133

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction ID: dbb621f027503421eccd8689c294ebf88999011181a54c0115c225b35bd7b5a3
Opcode Fuzzy Hash: 0d338722b2e3e51696f4e1a05dd7a6835afd7bcab5979c6f78e2f817af711592
Instruction Fuzzy Hash: 9811487164478069E220EA7A4C46FE3B6DD9B1931CF44883FF2DEC7183C6AA6846C756

Function 00411072 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00411077
EnterCriticalSection.KERNEL32(0044F590,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 00411085
LeaveCriticalSection.KERNEL32(0044F590,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 004110F5

Part of subcall function 0041A89A: _malloc.LIBCMT ref: 0041A8B4

LeaveCriticalSection.KERNEL32(0044F590,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 00411100

Part of subcall function 00410F29: InitializeCriticalSection.KERNEL32(000001A0,?,000001B8,0044F590,004110EE,00000020,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B), ref: 00410F62
Part of subcall function 00410F29: CreateSemaphoreW.KERNEL32(00000000,00000000,00000020,00000000,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 00410F6C
Part of subcall function 00410F29: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,00000000,?,0041776B,00000001,00000001,?,00000000,?,00402D2B,?,00000802), ref: 00410F7E

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateLeave$EnterEventH_prologInitializeSemaphore_malloc
String ID:
API String ID: 1405584564-0
Opcode ID: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction ID: 491e5497db774d6ab3e78c5f78b9db4af1dc916e288055147b814ae628d52a75
Opcode Fuzzy Hash: 3f0bec743d3c3e54beb4ca038bcc84bad5a4a530a73f67f15a7eea00e341295c
Instruction Fuzzy Hash: 1A118234A01321EBD724AF74AC457EABBA4AB0C355F10453BE902E3692DBBC89D1865D

Function 0042332E Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00423354

Part of subcall function 00423179: __fltout2.LIBCMT ref: 004231A5

__cftog_l.LIBCMT ref: 0042337A
__cftoe_l.LIBCMT ref: 004233AC

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 44ddc5ebc1807cb1f8dbc3b2ce9dd0a677749795dee404b17e6a32e81244ff51
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: AE11723250015EFBCF125E85EC418EE3F32BB48355B988456FE1859130CA3ACAB2AB85

Function 00422313 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042231F

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 00422336
__amsg_exit.LIBCMT ref: 00422344
__lock.LIBCMT ref: 00422354

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction ID: ac1e04e8c31356b773b53a495aea9e08dc5a2d3a98daccf88dafce2968103349
Opcode Fuzzy Hash: 2067aca802aea6c84e1c6e0627a9ce2a9215c14d0a893de0c815b7a1e0d9c920
Instruction Fuzzy Hash: D2F09631B00720EBDB60FBB6A50279D73A07F44724F54416FE844AB2D1CBBC9942DA5E

Function 0040272E Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 405COMMON

Download Yara Rule

Strings

;%u, xrefs: 00402A32

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID:
String ID: ;%u
API String ID: 0-535004727
Opcode ID: cfc7ebbd9fd2601b316cdb1ef2982a4c119fdbfeb810569a95eeff81c31aed19
Instruction ID: 268b90de5ef8301e543b0e1450f18e5b796866e9caf2f0e9a7a428077d8a2ebb
Opcode Fuzzy Hash: cfc7ebbd9fd2601b316cdb1ef2982a4c119fdbfeb810569a95eeff81c31aed19
Instruction Fuzzy Hash: ADE114702007445ADB24EF75C699BEE77E5AF40304F04053FE996A72C2DBBCA984CB5A

Function 0040820B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408210

Part of subcall function 00401822: __EH_prolog.LIBCMT ref: 00401827
Part of subcall function 00401822: _memset.LIBCMT ref: 0040196A
Part of subcall function 00401822: _memset.LIBCMT ref: 00401979
Part of subcall function 00401822: _memset.LIBCMT ref: 00401988

Part of subcall function 00401417: __EH_prolog.LIBCMT ref: 0040141C

_wcscpy.LIBCMT ref: 004082AF

Strings

rar, xrefs: 00408262

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: H_prolog_memset$_wcscpy
String ID: rar
API String ID: 2876264062-1792618458
Opcode ID: df481757314c625f03e0d64007fa51f0ba59a3fe21eb1f952cf43b257384ef2c
Instruction ID: 75000dcce843433d4275637ef0618472c828e59e125cdaf0ff5f97d994d1ab7f
Opcode Fuzzy Hash: df481757314c625f03e0d64007fa51f0ba59a3fe21eb1f952cf43b257384ef2c
Instruction Fuzzy Hash: 3D41A4319002589EDB24DB50C955BEA77B8AB14304F4448FFE489B3182DB796FC8CB29

Function 00411254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,004111DD,?,00000000,?), ref: 00411278
SetThreadPriority.KERNEL32(?,00000000,?,?,004112E4,-00000108,00404FE0), ref: 004112BF

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

CreateThread failed, xrefs: 00411284

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction ID: 964536ca15170dd961cb9332306e5bd8003a90b1d1e662a5f33448d65f1dc838
Opcode Fuzzy Hash: 3061c48cbf7df5314d67cb84a6f78a2ab06f9f7c5b99b3b88179035cff10f0ee
Instruction Fuzzy Hash: 4B01A2753453057BD3215F55AC46BB673A9EB44766F20043FFB82E11D0DAB4A8608A2D

Function 0041DEAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A42F
Part of subcall function 0041A429: __getptd.LIBCMT ref: 0041A43F

__getptd.LIBCMT ref: 0041DEBA

Part of subcall function 0041E9B4: __getptd_noexit.LIBCMT ref: 0041E9B7
Part of subcall function 0041E9B4: __amsg_exit.LIBCMT ref: 0041E9C4

__getptd.LIBCMT ref: 0041DEC8

Strings

csm, xrefs: 0041DED6

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction ID: 7c6b91792d137033b66a9eec197cc920f164d7126653d302a3e0d72df4157e21
Opcode Fuzzy Hash: 2d55cb122b51988d1cc7e6481490fc99cbdc11bcbdbc1298bbf42470784b3229
Instruction Fuzzy Hash: 040162B5C013148ACF389F25D444AEEB3B6AF14315F24441FE44156791DB38DED1DB49

Function 00410EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,0041106E,?), ref: 00410EA6
GetLastError.KERNEL32(?), ref: 00410EB2

Part of subcall function 00406423: __vswprintf_c_l.LIBCMT ref: 00406441

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00410EBB

Memory Dump Source

Source File: 0000000B.00000002.1645946666.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1645914303.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1645986133.000000000042A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.0000000000430000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646018342.000000000044F000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.1646076927.0000000000452000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_tasksche.jbxd

Yara matches

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction ID: 79dccacb4fa0009262a18c3e3c709d5502c54047c68cfd859e09497cac206ec9
Opcode Fuzzy Hash: ac3bcd71a64bb110093b5bec46156cf20680403487952e12d0601c5134127ac2
Instruction Fuzzy Hash: 13D0C23260402037C5013B245C05EAE36116B11331BA00722F831602F1CB6909A2429F

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ruXU7wj3X9.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tasksche.exe_67e7eb82189942524dcddca9cff151bf703b53fe_5f6e30d1_6d9fd5b3-2b52-4574-9c7c-6c700609d9ed\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER734C.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74A4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74F2.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER74F4.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7570.tmp.txt

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\mssecsvr.exe

Windows Analysis Report
ruXU7wj3X9.dll

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre