Edit tour

Windows Analysis Report
542CxvZnI5.dll

Overview

General Information

Sample name:	542CxvZnI5.dll renamed because original name is a hash value
Original sample name:	be3c1ef872e8e146ff78e66271ca261b.dll
Analysis ID:	1591515
MD5:	be3c1ef872e8e146ff78e66271ca261b
SHA1:	0e3c7374332d4a507fdbd7b30f5f78d7a4fbafcc
SHA256:	f63eb4858e66889e8b62e6e72fe5d5620995c3fccaa8cd23043c22ddb3c6aa02
Tags:	dllexeuser-mentality
Infos:

Detection

Virut, Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Virut

Yara detected Wannacry ransomware

AI detected suspicious sample

Changes memory attributes in foreign processes to executable or writable

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may execute only at specific dates)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file has a writeable .text section

Tries to evade debugger and weak emulator (self modifying code)

Tries to resolve many domain names, but no domain seems valid

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4524 cmdline: loaddll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2640 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 5980 cmdline: rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 6392 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 433720564D376A59C4FC3F2F8ACEC030)

winlogon.exe (PID: 564 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 640 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 752 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

fontdrvhost.exe (PID: 780 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

fontdrvhost.exe (PID: 788 cmdline: "fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)

svchost.exe (PID: 872 cmdline: C:\Windows\system32\svchost.exe -k RPCSS -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 924 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 992 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 1188 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1416 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1460 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1660 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1700 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1820 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1936 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1952 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

rundll32.exe (PID: 2680 cmdline: rundll32.exe C:\Users\user\Desktop\542CxvZnI5.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 2504 cmdline: rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvc.exe (PID: 1536 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 433720564D376A59C4FC3F2F8ACEC030)

mssecsvc.exe (PID: 6572 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 433720564D376A59C4FC3F2F8ACEC030)

svchost.exe (PID: 444 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 732 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 280 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1032 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1056 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1068 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1148 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1232 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1324 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1384 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1424 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1612 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1688 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1836 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1944 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2024 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Virut		No Attribution	https://blog.malwarebytes.com/threat-analysis/2018/03/blast-from-the-past-stowaway-virut-delivered-with-chinese-ddos-bot/ https://chrisdietri.ch/post/virut-resurrects/ https://krebsonsecurity.com/2013/01/polish-takedown-targets-virut-botnet/ https://securelist.com/review-of-the-virus-win32-virut-ce-malware-sample/36305/ https://www.mandiant.com/resources/pe-file-infecting-malware-ot	https://malpedia.caad.fkie.fraunhofer.de/details/win.virut

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
542CxvZnI5.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
542CxvZnI5.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x38f735:$x2: taskdl.exe 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x3028:$x7: mssecsvc.exe 0x120ac:$x7: mssecsvc.exe 0x1b3b4:$x7: mssecsvc.exe 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x38fe99:$s2: Windows 10 --> 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x38f307:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$
542CxvZnI5.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
C:\Windows\tasksche.exe	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
C:\Windows\mssecsvc.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\mssecsvc.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0xe048:$x7: mssecsvc.exe 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0xe034:$s1: C:\%s\%s 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
C:\Windows\mssecsvc.exe	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
C:\Windows\mssecsvc.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000000.2241048704.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000023.00000002.3405944268.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000010.00000000.2185024353.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000027.00000002.3406467423.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001B.00000000.2236151257.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001E.00000002.3402432003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000019.00000002.3400704837.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000007.00000002.3402551905.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000A.00000002.3493795280.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000026.00000002.3402824272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000D.00000000.2179195689.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000027.00000002.3405187204.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000021.00000002.3404348411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000029.00000000.2276062758.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000010.00000002.2367251245.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
0000001A.00000000.2228632401.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000D.00000002.3400994676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001C.00000002.3403893417.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000013.00000002.3400697506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000A.00000002.3402819580.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000017.00000002.3400997195.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000020.00000002.3405291179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000028.00000000.2275357508.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000020.00000000.2254076183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000029.00000002.3402235476.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001E.00000000.2248711553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000016.00000000.2202870396.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000E.00000002.3403338621.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000013.00000002.3400562813.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000B.00000000.2174451067.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000012.00000002.3402282133.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000028.00000002.3406751993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001E.00000002.3401875690.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000025.00000002.3406217056.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000015.00000002.3403522882.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000017.00000002.3400698716.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000012.00000000.2190133611.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000008.00000002.3403585451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000025.00000000.2264447813.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000C.00000002.3403150697.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000022.00000000.2258234045.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000018.00000002.3400695649.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000029.00000002.3402829287.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000011.00000002.3006271461.000000007FE40000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000024.00000002.3402001391.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000002.2367955469.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000020.00000002.3404111410.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000000.2155806207.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000014.00000000.2196070682.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000015.00000000.2198977925.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000C.00000002.3403935827.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000021.00000002.3405677404.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000014.00000002.3403105922.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000E.00000000.2181731693.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000017.00000000.2205891354.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000026.00000000.2267954326.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000015.00000002.3404464062.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000024.00000000.2262953528.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000022.00000002.3404477534.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000028.00000002.3405487489.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000016.00000002.3404523967.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000018.00000000.2223034706.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000A.00000000.2172969564.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000002.2372011334.000000007FE40000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000019.00000000.2223988543.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000007.00000002.3403262644.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001B.00000002.3401002112.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000009.00000002.3402992756.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001D.00000002.3402243073.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000025.00000002.3404889708.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001B.00000002.3400703981.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000B.00000002.3402735400.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000011.00000002.2980597130.0000000000A73000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000009.00000002.3403852852.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001D.00000000.2247232722.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000B.00000002.3493788665.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000D.00000002.3400610797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001D.00000002.3401707801.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000012.00000002.3402842670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000027.00000000.2271192362.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000023.00000000.2259095161.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000011.00000002.2979906966.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000024.00000002.3402662179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000019.00000002.3401117945.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001C.00000002.3404976335.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001F.00000002.3401714846.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000008.00000002.3402846585.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000026.00000002.3402229166.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000022.00000002.3405775251.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001A.00000002.3403667247.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000018.00000002.3401226137.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000013.00000000.2193268117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000C.00000000.2175662143.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000000E.00000002.3493625570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000007.00000000.2157612272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000014.00000002.3402428958.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000016.00000002.3403542982.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001A.00000002.3404729920.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000023.00000002.3404573979.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001F.00000002.3402354767.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
0000001F.00000000.2253051631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000021.00000000.2256281044.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000008.00000000.2159244338.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000009.00000000.2162403933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_Virut	Yara detected Virut	Joe Security
00000011.00000000.2188065513.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvc.exe PID: 6392	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 6392	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: winlogon.exe PID: 564	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: lsass.exe PID: 640	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 752	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: fontdrvhost.exe PID: 780	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: fontdrvhost.exe PID: 788	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 872	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 924	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: dwm.exe PID: 992	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: mssecsvc.exe PID: 1536	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 1536	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: mssecsvc.exe PID: 6572	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvc.exe PID: 6572	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 444	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 732	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 280	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1032	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1056	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1068	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1148	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1188	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1232	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1324	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1384	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1416	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1424	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1460	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1612	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1660	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1688	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1700	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1820	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1836	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1936	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1944	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 1952	JoeSecurity_Virut	Yara detected Virut	Joe Security
Process Memory Space: svchost.exe PID: 2024	JoeSecurity_Virut	Yara detected Virut	Joe Security
Click to see the 159 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.mssecsvc.exe.1f91084.3.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
17.2.mssecsvc.exe.24b48c8.6.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
5.2.mssecsvc.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.2.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvc.exe.7100a4.1.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
5.2.mssecsvc.exe.7100a4.1.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.2.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvc.exe.7100a4.1.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.7100a4.1.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
16.0.mssecsvc.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
16.0.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
16.0.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
16.0.mssecsvc.exe.7100a4.1.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
16.0.mssecsvc.exe.7100a4.1.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
16.0.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
16.0.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
16.0.mssecsvc.exe.7100a4.1.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.1fc3128.5.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.1fc3128.5.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.1fc3128.5.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.1fc3128.5.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
16.2.mssecsvc.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
16.2.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
16.2.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
16.2.mssecsvc.exe.7100a4.1.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.24e696c.9.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.24e696c.9.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.24e696c.9.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.24e696c.9.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.0.mssecsvc.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.0.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.0.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.0.mssecsvc.exe.7100a4.1.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.24c3948.7.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.24c3948.7.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x32520:$x1: icacls . /grant Everyone:F /T /C /Q 0x37c651:$x2: taskdl.exe 0x222ec:$x3: tasksche.exe 0x324fc:$x3: tasksche.exe 0x324d8:$x4: Global\MsWinZonesCacheCounterMutexA 0x32550:$x5: WNcry@2ol7 0x82d0:$x7: mssecsvc.exe 0x222c4:$x8: C:\%s\qeriuwjhrf 0x32520:$x9: icacls . /grant Everyone:F /T /C /Q 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x37cdb5:$s2: Windows 10 --> 0x32450:$s3: cmd.exe /c "%s" 0x649a4:$s4: msg/m_portuguese.wnry 0x37c223:$s4: msg/m_portuguese.wnry 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$ 0x25a26:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x25700:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x252ec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.24c3948.7.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
17.2.mssecsvc.exe.24c3948.7.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x324fc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32524:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Virut	Yara detected Virut	Joe Security
17.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
17.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
17.2.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.0.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
17.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
17.0.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.7100a4.1.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.7100a4.1.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.24b48c8.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.24b48c8.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xad6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0xade35:$s2: Windows 10 --> 0xad2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
17.2.mssecsvc.exe.24b48c8.6.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
16.0.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
16.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
16.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
16.0.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvc.exe.7100a4.1.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.0.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvc.exe.7100a4.1.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.0.mssecsvc.exe.7100a4.1.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.0.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.0.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.0.mssecsvc.exe.7100a4.1.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.24e696c.9.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.24e696c.9.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.24e696c.9.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.24e696c.9.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
17.2.mssecsvc.exe.1fc3128.5.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.1fc3128.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.1fc3128.5.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.1fc3128.5.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
16.2.mssecsvc.exe.7100a4.1.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
16.2.mssecsvc.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
16.2.mssecsvc.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
16.2.mssecsvc.exe.7100a4.1.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
5.0.mssecsvc.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvc.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0x35962d:$x2: taskdl.exe 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0x359d91:$s2: Windows 10 --> 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x3591ff:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.0.mssecsvc.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvc.exe.7100a4.1.raw.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
16.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
16.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
16.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
16.2.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvc.exe.400000.0.unpack	JoeSecurity_Virut	Yara detected Virut	Joe Security
5.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
5.2.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.2.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.1fa0104.4.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.1fa0104.4.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x32520:$x1: icacls . /grant Everyone:F /T /C /Q 0x37c651:$x2: taskdl.exe 0x222ec:$x3: tasksche.exe 0x324fc:$x3: tasksche.exe 0x324d8:$x4: Global\MsWinZonesCacheCounterMutexA 0x32550:$x5: WNcry@2ol7 0x82d0:$x7: mssecsvc.exe 0x222c4:$x8: C:\%s\qeriuwjhrf 0x32520:$x9: icacls . /grant Everyone:F /T /C /Q 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x37cdb5:$s2: Windows 10 --> 0x32450:$s3: cmd.exe /c "%s" 0x649a4:$s4: msg/m_portuguese.wnry 0x37c223:$s4: msg/m_portuguese.wnry 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$ 0x25a26:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x25700:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x252ec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.1fa0104.4.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
17.2.mssecsvc.exe.1fa0104.4.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x324fc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32524:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvc.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x38b6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x38be35:$s2: Windows 10 --> 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x38b2a3:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
5.0.mssecsvc.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvc.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.24bf8e8.8.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.24bf8e8.8.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x36580:$x1: icacls . /grant Everyone:F /T /C /Q 0x3806b1:$x2: taskdl.exe 0x2634c:$x3: tasksche.exe 0x3655c:$x3: tasksche.exe 0x36538:$x4: Global\MsWinZonesCacheCounterMutexA 0x365b0:$x5: WNcry@2ol7 0xc330:$x7: mssecsvc.exe 0x26324:$x8: C:\%s\qeriuwjhrf 0x36580:$x9: icacls . /grant Everyone:F /T /C /Q 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x380e15:$s2: Windows 10 --> 0x364b0:$s3: cmd.exe /c "%s" 0x68a04:$s4: msg/m_portuguese.wnry 0x380283:$s4: msg/m_portuguese.wnry 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$ 0x29a86:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x29760:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x2934c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.24bf8e8.8.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x3655c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x36584:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.1f9c0a4.2.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.1f9c0a4.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x36580:$x1: icacls . /grant Everyone:F /T /C /Q 0x3806b1:$x2: taskdl.exe 0x2634c:$x3: tasksche.exe 0x3655c:$x3: tasksche.exe 0x36538:$x4: Global\MsWinZonesCacheCounterMutexA 0x365b0:$x5: WNcry@2ol7 0xc330:$x7: mssecsvc.exe 0x26324:$x8: C:\%s\qeriuwjhrf 0x36580:$x9: icacls . /grant Everyone:F /T /C /Q 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x380e15:$s2: Windows 10 --> 0x364b0:$s3: cmd.exe /c "%s" 0x68a04:$s4: msg/m_portuguese.wnry 0x380283:$s4: msg/m_portuguese.wnry 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$ 0x29a86:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x29760:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x2934c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.1f9c0a4.2.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x3655c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x36584:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.1f91084.3.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.1f91084.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x286de4:$x1: icacls . /grant Everyone:F /T /C /Q 0xad6d1:$x2: taskdl.exe 0x3136c:$x3: tasksche.exe 0x276bb0:$x3: tasksche.exe 0x286dc0:$x3: tasksche.exe 0x286d9c:$x4: Global\MsWinZonesCacheCounterMutexA 0x286e14:$x5: WNcry@2ol7 0x17350:$x7: mssecsvc.exe 0x24126c:$x7: mssecsvc.exe 0x25cb94:$x7: mssecsvc.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x276b88:$x8: C:\%s\qeriuwjhrf 0x286de4:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x241254:$s1: C:\%s\%s 0x25cb7c:$s1: C:\%s\%s 0x276b9c:$s1: C:\%s\%s 0xade35:$s2: Windows 10 --> 0x286d14:$s3: cmd.exe /c "%s" 0xad2a3:$s4: msg/m_portuguese.wnry
17.2.mssecsvc.exe.1f91084.3.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
17.2.mssecsvc.exe.1f91084.3.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x286dc0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x286de8:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.24c3948.7.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.24c3948.7.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2dd20:$x1: icacls . /grant Everyone:F /T /C /Q 0x377e51:$x2: taskdl.exe 0x1daec:$x3: tasksche.exe 0x2dcfc:$x3: tasksche.exe 0x2dcd8:$x4: Global\MsWinZonesCacheCounterMutexA 0x2dd50:$x5: WNcry@2ol7 0x76d0:$x7: mssecsvc.exe 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x2dd20:$x9: icacls . /grant Everyone:F /T /C /Q 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x3785b5:$s2: Windows 10 --> 0x2dc50:$s3: cmd.exe /c "%s" 0x601a4:$s4: msg/m_portuguese.wnry 0x377a23:$s4: msg/m_portuguese.wnry 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$ 0x21226:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x20f00:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x20aec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
17.2.mssecsvc.exe.24c3948.7.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x2dcfc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x2dd24:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
17.2.mssecsvc.exe.1fa0104.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
17.2.mssecsvc.exe.1fa0104.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2dd20:$x1: icacls . /grant Everyone:F /T /C /Q 0x377e51:$x2: taskdl.exe 0x1daec:$x3: tasksche.exe 0x2dcfc:$x3: tasksche.exe 0x2dcd8:$x4: Global\MsWinZonesCacheCounterMutexA 0x2dd50:$x5: WNcry@2ol7 0x76d0:$x7: mssecsvc.exe 0x50b9ec:$x7: mssecsvc.exe 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x2dd20:$x9: icacls . /grant Everyone:F /T /C /Q 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x50b9d4:$s1: C:\%s\%s 0x3785b5:$s2: Windows 10 --> 0x2dc50:$s3: cmd.exe /c "%s" 0x601a4:$s4: msg/m_portuguese.wnry 0x377a23:$s4: msg/m_portuguese.wnry 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$ 0x21226:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x20f00:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
17.2.mssecsvc.exe.1fa0104.4.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x2dcfc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x2dd24:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 114 entries

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\WINDOWS\mssecsvc.exe, ParentImage: C:\Windows\mssecsvc.exe, ParentProcessId: 6392, ParentProcessName: mssecsvc.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, ProcessId: 752, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: winlogon.exe, CommandLine: winlogon.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\winlogon.exe, NewProcessName: C:\Windows\System32\winlogon.exe, OriginalFileName: C:\Windows\System32\winlogon.exe, ParentCommandLine: C:\WINDOWS\mssecsvc.exe, ParentImage: C:\Windows\mssecsvc.exe, ParentProcessId: 6392, ParentProcessName: mssecsvc.exe, ProcessCommandLine: winlogon.exe, ProcessId: 564, ProcessName: winlogon.exe

Suricata Signatures

ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T02:52:28.619850+0100	2012730	1	A Network Trojan was detected	192.168.2.5	49261	1.1.1.1	53	UDP
2025-01-15T02:53:20.056518+0100	2012730	1	A Network Trojan was detected	192.168.2.5	63298	1.1.1.1	53	UDP

ETPRO MALWARE Possible Virut DGA NXDOMAIN Responses (com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T02:53:28.828299+0100	2811577	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.5	49370	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 542CxvZnI5.dll

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\mssecsvc.exe	Avira: detection malicious, Label: W32/Virut.Gen
Source: C:\Windows\tasksche.exe	Avira: detection malicious, Label: TR/Ransom.Gen

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 92%
Source: C:\Windows\mssecsvc.exe	ReversingLabs: Detection: 95%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: 542CxvZnI5.dll	Virustotal: Detection: 90%			Perma Link
Source: 542CxvZnI5.dll	ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\mssecsvc.exe	Joe Sandbox ML: detected
Source: C:\Windows\tasksche.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 542CxvZnI5.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: 542CxvZnI5.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50300 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50673 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50675 version: TLS 1.2

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223968868.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223968868.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorb source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @ source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp

Source: mssecsvc.exe	Binary or memory string: [autorun] open=
Source: mssecsvc.exe, 00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: [autorun]
Source: mssecsvc.exe, 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: mssecsvc.exe, 00000005.00000002.2372011334.000000007FE40000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: winlogon.exe, 00000007.00000002.3402551905.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: winlogon.exe, 00000007.00000002.3403262644.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: winlogon.exe, 00000007.00000000.2157612272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: lsass.exe, 00000008.00000002.3403585451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: lsass.exe, 00000008.00000002.3402846585.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: lsass.exe, 00000008.00000000.2159244338.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000009.00000002.3402992756.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000009.00000002.3403852852.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000009.00000000.2162403933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: fontdrvhost.exe, 0000000A.00000002.3493795280.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: fontdrvhost.exe, 0000000A.00000002.3402819580.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: fontdrvhost.exe, 0000000A.00000000.2172969564.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: fontdrvhost.exe, 0000000B.00000000.2174451067.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: fontdrvhost.exe, 0000000B.00000002.3402735400.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: fontdrvhost.exe, 0000000B.00000002.3493788665.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000000C.00000002.3403150697.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000000C.00000002.3403935827.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000000C.00000000.2175662143.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000000D.00000000.2179195689.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000000D.00000002.3400994676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000000D.00000002.3400610797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: dwm.exe, 0000000E.00000002.3403338621.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: dwm.exe, 0000000E.00000000.2181731693.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: dwm.exe, 0000000E.00000002.3493625570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: mssecsvc.exe	Binary or memory string: [autorun] open=
Source: mssecsvc.exe, 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: mssecsvc.exe	Binary or memory string: [autorun] open=
Source: mssecsvc.exe, 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: mssecsvc.exe, 00000011.00000002.2980597130.0000000000A73000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000012.00000002.3402282133.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000012.00000000.2190133611.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000012.00000002.3402842670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000013.00000002.3400697506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000013.00000002.3400562813.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000013.00000000.2193268117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000014.00000000.2196070682.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000014.00000002.3403105922.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000014.00000002.3402428958.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000015.00000002.3403522882.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000015.00000000.2198977925.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000015.00000002.3404464062.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000016.00000000.2202870396.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000016.00000002.3404523967.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000016.00000002.3403542982.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000017.00000002.3400997195.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000017.00000002.3400698716.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000017.00000000.2205891354.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000018.00000002.3400695649.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000018.00000000.2223034706.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000018.00000002.3401226137.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000019.00000002.3400704837.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000019.00000000.2223988543.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000019.00000002.3401117945.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001A.00000000.2228632401.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001A.00000002.3403667247.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001A.00000002.3404729920.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001B.00000000.2236151257.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001B.00000002.3401002112.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001B.00000002.3400703981.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001C.00000000.2241048704.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001C.00000002.3403893417.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001C.00000002.3404976335.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001D.00000002.3402243073.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001D.00000000.2247232722.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001D.00000002.3401707801.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001E.00000002.3402432003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001E.00000000.2248711553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001E.00000002.3401875690.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001F.00000002.3401714846.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001F.00000002.3402354767.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 0000001F.00000000.2253051631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000020.00000002.3405291179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000020.00000000.2254076183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000020.00000002.3404111410.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000021.00000002.3404348411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000021.00000002.3405677404.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000021.00000000.2256281044.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000022.00000000.2258234045.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000022.00000002.3404477534.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000022.00000002.3405775251.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000023.00000002.3405944268.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000023.00000000.2259095161.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000023.00000002.3404573979.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000024.00000002.3402001391.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000024.00000000.2262953528.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000024.00000002.3402662179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000025.00000002.3406217056.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000025.00000000.2264447813.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000025.00000002.3404889708.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000026.00000002.3402824272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000026.00000000.2267954326.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000026.00000002.3402229166.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000027.00000002.3406467423.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000027.00000002.3405187204.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000027.00000000.2271192362.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000028.00000000.2275357508.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000028.00000002.3406751993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000028.00000002.3405487489.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000029.00000002.3428342703.000001C781E40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\Autorun.infAutoRun.Amd64
Source: svchost.exe, 00000029.00000000.2276062758.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000029.00000002.3402235476.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000029.00000000.2277334412.000001C781E40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\Autorun.infAutoRun.Amd64
Source: svchost.exe, 00000029.00000002.3402829287.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000029.00000002.3420547422.000001C781D70000.00000004.00000020.00040000.00000000.sdmp	Binary or memory string: Autorun.inf

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2012730 - Severity 1 - ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup : 192.168.2.5:49261 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2012730 - Severity 1 - ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup : 192.168.2.5:63298 -> 1.1.1.1:53

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: urxxuf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ngemix.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqegva.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xzgrlj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ant.trenz.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: oacbaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: slnmhg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pojfeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ilo.brenz.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: asjuen.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqpzuo.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rxexyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ebohzv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: toexkd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eijfjn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiurmh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vttzwu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yscyez.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xdzsqn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: poqxaa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ezaeqf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lepdbj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ersgvh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imdznk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: remieu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fxumem.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfguna.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abyeya.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bjeako.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oaqqkf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkuzud.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dkrbtp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akzoeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uteyyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: voydqz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ogoeuu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkkvba.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kiieiy.com replaycode: Name error (3)

Source: unknown

Network traffic detected: IP country count 10

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2811577 - Severity 1 - ETPRO MALWARE Possible Virut DGA NXDOMAIN Responses (com) : 1.1.1.1:53 -> 192.168.2.5:49370

Source: unknown	DNS traffic detected: query: urxxuf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ngemix.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqegva.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xzgrlj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ant.trenz.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: oacbaq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: slnmhg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pojfeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ilo.brenz.pl replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: asjuen.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqpzuo.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rxexyq.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ebohzv.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: toexkd.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eijfjn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiurmh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vttzwu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yscyez.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xdzsqn.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: poqxaa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ezaeqf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lepdbj.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ersgvh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: imdznk.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: remieu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fxumem.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfguna.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abyeya.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bjeako.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oaqqkf.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkuzud.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dkrbtp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akzoeg.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uteyyp.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: voydqz.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ogoeuu.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkkvba.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kiieiy.com replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00AD27A1 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,

5_2_00AD27A1

Source: lsass.exe, 00000008.00000000.2160835567.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3460531405.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://3csp.icrosof4m/ocp0
Source: Microsoft-Windows-LiveId%4Operational.evtx.25.dr	String found in binary or memory: http://Passport.NET/tb
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 00000008.00000000.2160748939.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3456869482.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD866000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD866000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000008.00000000.2160748939.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3456869482.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000008.00000000.2160748939.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3456869482.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: lsass.exe, 00000008.00000000.2160158196.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3439187607.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000008.00000000.2160158196.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3439187607.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000008.00000002.3435170210.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD866000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160748939.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3456869482.00000140AE05A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 00000008.00000000.2160835567.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161066795.00000140AE19A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3465840345.00000140AE19D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 0000001A.00000000.2232869398.000001A204EE0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3435170210.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000008.00000000.2161179424.00000140AE203000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3471111449.00000140AE21C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161179424.00000140AE21B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1AB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160697715.00000140AE000000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2161084952.00000140AE1B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 00000022.00000000.2260193179.000001E709ED9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com
Source: svchost.exe, 00000009.00000000.2170070690.000001A78716B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://az804205.vo.msecnd.net/
Source: svchost.exe, 00000009.00000000.2170070690.000001A78716B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://az815563.vo.msecnd.net/
Source: svchost.exe, 00000009.00000002.3482183875.000001A786A3D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3487132793.000001A786B00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2166233180.000001A786A3D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2166701119.000001A786B00000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.onenote.net/livetile/?Language=
Source: svchost.exe, 00000009.00000002.3458096495.000001A78602A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2163338253.000001A78602A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.cn/shellRESP
Source: svchost.exe, 00000009.00000002.3458096495.000001A78602A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2163338253.000001A78602A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com/shell

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50674
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50675
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50402
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 50300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50300 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50320 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50475 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50673 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.5:50675 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: 542CxvZnI5.dll, type: SAMPLE
Source: Yara match	File source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.24b48c8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.24bf8e8.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.1f9c0a4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.24c3948.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mssecsvc.exe.1fa0104.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000000.2185024353.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2367251245.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2367955469.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2155806207.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2979906966.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.2188065513.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6572, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\mssecsvc.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 542CxvZnI5.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 542CxvZnI5.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1f91084.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24b48c8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.24b48c8.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24b48c8.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.24bf8e8.8.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24bf8e8.8.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1f9c0a4.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.1f9c0a4.2.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.24c3948.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.24c3948.7.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 17.2.mssecsvc.exe.1fa0104.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 17.2.mssecsvc.exe.1fa0104.4.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team

PE file has a writeable .text section

Source: mssecsvc.exe.3.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00A7302F NtSetInformationProcess,	5_2_00A7302F
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CloseHandle,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	5_2_00AD05F2
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	5_2_00AD042D
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD2529 NtOpenSection,	5_2_00AD2529
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD256E NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	5_2_00AD256E
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD1169 LoadLibraryA,GetModuleHandleA,CreateFileMappingA,LookupPrivilegeValueA,NtAdjustPrivilegesToken,	5_2_00AD1169
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD2471 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	5_2_00AD2471
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD24A8 lstrcpyW,lstrlenW,NtCreateSection,	5_2_00AD24A8
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD3397 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	5_2_00AD3397
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD141C LookupPrivilegeValueA,NtAdjustPrivilegesToken,	5_2_00AD141C
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD3372 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	5_2_00AD3372
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD1444 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	5_2_00AD1444
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE305F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	5_2_7FE305F2
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE324A8 lstrcpyW,lstrlenW,NtCreateSection,	5_2_7FE324A8
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE33397 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	5_2_7FE33397
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE3256E NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	5_2_7FE3256E
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE33372 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	5_2_7FE33372
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE32471 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	5_2_7FE32471
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE31444 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	5_2_7FE31444
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE32529 NtOpenSection,	5_2_7FE32529
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE3042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	5_2_7FE3042D
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE3141C LookupPrivilegeValueA,NtAdjustPrivilegesToken,	5_2_7FE3141C
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE405F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	16_2_7FE405F2
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE424A8 lstrcpyW,lstrlenW,NtCreateSection,	16_2_7FE424A8
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE43397 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	16_2_7FE43397
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE4256E NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	16_2_7FE4256E
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE42471 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	16_2_7FE42471
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE43372 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	16_2_7FE43372
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE41444 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	16_2_7FE41444
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE4042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	16_2_7FE4042D
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE42529 NtOpenSection,	16_2_7FE42529
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE4141C LookupPrivilegeValueA,NtAdjustPrivilegesToken,	16_2_7FE4141C
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00A7302F NtSetInformationProcess,	17_2_00A7302F
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CloseHandle,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	17_2_00BF05F2
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	17_2_00BF042D
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF2529 NtOpenSection,	17_2_00BF2529
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF2471 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	17_2_00BF2471
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF256E NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	17_2_00BF256E
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF1169 LoadLibraryA,GetModuleHandleA,CreateFileMappingA,LookupPrivilegeValueA,NtAdjustPrivilegesToken,	17_2_00BF1169
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF24A8 lstrcpyW,lstrlenW,NtCreateSection,	17_2_00BF24A8
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF3397 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	17_2_00BF3397
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF141C LookupPrivilegeValueA,NtAdjustPrivilegesToken,	17_2_00BF141C
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF3372 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	17_2_00BF3372
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF1444 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	17_2_00BF1444

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior

Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD1169	5_2_00AD1169
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD28C2	5_2_00AD28C2
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE328C2	5_2_7FE328C2
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE34BD7	5_2_7FE34BD7
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE428C2	16_2_7FE428C2
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE44BD7	16_2_7FE44BD7
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF1169	17_2_00BF1169
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF28C2	17_2_00BF28C2

Source: Joe Sandbox View	Dropped File: C:\WINDOWS\qeriuwjhrf (copy) 331E14A6594B700B6167690430C9DA72FEE72D408DD1B8C5CB155C0199033D0A
Source: Joe Sandbox View	Dropped File: C:\Windows\tasksche.exe 331E14A6594B700B6167690430C9DA72FEE72D408DD1B8C5CB155C0199033D0A

Source: mssecsvc.exe.3.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: tasksche.exe.5.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate

Source: 542CxvZnI5.dll	Binary or memory string: OriginalFilenamediskpart.exej% vs 542CxvZnI5.dll
Source: 542CxvZnI5.dll	Binary or memory string: OriginalFilenamelhdfrgui.exej% vs 542CxvZnI5.dll

Source: 542CxvZnI5.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: 542CxvZnI5.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 542CxvZnI5.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1f91084.3.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24b48c8.6.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1fc3128.5.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.24e696c.9.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 17.2.mssecsvc.exe.24c3948.7.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 17.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.24b48c8.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24b48c8.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.24e696c.9.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1fc3128.5.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 17.2.mssecsvc.exe.1fa0104.4.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.24bf8e8.8.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24bf8e8.8.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1f9c0a4.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.1f9c0a4.2.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 17.2.mssecsvc.exe.1f91084.3.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.24c3948.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.24c3948.7.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 17.2.mssecsvc.exe.1fa0104.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 17.2.mssecsvc.exe.1fa0104.4.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: C:\Windows\mssecsvc.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set

Source: tasksche.exe.5.dr	Binary string: h\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\MOP030B\American McGee's Alice
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\03edc404e68b95b7e0b07a0416c8e4a7\System.Transactions.ni.dll.auxthp
Source: tasksche.exe.5.dr	Binary string: `\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Image ViewerD
Source: tasksche.exe.5.dr	Binary string: I\Device\HarddiskVolume1\Program Files\Microsoft Office\Office14\EXCEL.EXEp
Source: tasksche.exe.5.dr	Binary string: {\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.inihip
Source: tasksche.exe.5.dr	Binary string: >\Device\HarddiskVolume1\Program Files\TrueKey\TrueKeyVault.dllty
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\ksuser.dllorp
Source: tasksche.exe.5.dr	Binary string: w\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Harry Potter and the Deathly Hallows - Part 1p
Source: tasksche.exe.5.dr	Binary string: e\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndexp
Source: tasksche.exe.5.dr	Binary string: K\Device\HarddiskVolume1\Program Files\Microsoft Office\Office14\WINWORD.EXEd-p
Source: tasksche.exe.5.dr	Binary string: 2\Device\HarddiskVolume1\Windows\System32\wbem\Logsthip
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wsbep
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.widlp
Source: tasksche.exe.5.dr	Binary string: 8\Device\HarddiskVolume1\Program Files\TrueKey\thrift.dllop
Source: tasksche.exe.5.dr	Binary string: y\Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8#\33056cb1c9e7cf51ee0a4168997f0db4p
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\fa881a9dd9820b29ec20e9d90c6a0d99\CustomMarshalers.ni.dll.auxp
Source: Security.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: tasksche.exe.5.dr	Binary string: S\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll\|\|p
Source: tasksche.exe.5.dr	Binary string: :\Device\HarddiskVolume1\Windows\System32\config\COMPONENTSxyz
Source: tasksche.exe.5.dr	Binary string: V\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edbbrep
Source: tasksche.exe.5.dr	Binary string: _\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yandex
Source: tasksche.exe.5.dr	Binary string: K\Device\HarddiskVolume1\Windows\System32\config\systemprofile\AppData\Localtyp
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\msidle.dllarp
Source: tasksche.exe.5.dr	Binary string: L\Device\HarddiskVolume1\Program Files\TrueKey\providers\deviceIDProvider.dll.p
Source: tasksche.exe.5.dr	Binary string: h\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Skachat Torrent
Source: tasksche.exe.5.dr	Binary string: X\Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#ep
Source: tasksche.exe.5.dr	Binary string: N\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllt^$p
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\cf330aa5c9f2a48448933edac5333406\System.DirectoryServices.ni.dll.auxp
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\QAGENT.DLLEtp
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\scrrun.dll@
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: \Device\NetbiosSmb
Source: tasksche.exe.5.dr	Binary string: <\Device\HarddiskVolume1\Windows\System32\ru-RU\tzres.dll.muiap
Source: tasksche.exe.5.dr	Binary string: x\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.001pF
Source: tasksche.exe.5.dr	Binary string: r\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\/
Source: tasksche.exe.5.dr	Binary string: 8\Device\HarddiskVolume1\Windows\System32\mfreadwrite.dll.p
Source: tasksche.exe.5.dr	Binary string: _\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\/
Source: tasksche.exe.5.dr	Binary string: l\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\|.
Source: tasksche.exe.5.dr	Binary string: E\Device\HarddiskVolume1\Program Files\TrueKey\logs\Log.2017-05-12.logp
Source: System.evtx.25.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4eb
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dllnksp
Source: tasksche.exe.5.dr	Binary string: S\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\PotPlayer
Source: tasksche.exe.5.dr	Binary string: F\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applicationspar
Source: tasksche.exe.5.dr	Binary string: 2\Device\HarddiskVolume1\Windows\System32\adsnt.dll.cop
Source: tasksche.exe.5.dr	Binary string: G\Device\HarddiskVolume1\ProgramData\Bluestacks\Logs\BlueStacksUsers.log.np
Source: tasksche.exe.5.dr	Binary string: Q\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\MOP030B&
Source: tasksche.exe.5.dr	Binary string: l\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStoreu.
Source: tasksche.exe.5.dr	Binary string: L\Device\HarddiskVolume1\Program Files\Microsoft Office\Office14\POWERPNT.EXEk
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\mfplat.dllmgp
Source: tasksche.exe.5.dr	Binary string: K\Device\HarddiskVolume1\Users\User\AppData\Local\Yandex\BrowserManager\datay
Source: tasksche.exe.5.dr	Binary string: p\Device\HarddiskVolume1\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtxp
Source: tasksche.exe.5.dr	Binary string: e\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Suicide Squad - Special OpsN
Source: tasksche.exe.5.dr	Binary string: 5\Device\HarddiskVolume1\Windows\System32\rundll32.exep
Source: tasksche.exe.5.dr	Binary string: c\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex^$,
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.25.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeH**
Source: tasksche.exe.5.dr	Binary string: P\Device\HarddiskVolume1\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dllap
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\cc649e0f5426f48bb9361c159b8e707f\System.Data.ni.dll.aux
Source: tasksche.exe.5.dr	Binary string: V\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chkann
Source: tasksche.exe.5.dr	Binary string: W\Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactionsro\|
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dllhp
Source: tasksche.exe.5.dr	Binary string: ?\Device\HarddiskVolume1\Windows\System32\ru-RU\WUDFHost.exe.mui
Source: tasksche.exe.5.dr	Binary string: ?\Device\HarddiskVolume1\Windows\System32\config\COMPONENTS.LOG1
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\03edc404e68b95b7e0b07a0416c8e4a7\System.Transactions.ni.dlldi
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.ciy
Source: Security.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sysame
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: tasksche.exe.5.dr	Binary string: O\Device\HarddiskVolume1\Program Files\NVIDIA Corporation\Display\nvsmartmax.dll^$p
Source: tasksche.exe.5.dr	Binary string: _\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.25.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: tasksche.exe.5.dr	Binary string: T\Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalersep
Source: tasksche.exe.5.dr	Binary string: p\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\StarGame\Alice.Madness Returns + 2 DLCp
Source: tasksche.exe.5.dr	Binary string: y\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnkp
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: tasksche.exe.5.dr	Binary string: L\Device\HarddiskVolume1\Program Files\TrueKey\providers\LocationProvider.dllph
Source: System.evtx.25.dr	Binary string: C:\Device\HarddiskVolume3
Source: tasksche.exe.5.dr	Binary string: ?\Device\HarddiskVolume1\Windows\System32\drivers\UMDF\WpdFs.dll
Source: tasksche.exe.5.dr	Binary string: z\Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\System.Xaml.dllU+
Source: tasksche.exe.5.dr	Binary string: S\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\wbem\ru-RU
Source: tasksche.exe.5.dr	Binary string: l\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStoren.
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dllcp
Source: tasksche.exe.5.dr	Binary string: O\Device\HarddiskVolume1\Users\User\AppData\Local\Yandex\BrowserManager\settingsrd
Source: tasksche.exe.5.dr	Binary string: W\Device\HarddiskVolume1\Program Files\Alice.Madness Returns + 2 DLC\GDFBinary.en-us.dll.cp
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.dir-p
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.25.dr	Binary string: :\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.25.dr	Binary string: 9\Device\HarddiskVolume3\Windows\SysWOW64\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\netman.dllhip
Source: tasksche.exe.5.dr	Binary string: l\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStoreeH
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dllp
Source: tasksche.exe.5.dr	Binary string: X\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.25.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: tasksche.exe.5.dr	Binary string: _\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AIDA64@
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dllap
Source: tasksche.exe.5.dr	Binary string: O\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dllsitp
Source: tasksche.exe.5.dr	Binary string: 5\Device\HarddiskVolume1\Windows\System32\bthprops.cplp
Source: tasksche.exe.5.dr	Binary string: x\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000rp
Source: tasksche.exe.5.dr	Binary string: y\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.002H
Source: tasksche.exe.5.dr	Binary string: R\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\StarGame
Source: tasksche.exe.5.dr	Binary string: ?\Device\HarddiskVolume1\Windows\System32\config\COMPONENTS.LOG2.cp
Source: tasksche.exe.5.dr	Binary string: E\Device\HarddiskVolume1\Program Files\Bluestacks\HD-Logger-Native.dllp
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: A\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe
Source: tasksche.exe.5.dr	Binary string: Q\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\MOP030Bp
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\37523c98ca4b37b2a6d189294e443202\System.Runtime.Serialization.ni.dllp
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\37523c98ca4b37b2a6d189294e443202\System.Runtime.Serialization.ni.dll.auxp
Source: tasksche.exe.5.dr	Binary string: y\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.001p
Source: tasksche.exe.5.dr	Binary string: k\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMaptyp
Source: tasksche.exe.5.dr	Binary string: l\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStoreg.
Source: tasksche.exe.5.dr	Binary string: H\Device\HarddiskVolume1\Program Files\TrueKey\providers\faceProvider.dllsp
Source: tasksche.exe.5.dr	Binary string: ^\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
Source: tasksche.exe.5.dr	Binary string: R\Device\HarddiskVolume1\Users\User\AppData\Local\Yandex\BrowserManager\Logs\bm.logparp
Source: tasksche.exe.5.dr	Binary string: q\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenup
Source: tasksche.exe.5.dr	Binary string: Q\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 11p
Source: tasksche.exe.5.dr	Binary string: T\Device\HarddiskVolume1\Users\User\AppData\Local\Yandex\BrowserManager\data\settingscp
Source: tasksche.exe.5.dr	Binary string: D\Device\HarddiskVolume1\Windows\assembly\GAC_MSIL\mscorlib.resourcesgp
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\tquery.dlllep
Source: tasksche.exe.5.dr	Binary string: V\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edbfirp
Source: tasksche.exe.5.dr	Binary string: \|\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts8
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.18766_none_0b32a93025b365c1\wcp.dllp
Source: tasksche.exe.5.dr	Binary string: y\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.001H
Source: System.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exep
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\FXSAPI.dllcop
Source: tasksche.exe.5.dr	Binary string: 7\Device\HarddiskVolume1\Windows\System32\CertEnroll.dllarp
Source: tasksche.exe.5.dr	Binary string: Y\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogsp
Source: tasksche.exe.5.dr	Binary string: /\Device\HarddiskVolume1\Windows\System32\mf.dlly
Source: tasksche.exe.5.dr	Binary string: c\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
Source: tasksche.exe.5.dr	Binary string: 2\Device\HarddiskVolume1\Windows\System32\wshom.ocx
Source: tasksche.exe.5.dr	Binary string: 6\Device\HarddiskVolume1\Windows\System32\srchadmin.dll
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.25.dr	Binary string: 1\Device\HarddiskVolume3\Windows\System32\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: tasksche.exe.5.dr	Binary string: 4\Device\HarddiskVolume1\Windows\System32\WMVCORE.DLLip
Source: tasksche.exe.5.dr	Binary string: G\Device\HarddiskVolume1\Program Files\Windows Media Player\wmpnssci.dll
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\cc649e0f5426f48bb9361c159b8e707f\System.Data.ni.dll0
Source: tasksche.exe.5.dr	Binary string: 4\Device\HarddiskVolume1\Windows\servicing\CbsMsg.dllp
Source: tasksche.exe.5.dr	Binary string: x\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002xp
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.dirmp
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\rasdlg.dllinp
Source: tasksche.exe.5.dr	Binary string: S\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\PotPlayer@
Source: tasksche.exe.5.dr	Binary string: 7\Device\HarddiskVolume1\Windows\System32\CertEnroll.dllku
Source: tasksche.exe.5.dr	Binary string: 9\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Datap
Source: tasksche.exe.5.dr	Binary string: G\Device\HarddiskVolume1\ProgramData\NVIDIA Corporation\Drs\nvdrsdb1.binlip
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Ease of Access.lnkp
Source: tasksche.exe.5.dr	Binary string: m\Device\HarddiskVolume1\Windows\Microsoft.NET\Framework\v4.0.30319\WorkflowServiceHostPerformanceCounters.dllp
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\cf330aa5c9f2a48448933edac5333406\System.DirectoryServices.ni.dll
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\fa881a9dd9820b29ec20e9d90c6a0d99\CustomMarshalers.ni.dllx
Source: tasksche.exe.5.dr	Binary string: 7\Device\HarddiskVolume1\Windows\System32\CertEnroll.dllco
Source: tasksche.exe.5.dr	Binary string: H\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Temp\usgthrsvcrp
Source: tasksche.exe.5.dr	Binary string: y\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000H
Source: tasksche.exe.5.dr	Binary string: :\Device\HarddiskVolume1\Windows\System32\wbem\cimwin32.dll
Source: tasksche.exe.5.dr	Binary string: V\Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logparp
Source: tasksche.exe.5.dr	Binary string: X\Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Data7706cdc8#ep
Source: tasksche.exe.5.dr	Binary string: >\Device\HarddiskVolume1\Windows\System32\en-US\azroles.dll.mui
Source: tasksche.exe.5.dr	Binary string: X\Device\HarddiskVolume1\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#p
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.ci\|\|p
Source: tasksche.exe.5.dr	Binary string: V\Device\HarddiskVolume1\Users\User\AppData\Local\Yandex\BrowserManager\Crypto.Core.dll\|\|cp
Source: tasksche.exe.5.dr	Binary string: 4\Device\HarddiskVolume1\ProgramData\Microsoft\Searchup
Source: tasksche.exe.5.dr	Binary string: 4\Device\HarddiskVolume1\Windows\System32\mspaint.exejp
Source: tasksche.exe.5.dr	Binary string: 3\Device\HarddiskVolume1\Windows\System32\wscapi.dll.pp
Source: System.evtx.25.dr	Binary string: C:\Device\HarddiskVolume3~(
Source: tasksche.exe.5.dr	Binary string: J\Device\HarddiskVolume1\Program Files\Microsoft Office\Office14\MSTORE.EXEes.p
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.25.dr	Binary string: 9\Device\HarddiskVolume3\Windows\System32\msvcp110_win.dll?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: tasksche.exe.5.dr	Binary string: D\Device\HarddiskVolume1\Program Files\TrueKey\system.data.sqlite.dllnp
Source: System.evtx.25.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: tasksche.exe.5.dr	Binary string: e\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\Suicide Squad - Special Ops
Source: tasksche.exe.5.dr	Binary string: ;\Device\HarddiskVolume1\Program Files\Skype\Phone\Skype.exeetp
Source: tasksche.exe.5.dr	Binary string: @\Device\HarddiskVolume1\Program Files\TrueKey\sqlite.interop.dllop
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.25.dr	Binary string: L\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: tasksche.exe.5.dr	Binary string: \\Device\HarddiskVolume1\ProgramData\Microsoft\Windows\Start Menu\Programs\PRO"
Source: tasksche.exe.5.dr	Binary string: \|\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts$p
Source: System.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.25.dr	Binary string: 1\Device\HarddiskVolume3\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: tasksche.exe.5.dr	Binary string: 4\Device\HarddiskVolume1\Windows\System32\ieframe.dllnF
Source: tasksche.exe.5.dr	Binary string: ,\Device\HarddiskVolume1\Users\User\Favorites-p
Source: tasksche.exe.5.dr	Binary string: v\Device\HarddiskVolume1\Program Files\Alice.Madness Returns + 2 DLC\Game\Alice2\Binaries\Win32\AliceMadnessReturns.exe\|mop
Source: tasksche.exe.5.dr	Binary string: 5\Device\HarddiskVolume1\Windows\System32\perfproc.dllp
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: tasksche.exe.5.dr	Binary string: 7\Device\HarddiskVolume1\Windows\System32\framedynos.dll
Source: tasksche.exe.5.dr	Binary string: \Device\HarddiskVolume1\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dllp
Source: tasksche.exe.5.dr	Binary string: ~\Device\HarddiskVolume1\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Magnify.lnkT+

Source: mssecsvc.exe, 00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, 542CxvZnI5.dll, mssecsvc.exe.3.dr, tasksche.exe.5.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.troj.expl.evad.winDLL@16/62@0/100

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00AD05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CloseHandle,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,

5_2_00AD05F2

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03

Source: 542CxvZnI5.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\542CxvZnI5.dll,PlayGame

Source: 542CxvZnI5.dll	Virustotal: Detection: 90%
Source: 542CxvZnI5.dll	ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\542CxvZnI5.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\542CxvZnI5.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 542CxvZnI5.dll

Static file information: File size 5267459 > 1048576

Source: 542CxvZnI5.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: $@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223968868.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct42C5.tmp.pdb source: svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223968868.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: &@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorb source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ~1.PDB @ source: svchost.exe, 00000018.00000000.2223968868.0000024B8764A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3424115726.0000024B87641000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000018.00000002.3422282579.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.2223907093.0000024B8762B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wct4B1.tmpp.pdb source: svchost.exe, 00000018.00000000.2224075143.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.3425200185.0000024B8765A000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00AD3CC8 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,CreateThread,CloseHandle,WSAStartup,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,

5_2_00AD3CC8

Source: initial sample

Static PE information: section where entry point is pointing to: vzdbmga

Source: mssecsvc.exe.3.dr

Static PE information: section name: vzdbmga

Source: mssecsvc.exe.3.dr

Static PE information: section name: vzdbmga entropy: 7.2160923714047565

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe

Executable created and started: C:\WINDOWS\mssecsvc.exe

Jump to behavior

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe	Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file

Source: C:\Windows\mssecsvc.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe	Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may execute only at specific dates)

Source: C:\Windows\mssecsvc.exe

Evasive API call chain: GetSystemTime,DecisionNodes,Sleep

graph_17-2489

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Windows\mssecsvc.exe	Special instruction interceptor: First address: A7986A instructions caused by: Self-modifying code
Source: C:\Windows\mssecsvc.exe	Special instruction interceptor: First address: A73350 instructions caused by: Self-modifying code

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00A79868 rdtsc

5_2_00A79868

Source: C:\Windows\mssecsvc.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\mssecsvc.exe	Dropped PE file which has not been started: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	Dropped PE file which has not been started: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvc.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_17-2489

Source: C:\Windows\mssecsvc.exe	API coverage: 6.2 %
Source: C:\Windows\mssecsvc.exe	API coverage: 1.4 %
Source: C:\Windows\mssecsvc.exe	API coverage: 7.3 %

Source: C:\Windows\mssecsvc.exe TID: 1784	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 1784	Thread sleep time: -176000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3652	Thread sleep count: 126 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 3652	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\mssecsvc.exe TID: 1784	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: Microsoft-Windows-Partition%4Diagnostic.evtx.25.dr	Binary or memory string: VMwareVirtual disk2.06000c292b65879ff477a6af604113f58PCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 00000009.00000002.3471384873.000001A786438000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicheartbeat
Source: svchost.exe, 00000019.00000000.2226269258.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.3444789529.00000205FAC2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: svchost.exe, 00000019.00000002.3447620312.00000205FAC43000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmci
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000017.00000002.3431988576.00000254A202B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000000C.00000002.3446062414.000001D55D042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.2176775642.000001D55D042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3442840937.000001D55D013000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.2176730998.000001D55D013000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dwm.exe, 0000000E.00000002.3509386634.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000=
Source: svchost.exe, 00000029.00000002.3435246206.000001C781F02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.25.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: svchost.exe, 00000019.00000003.2296747620.00000205FD235000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: dwm.exe, 0000000E.00000002.3509386634.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.25.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: svchost.exe, 00000019.00000003.2296747620.00000205FD235000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 00000019.00000000.2226011203.00000205FABB0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk6000c292b65879ff477a6af604113f58
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c292b65879ff477a6af604113f588
Source: svchost.exe, 00000009.00000000.2166137749.000001A786A25000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>nal
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: svchost.exe, 00000019.00000003.2293558433.00000205FB933000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmcir:m
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>-W(
Source: mssecsvc.exe, 00000011.00000002.2981002221.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: svchost.exe, 00000009.00000000.2166233180.000001A786A3D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000019.00000002.3506457666.00000205FBFA5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Ntfs%4Operational.evtx.25.dr	Binary or memory string: VMware
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: nonicVMware Virtual disk 6000c292b65879ff477a6af604113f58
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>oso
Source: svchost.exe, 00000019.00000003.2296747620.00000205FD235000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: svchost.exe, 00000009.00000002.3471384873.000001A786438000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicshutdown
Source: svchost.exe, 00000009.00000000.2166233180.000001A786A3D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000we
Source: svchost.exe, 00000029.00000002.3435246206.000001C781F02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: svchost.exe, 00000009.00000000.2166233180.000001A786A3D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: svchost.exe, 00000019.00000003.2296747620.00000205FD235000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.25.dr	Binary or memory string: VMware Virtual disk 2.0 6000c292b65879ff477a6af604113f58PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>-P(
Source: lsass.exe, 00000008.00000002.3439187607.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000009.00000002.3471384873.000001A786438000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: cativmicvss
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000029.00000000.2277334412.000001C781E40000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: svchost.exe, 00000009.00000002.3471384873.000001A786438000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicshutdown
Source: dwm.exe, 0000000E.00000002.3509386634.0000011607ED0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: PointVMware&P
Source: Microsoft-Windows-Partition%4Diagnostic.evtx.25.dr	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: svchost.exe, 00000029.00000002.3430358268.000001C781E5B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c292b65879ff477a6af604113f58
Source: mssecsvc.exe, 00000005.00000002.2370044980.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3432692016.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160000055.00000140AD813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000000.2179794745.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3421811958.00000195DD613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.2195003090.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.3424126128.000001F28C22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.3424768941.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.2200009754.000001CA9782A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.2207595624.00000254A2043000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.3433120989.00000254A2043000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>xVxp9v
Source: lsass.exe, 00000008.00000002.3439187607.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000029.00000002.3430358268.000001C781E5B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: UDFBBSCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000019.00000002.3507078837.00000205FD000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>LB2oIb
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>ta(
Source: svchost.exe, 00000009.00000002.3471384873.000001A786438000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 629.vmicvss
Source: lsass.exe, 00000008.00000002.3460531405.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000019.00000003.2296747620.00000205FD235000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: mssecsvc.exe, 00000010.00000002.2368612169.0000000000B0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>U
Source: svchost.exe, 0000000D.00000002.3427535586.00000195DD66A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000021.00000002.3425298587.000001B278E02000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000008.00000002.3439187607.00000140AD88B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>imm
Source: svchost.exe, 00000029.00000002.3427368915.000001C781E2B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000019.00000003.2296747620.00000205FD235000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: svchost.exe, 00000009.00000002.3471384873.000001A786438000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicheartbeat

Source: C:\Windows\mssecsvc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\mssecsvc.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00A79868 rdtsc

5_2_00A79868

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_7FE36573 LdrInitializeThunk,

5_2_7FE36573

Source: C:\Windows\mssecsvc.exe

5_2_00AD3CC8

Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00A7302F mov edx, dword ptr fs:[00000030h]	5_2_00A7302F
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD05F2 mov eax, dword ptr fs:[00000030h]	5_2_00AD05F2
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD042D mov eax, dword ptr fs:[00000030h]	5_2_00AD042D
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_00AD025E mov edx, dword ptr fs:[00000030h]	5_2_00AD025E
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE305F2 mov eax, dword ptr fs:[00000030h]	5_2_7FE305F2
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE3025E mov edx, dword ptr fs:[00000030h]	5_2_7FE3025E
Source: C:\Windows\mssecsvc.exe	Code function: 5_2_7FE3042D mov eax, dword ptr fs:[00000030h]	5_2_7FE3042D
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_00A7302F mov edx, dword ptr fs:[00000030h]	16_2_00A7302F
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE405F2 mov eax, dword ptr fs:[00000030h]	16_2_7FE405F2
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE4025E mov edx, dword ptr fs:[00000030h]	16_2_7FE4025E
Source: C:\Windows\mssecsvc.exe	Code function: 16_2_7FE4042D mov eax, dword ptr fs:[00000030h]	16_2_7FE4042D
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00A7302F mov edx, dword ptr fs:[00000030h]	17_2_00A7302F
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF05F2 mov eax, dword ptr fs:[00000030h]	17_2_00BF05F2
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF042D mov eax, dword ptr fs:[00000030h]	17_2_00BF042D
Source: C:\Windows\mssecsvc.exe	Code function: 17_2_00BF025E mov edx, dword ptr fs:[00000030h]	17_2_00BF025E

Source: C:\Windows\mssecsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\mssecsvc.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2FE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2DC0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF3620 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2FE0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2DC0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF3620 protect: page execute and read and write	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Windows\mssecsvc.exe	Thread created: unknown EIP: 7EFC3BCA			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Thread created: unknown EIP: 7EFB3BCA			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2FE0 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2DC0 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF3620 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2F60 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF3710 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2C00 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2FE0 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2DC0 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF3620 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2F60 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF3710 value: E8	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: PID: 1028 base: 76EF2C00 value: E8	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\winlogon.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\lsass.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\dwm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\qsttVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\winlogon.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\lsass.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\dwm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\mssecsvc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\yietVt target: C:\Windows\mssecsvc.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\mssecsvc.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2FE0	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2DC0	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF3620	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FCC0DE0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 4B80000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\SysWOW64\WerFault.exe base: 53A0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D55D2D0000	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2FE0	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF2DC0	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 76EF3620	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1

Jump to behavior

Source: winlogon.exe, 00000007.00000002.3456476310.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.2158458567.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2182771761.0000011605AB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000007.00000002.3456476310.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.2158458567.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3504320407.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000007.00000002.3456476310.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.2158458567.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3504320407.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000007.00000002.3456476310.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.2158458567.000001E858D81000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3504320407.0000011605EC1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask VolumeInformation			Jump to behavior

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00AD3820 GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,

5_2_00AD3820

Source: C:\Windows\mssecsvc.exe

Code function: 5_2_00AD042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,

5_2_00AD042D

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.25.dr

Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Virut

Source: Yara match	File source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.2241048704.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3405944268.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3406467423.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.2236151257.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3402432003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3400704837.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3402551905.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3493795280.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3402824272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.2179195689.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3405187204.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3404348411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.2276062758.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.2228632401.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3400994676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3403893417.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3400697506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3402819580.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3400997195.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3405291179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.2275357508.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.2254076183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3402235476.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2248711553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2202870396.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3403338621.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3400562813.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2174451067.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3402282133.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3406751993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3401875690.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3406217056.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3403522882.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3400698716.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.2190133611.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3403585451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.2264447813.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3403150697.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.2258234045.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3400695649.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3402829287.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3006271461.000000007FE40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3402001391.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3404111410.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2196070682.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.2198977925.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3403935827.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3405677404.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3403105922.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2181731693.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2205891354.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.2267954326.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3404464062.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.2262953528.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3404477534.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3405487489.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3404523967.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.2223034706.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.2172969564.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2372011334.000000007FE40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.2223988543.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3403262644.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3401002112.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3402992756.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3402243073.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3404889708.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3400703981.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3402735400.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2980597130.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3403852852.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.2247232722.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3493788665.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3400610797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3401707801.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3402842670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.2271192362.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.2259095161.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3402662179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3401117945.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3404976335.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3401714846.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3402846585.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3402229166.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3405775251.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3403667247.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3401226137.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.2193268117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2175662143.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3493625570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2157612272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3402428958.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3403542982.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3404729920.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3404573979.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3402354767.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.2253051631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.2256281044.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.2159244338.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2162403933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lsass.exe PID: 640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwm.exe PID: 992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2024, type: MEMORYSTR

Remote Access Functionality

Yara detected Virut

Source: Yara match	File source: 17.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000000.2241048704.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3405944268.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3406467423.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.2236151257.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3402432003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3400704837.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3402551905.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3493795280.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3402824272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.2179195689.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3405187204.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3404348411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.2276062758.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.2228632401.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3400994676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3403893417.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3400697506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3402819580.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3400997195.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3405291179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.2275357508.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.2254076183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3402235476.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.2248711553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.2202870396.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3403338621.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3400562813.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2174451067.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3402282133.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3406751993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3401875690.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3406217056.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3403522882.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3400698716.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000000.2190133611.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3403585451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.2264447813.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3403150697.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.2258234045.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3400695649.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3402829287.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3006271461.000000007FE40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3402001391.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3404111410.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2196070682.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.2198977925.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3403935827.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.3405677404.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3403105922.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2181731693.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2205891354.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.2267954326.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3404464062.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.2262953528.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3404477534.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.3405487489.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3404523967.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.2223034706.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.2172969564.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2372011334.000000007FE40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.2223988543.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3403262644.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3401002112.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3402992756.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3402243073.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3404889708.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3400703981.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3402735400.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2980597130.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3403852852.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000000.2247232722.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3493788665.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3400610797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3401707801.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3402842670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.2271192362.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.2259095161.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3402662179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3401117945.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3404976335.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3401714846.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3402846585.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3402229166.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3405775251.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3403667247.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3401226137.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.2193268117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.2175662143.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3493625570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2157612272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3402428958.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.3403542982.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3404729920.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3404573979.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3402354767.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.2253051631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.2256281044.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.2159244338.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2162403933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6392, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lsass.exe PID: 640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 788, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwm.exe PID: 992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 1536, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1068, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1424, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1660, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1936, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 2024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Native API	1 DLL Side-Loading	512 Process Injection	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	11 System Time Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	512 Process Injection	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
542CxvZnI5.dll	90%	Virustotal		Browse
542CxvZnI5.dll	92%	ReversingLabs	Win32.Ransomware.WannaCry
542CxvZnI5.dll	100%	Avira	W32/Virut.Gen
542CxvZnI5.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\mssecsvc.exe	100%	Avira	W32/Virut.Gen
C:\Windows\tasksche.exe	100%	Avira	TR/Ransom.Gen
C:\Windows\mssecsvc.exe	100%	Joe Sandbox ML
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	93%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\mssecsvc.exe	95%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	93%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label	Link
http://3csp.icrosof4m/ocp0	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3435170210.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com/shell	svchost.exe, 00000009.00000002.3458096495.000001A78602A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2163338253.000001A78602A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://3csp.icrosof4m/ocp0	lsass.exe, 00000008.00000000.2160835567.00000140AE074000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3460531405.00000140AE074000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.cn/shellRESP	svchost.exe, 00000009.00000002.3458096495.000001A78602A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2163338253.000001A78602A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://Passport.NET/tb	Microsoft-Windows-LiveId%4Operational.evtx.25.dr	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 00000008.00000002.3435170210.00000140AD850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2160070128.00000140AD850000.00000004.00000001.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 00000008.00000000.2160032797.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3433737462.00000140AD82F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	svchost.exe, 0000001A.00000000.2232869398.000001A204EE0000.00000002.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
51.62.241.1	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
39.69.187.1	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
39.69.187.2	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
20.15.180.1	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.15.180.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.2.157.1	unknown	United States	7018	ATT-INTERNET4US	false
137.175.162.138	unknown	Canada	5769	VIDEOTRONCA	false
26.51.77.1	unknown	United States	7922	COMCAST-7922US	false
211.132.162.2	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
211.132.162.1	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
138.40.81.2	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
138.40.81.1	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
51.62.241.233	unknown	United Kingdom	2686	ATGS-MMD-ASUS	false
72.151.164.132	unknown	United States	7018	ATT-INTERNET4US	false
100.43.221.1	unknown	United States	14265	US-TELEPACIFICUS	false
160.166.64.79	unknown	Morocco	6713	IAM-ASMA	false
193.175.220.134	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
221.170.202.170	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
26.51.77.154	unknown	United States	7922	COMCAST-7922US	false
214.224.11.142	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
214.224.11.1	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
198.154.22.143	unknown	United States	668	DNIC-AS-00668US	false
111.48.240.74	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
138.40.81.25	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
181.1.73.1	unknown	Argentina	7303	TelecomArgentinaSAAR	false
181.1.73.2	unknown	Argentina	7303	TelecomArgentinaSAAR	false
91.63.153.58	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
78.74.197.76	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591515
Start date and time:	2025-01-15 02:51:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	32
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	542CxvZnI5.dll renamed because original name is a hash value
Original Sample Name:	be3c1ef872e8e146ff78e66271ca261b.dll
Detection:	MAL
Classification:	mal100.rans.troj.expl.evad.winDLL@16/62@0/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 40.126.31.67, 13.107.246.45, 52.149.20.212, 20.190.159.4, 20.189.173.20
Excluded domains from analysis (whitelisted): vttzwu.com, voydqz.com, ezaeqf.com, slscr.update.microsoft.com, poqxaa.com, xdzsqn.com, kkuzud.com, uteyyp.com, pojfeg.com, fxumem.com, bjeako.com, login.live.com, imdznk.com, yscyez.com, onparo.com, urxxuf.com, kiieiy.com, lepdbj.com, ebohzv.com, xzgrlj.com, qiurmh.com, dkrbtp.com, ersgvh.com, client.wns.windows.com, sizuny.com, kfguna.com, otelrules.azureedge.net, oacbaq.com, ogoeuu.com, ant.trenz.pl, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, rxexyq.com, ngemix.com, remieu.com, tkkvba.com, rqegva.com, oaqqkf.com, slnmhg.com, akzoeg.com, abyeya.com, umwatson.events.data.microsoft.com, oqpzuo.com, asjuen.com, ilo.brenz.pl, toexkd.com, eijfjn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:52:17	API Interceptor	1x Sleep call for process: loaddll32.exe modified
20:53:06	API Interceptor	112x Sleep call for process: mssecsvc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	GUtEaDsc9X.dll	Get hash	malicious	Wannacry	Browse	27.13.195.1
	330tqxXVzm.dll	Get hash	malicious	Wannacry	Browse	61.53.130.1
	9kNjKSEUym.dll	Get hash	malicious	Wannacry	Browse	39.87.158.1
	D3W41IdtQA.dll	Get hash	malicious	Wannacry	Browse	124.94.33.112
	sLlAsC4I5r.dll	Get hash	malicious	Wannacry	Browse	39.80.197.203
	ruXU7wj3X9.dll	Get hash	malicious	Wannacry	Browse	27.219.109.201
	eIZi481eP6.dll	Get hash	malicious	Wannacry	Browse	182.119.252.121
	Yx3rRuVx3c.dll	Get hash	malicious	Wannacry	Browse	42.63.214.1
	9nNO3SHiV1.dll	Get hash	malicious	Wannacry	Browse	27.11.108.236
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	39.74.29.1
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	GUtEaDsc9X.dll	Get hash	malicious	Wannacry	Browse	27.13.195.1
	330tqxXVzm.dll	Get hash	malicious	Wannacry	Browse	61.53.130.1
	9kNjKSEUym.dll	Get hash	malicious	Wannacry	Browse	39.87.158.1
	D3W41IdtQA.dll	Get hash	malicious	Wannacry	Browse	124.94.33.112
	sLlAsC4I5r.dll	Get hash	malicious	Wannacry	Browse	39.80.197.203
	ruXU7wj3X9.dll	Get hash	malicious	Wannacry	Browse	27.219.109.201
	eIZi481eP6.dll	Get hash	malicious	Wannacry	Browse	182.119.252.121
	Yx3rRuVx3c.dll	Get hash	malicious	Wannacry	Browse	42.63.214.1
	9nNO3SHiV1.dll	Get hash	malicious	Wannacry	Browse	27.11.108.236
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	39.74.29.1
ATGS-MMD-ASUS	GUtEaDsc9X.dll	Get hash	malicious	Wannacry	Browse	56.148.232.23
	330tqxXVzm.dll	Get hash	malicious	Wannacry	Browse	48.0.238.151
	https://suman006723213.github.io/garena.reward.ff/	Get hash	malicious	HTMLPhisher	Browse	34.36.216.150
	https://checkpoint681.verifications.io.vn/491c51f2b04f4064b623dfcead849625	Get hash	malicious	Unknown	Browse	34.149.134.77
	https://jpmchase.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=ccs.collections%40jpmchase.com&p=c0d0aede-7bea-4ead-a752-2d73ef1c7343#v=3.0.0&d=https%3A%2F%2Fapi.virtru.com%2Fstorage%2Fapi%2Fpolicies%2Fc0d0aede-7bea-4ead-a752-2d73ef1c7343%2Fdata%2Fmetadata&dk=1k9dx%2B9Tl5K3SfB3B3irzBa9ZHLb5jXqYy1n7NSx1lE%3D	Get hash	malicious	Unknown	Browse	34.160.98.162
	F1G5BkUV74.dll	Get hash	malicious	Wannacry	Browse	33.175.236.126
	ruXU7wj3X9.dll	Get hash	malicious	Wannacry	Browse	56.59.202.1
	YZJG8NuHEP.dll	Get hash	malicious	Wannacry	Browse	51.209.245.1
	http://monitor.linkwhat.com/tl4tl4726Qz107cK770xR10599lj360px17lb07468gl70015oV95328Kn41253VG39381FP5605427918==aru2826664	Get hash	malicious	Phisher	Browse	34.149.158.220
	hsmSW6Eifl.dll	Get hash	malicious	Wannacry	Browse	34.1.98.1
MICROSOFT-CORP-MSN-AS-BLOCKUS	tTbeoLWNhb.dll	Get hash	malicious	Wannacry	Browse	21.90.103.237
	330tqxXVzm.dll	Get hash	malicious	Wannacry	Browse	40.90.175.1
	EXTERNAL Your company's credit limit has changed!.msg	Get hash	malicious	Unknown	Browse	13.89.179.14
	Eastern Contractors Corporation Contract and submittal document.eml	Get hash	malicious	Unknown	Browse	40.126.32.138
	04Ct9PoJrL.dll	Get hash	malicious	Wannacry	Browse	22.174.74.1
	bopY0ot9wf.dll	Get hash	malicious	Wannacry	Browse	20.51.106.1
	habHh1BC0L.dll	Get hash	malicious	Wannacry	Browse	52.178.54.35
	https://securityalert-corporate.com/click/f288bff9-842d-4e34-8d2d-41ad20e48e9d	Get hash	malicious	Unknown	Browse	20.49.104.18
	FjSrGs0AE2.dll	Get hash	malicious	Wannacry	Browse	22.184.197.1
	mlfk8sYaiy.dll	Get hash	malicious	Wannacry	Browse	13.103.137.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/b/?_encoding=UTF8&_encoding=UTF8&node=3024314031&bbn=16435051&pd_rd_w=VSdHJ&content-id=amzn1.sym.01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_p=01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_r=E0WD16QK99B55VAWSKBQ&pd_rd_wg=EU3Lj&pd_rd_r=fd3510c2-a6e6-4f59-a468-c59aac80bfa9&ref_=pd_hp_d_btf_unk	Get hash	malicious	Unknown	Browse	40.115.3.253
	https://ziyahid.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	40.115.3.253
	http://pub-35a1d927529e4c9684409537cf8ff63f.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	40.115.3.253
	http://emeklilereozeldir.org/	Get hash	malicious	Unknown	Browse	40.115.3.253
	http://industrious-tomato-ngvkcs.mystrikingly.com/	Get hash	malicious	Unknown	Browse	40.115.3.253
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	40.115.3.253
	https://cdn.trytraffics.com/rdr/YWE9MzUyODAwODkxJnNlaT0zMDQ3NDU3NCZ0az1JR0doTXJGNXNpVnJBYzZkWlBUWSZ0PTUmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXM=	Get hash	malicious	Unknown	Browse	40.115.3.253
	https://sreamconmymnltty.com/scerty/bliun/bolop	Get hash	malicious	Unknown	Browse	40.115.3.253
	https://yolocdh.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	40.115.3.253
	https://githoalonebiggsimalls.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	40.115.3.253

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\tasksche.exe	UR9TBr66am.dll	Get hash	malicious	Wannacry	Browse
C:\Windows\tasksche.exe	eAx3JV2z84.dll	Get hash	malicious	Wannacry	Browse
C:\WINDOWS\qeriuwjhrf (copy)	UR9TBr66am.dll	Get hash	malicious	Wannacry	Browse
C:\WINDOWS\qeriuwjhrf (copy)	eAx3JV2z84.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.777724762407647
Encrypted:	false
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8s3x:QqPe1Cxcxk3ZAEUadzR8sB
MD5:	79409B6F48460807480E4A574312D85F
SHA1:	5D9F64CCF13081441F2785A535E02312236445D9
SHA-256:	331E14A6594B700B6167690430C9DA72FEE72D408DD1B8C5CB155C0199033D0A
SHA-512:	AC004B3248CBC2CE7B6D566E3F5128195669E5C53C24AE13668E37FDADCB5158CC345D7A33CADFED6328A25A640C5FA612D0F0DB86989C3ACC21771B55508916
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 93%
Joe Sandbox View:	Filename: UR9TBr66am.dll, Detection: malicious, Browse Filename: eAx3JV2z84.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4680
Entropy (8bit):	3.711003410108568
Encrypted:	false
SSDEEP:	96:pYMguQII4i5lz6h4aGdinipV9ll7UY5HAmzQ+:9A4n/xne7HO+
MD5:	207D7A4BB76433AE17CBE654A4A2965A
SHA1:	A9FDA6709BFFCB47CA96E05913E89B8745FC3654
SHA-256:	EF8FBB8CF2968CD745D5C8D75B866EC965378DFEBBEA7D6B5962806FAEFB8E63
SHA-512:	1963C34A70C4A095DE46947328A9A44B67260938656026E2E7AA24480064E8E2E08D6DCC0BCEAC6B54384348CED9E162F2C661AC2241EF30BBF1A947560524B1
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...6.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.S.o.u.r.c.e.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.S.o.u.r.c.e.>..... . . . .<.A.u.t.h.o.r.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.0.).<./.A.u.t.h.o.r.>..... . . . .<.V.e.r.s.i.o.n.>.1...0.<./.V.e.r.s.i.o.n.>..... . . . .<.D.e.s.c.r.i.p.t.i.o.n.>.$.(.@.%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.p.p.c...d.l.l.,.-.2.0.1.).<./.D.e.s.c.r.i.p.t.i.o.n.>..... . . . .<.U.R.I.>.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.o.f.t.w.a.r.e.P.r.o.t.e.c.t.i.o.n.P.l.a.t.f.o.r.m.\.S.v.c.R.e.s.t.a.r.t.T.a.s.k.<./.U.R.I.>..... . . . .<.S.e.c.u.r.i.t.y.D.e.s.c.r.i.p.t.o.r.>.D.:.P.(.A.;.;.F.A.;.;.;.S.Y.).(.A.;.;.F.A.;.;.;.B.A.).

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	6440
Entropy (8bit):	3.9707319168992488
Encrypted:	false
SSDEEP:	96:2oCrup/vOocabeilaFgQjHQd6k0GCFoG3zYbES3zYdtQqg:pH/mNAexRwAk0GA/ajX
MD5:	C5686DB6680EF3F9075D4584F3443D94
SHA1:	9F53BD6A598DC8E10229BE470CF1A731B50474F6
SHA-256:	49B827DCB02D61A551C958F6FA94DB97226CD91DAD47CA804886E251028CE2EA
SHA-512:	EC257B00DA09D996625B95ACAF914673F8E97A7909B59E40A68EF124DEC3E1CF19543B1AB45B278D6D690930EE1AD1550C5C1D0F434AF4FB19122C1BD962D617
Malicious:	false
Preview:	ElfChnk.................f.......j...............(..........................................................................................................................=...........................................................................................................................g...............@...........................n...................M...]...........................j...............................&...............................~.......................................................**..X...f.......\.U".f..........&.........}.]..+..$.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67544
Entropy (8bit):	4.102208680307349
Encrypted:	false
SSDEEP:	768:8kBVUHiapX7xadptrDT9W84bW664k5XyvkYk:87Hi6xadptrX9WPbR7
MD5:	AAE1405C54F5A7350C62189AC8988915
SHA1:	A37D74B2A3F1EC0ACE23C1A5A1C0665B9A9ECFDF
SHA-256:	BF05DACCBFA4259E32726A19123857F8A3811D68753683DAEBFA1CDB8C849EC5
SHA-512:	385268344D8D1B5E793402C37CC43B6263135B74B7CB22E2189D6F869CD24B743D96069BE02A51D6488B4A798D7699B1514FC370BC1E26C7F9E01E5578584E2F
Malicious:	false
Preview:	ElfChnk.........S...............S......................{......................................................................j................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................*..(...Q........4...f........F..................................................................F.......R.....!.....s.......... .4...f......................@...Q....................M.i.c.r.o.s.o.f.t.-.C.l.i.e.n.t.-.L.i.c.e.n.s.i.n.g.-.P.l.a.t.f.o.r.m.U....I.)+."BoM.i.c.r.o.s.o.f.t.-.C.l.i.e.n.t.-.L.i.c.e.n.s.i.n.g.-.P.l.a.t.f.o.r.m./.A.d.m.i.n.....R.qo..................J...J...........6.1.a.f.d.6.a.2.-.d.7.c.3.-.8.d.2.5.-.3.6.c.2.-.0.c.2.c.4.7.e.3.a.c.a.8...6.1.a.f.d.6.a.2.-.d.7

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4013147639327475
Encrypted:	false
SSDEEP:	384:FhGN+3N6sNSNYNLNjNUSNbN6NHNRNbNYN0NsNZN7NhNLNPNhN8NdNixNAwNioNZs:FGvsbF1QBjr1xCKuL48fpoQ
MD5:	D352D15D6A29EC818FCCB7D131D827B4
SHA1:	E83944244EF8A5B84B6A8DF486A5A5801937ED51
SHA-256:	B57978A9C8C8B8D8DF2EC5AAE442504C7327951A2602CD8322378EB9E6AC0D57
SHA-512:	CF9CDEAE9F69A19E36214B4C29D9C319B231675CD5B4B3A7BAC8F1EE23FFDB06E8E4188E0309A2B710EA1AC8948F72ED4EC7CA8209FA7C0255E1C3BA4614E959
Malicious:	false
Preview:	ElfChnk............................................lK..........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F....................C.......................J...............................................................i...................F......e...........**..............."s...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	69744
Entropy (8bit):	4.288088234291132
Encrypted:	false
SSDEEP:	384:yVxWkVLJV9VtVgVUVrVZhsVPVUVvVoVTVXV8VMVxVIVyV5JVYV6VCiVfV5V/VBVs:qHI1H
MD5:	C370C861B178376C534151DBB1CE95E7
SHA1:	E6CD15BD68DB6762C13F836BD1DDFBD523D7691E
SHA-256:	8BABB9FAC14E290671ADEF51670CF0A83A383CC4F8688F659BE2ED5BA2D9BC78
SHA-512:	298D1CCF2724D2A7A8F5DBD5D45054EDAB9648CA2ECC5B85AE7A9AA677765EE44686FF46A9B517EF57DF6E6C7A2433EB283567AB0B1F50C5763A6447C61E0022
Malicious:	false
Preview:	ElfChnk.i...............i...................H.........N....................................................................g...................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F....................................................3.......................................................8..........................&...Y1....................%@.u..........F..&...............................................................@.......X..._.!.....E..........@%@.u............s....................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........L...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.A.l.a.r.m.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.....M.i.c...................:.u..........F.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.423265177202914
Encrypted:	false
SSDEEP:	384:67UhsmYDQlm9cKrRtUmNmHumtTmgm5wQXvZ7bmO8mfQE3mq9mqmxqm6nFmCWmnsn:XMrJcWHvqisqnvokZRKeTSPnSKn
MD5:	34B35A683C68A73A1BF569F68E54DB0D
SHA1:	FC5C102CFE726B21653E768ADA9A275FADA90550
SHA-256:	82203A8B2AF5D6CF60E99ADA87DF17CED01A954F995B6649E26E1C08FB97BEC9
SHA-512:	E547B36385DBFBAF0D825AE5475C3CEF0B1949E632402D94385794F1AA1A8A565738FA29C4F895894DB61B86CE7F29DF2D389CFF63D9D246AE5157BAB20DABB1
Malicious:	false
Preview:	ElfChnk..0.......0.......0.......0..........x...X...iS.~........................................................................................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...................................C\..........................................KJ...............H..;d.......X..............#...........%...........**.......0....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 4, DIRTY
Category:	dropped
Size (bytes):	70680
Entropy (8bit):	0.7970331195244389
Encrypted:	false
SSDEEP:	384:PmhpiMLe8XiCtViCi4hpiMLe8XiCtViCi:ePpnPp
MD5:	1B27247D2208CF557693A326FABB2E2E
SHA1:	DD882B3916882551A802E4FF22E6069793EBE601
SHA-256:	B1BAE55A1B246E649E612FF441298FA7E74461F34AA7FBCC9905DB300925A438
SHA-512:	1B0FA364EC957F352C13FE632FDE271B38B3D359B529BE2D163A88FFBC7C893AAD3218C954292DEB05445D16C0D10034B5A7F0965BBEB0839F03DA4D5920514B
Malicious:	false
Preview:	ElfFile.........................................................................................................................ElfChnk.....................................P........8......................................................................Ux'e............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.416807332891786
Encrypted:	false
SSDEEP:	1536:CbBN2A4VD7VAx8whAGU2woJQghgooKChi581UAkM:
MD5:	8B93FFD74BA69D506BC1A7CA93434764
SHA1:	8275F283E3EB6143F33D1B97C889D167963A9B41
SHA-256:	9D1B6EA5CF8330CB2CE526B709669FCF7BD756EE43E30230B98F3FBE6B80D227
SHA-512:	8EED6493C2C3B9BD2B0DB0ECF80B6FFCC007A1BB618725BC5681469894965CE2606589062BA941C6B29D23F9A5F46EE9613F2FA46AC0B587CB6130EA99E24A15
Malicious:	false
Preview:	ElfChnk.........b...............b...............@...........................................................................Z!H.............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.519960906808938
Encrypted:	false
SSDEEP:	768:7PB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9ZFN9NxKk:vXY5nVYIyyqED5BVZUeJ+EsiA881rXT
MD5:	F2DD657C9A1CB9C4DE1DF89C0F45E5F1
SHA1:	A9B48C4B4F004BE9F9641753D4BAEADD209BC4EF
SHA-256:	7601EB81F47B9DFC18BAD436F6657EBFD07782F6C8BC681A76DEFC69C6104613
SHA-512:	C226D4C11D55C8BA887F2A6314B2C797CA60A12B90C066E7929E0CF182440D3E246C9399D4118FD5E781C7998A85E78AEF363D54D68DA86E39BF6D9F07DA6441
Malicious:	false
Preview:	ElfChnk.........\|...............\|...................%DkZ........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y...........>...........**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	93880
Entropy (8bit):	2.149676099710646
Encrypted:	false
SSDEEP:	384:KosK6Co3hdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorDorrTo9orFo2:6BDCpWPDCpWj0SB8
MD5:	68DE021BC7D2289BD8404C6900B1E4CD
SHA1:	DC2E3AFA09527A397C6084D25602D9C71334CD6E
SHA-256:	80A62E35444B0FD6C1CAF081C2BB60F04F6BC08F631DB633D3B9A13B3362A9AA
SHA-512:	E15A1C4716F71EBF4FFA1B1EF6C7C875DBDF2DF9B21EF0BA6FB9BD25B974F4691224CCEE174F790F458D1056FB7940E55079F3C6562B8FA00C28619080E3D5F0
Malicious:	false
Preview:	ElfChnk......................................+...-..\..........................................................................g................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................U)..............................**..............njQ..f........F..................................................................>.......V...X.!..e..............njQ..f...............................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8512934663046342
Encrypted:	false
SSDEEP:	384:vhAiPA5PNPxPEPHPhPEPmPSPRP3PoP1P0mPQP1P9xP:v2Nz
MD5:	B58E72BD85CF367466349FADCF9A5818
SHA1:	0F561886DC1FC8FBCA5DC8CA10DB1A7C34CEE419
SHA-256:	D6F533FC5273A6E86F4295EE8935D94CC1A1CCD12A0DCA9C6C9723F852772861
SHA-512:	32893F184EE6EA667D4FA98625F5B0192256F05E072513D2F68C3078FA2002824DB743BF759C5DEF4EBFD92D4257E5EE06FF584D0F4A79D8A964FA2C65CFCA01
Malicious:	false
Preview:	ElfChnk......................................%...&.........................................................................p4..................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................................................................................'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432260898567245
Encrypted:	false
SSDEEP:	384:hhZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+lD:hWXSYieD+tvgzmMvG5m2a0
MD5:	9BCAC131A0E1046D07A1126509C0163B
SHA1:	668C02B1F04155FC7C86DA0FD801AB8512D8E647
SHA-256:	A069A8295BD4D219C7E117748EC00A8CE85C3AD2F84991B77311E865DA012C90
SHA-512:	11CECFB1CC6FB52B75BBEADCB99337634B61B1D4B78514905846BC0D6F57704EFDD01E59177C0A843FB8346DF2AEF6FF00315D1597E526F4408368A0834B4E90
Malicious:	false
Preview:	ElfChnk......................................$...&............................................................................W................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................&...........**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67128
Entropy (8bit):	3.1539129169709863
Encrypted:	false
SSDEEP:	384:ChWh4FhqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hR:wbCyhLfISid
MD5:	858D6ABA27FBCB52369BC5C50A08CBF3
SHA1:	DDB494D442A73DF2A841E4C8995CF2FFCFCC6B95
SHA-256:	45B413EDD5C6E9312C10D0D2B4638C982DEFBB22E7CE782FE4FE2EBDF9B9F1C8
SHA-512:	90C749C511364881F01A25D9772A76BA3509E227EC28F4024ADDB934D754D9251035ED6247849758B0A2C92DA8065A7539B7AA951E1B123BC72ECBB169357644
Malicious:	false
Preview:	ElfChnk.........L...............L...........P........n0....................................................................ps..................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n............................................................................v..........**......K............f........F...v..............................................................<.......T.....!......................f..........)...............K....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.D.P.A.P.I.@.....NF.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.D.P.A.P.I./.O.p.e.r.a.t.i.o.n.a.l....0.............j...;......H..f(.:j4C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.M.i.c.r.o.s.o.f.t.\.P.r.o.t.e.c.t.\.S.-.1.-.5.-.1.8.\.U.s.e.r.\....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66528
Entropy (8bit):	3.297033869047589
Encrypted:	false
SSDEEP:	768:ScMhFBuyKskZljdoKXjtT/r18rQXn8iLqa3:jMhFBuV
MD5:	66654F01BDFF24962CDCDEC7D524FCF7
SHA1:	02A572B8B9534FACF129E380EF9AB9A24574D0E4
SHA-256:	235573D5743FDDD1E7BC5228D10D2A8FD811F72A3230751F0EA5270D8127EDA2
SHA-512:	3C99ACB512991A202B7D7F213D80E704839E1B70EA2C05B42776681090B5016172C45365382AAA231E1FC223037C375BA4F2C7E2BACED7A30DF4A67712A61B04
Malicious:	false
Preview:	ElfChnk.........L...............L.................7..........................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A..........................................**......L............f........F..................................................................>.......V...y.!......................f..........)...............L....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.N.C.r.y.p.t........E..3...pM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.r.y.p.t.o.-.N.C.r.y.p.t./.O.p.e.r.a.t.i.o.n.a.l....M.........F...........M.i.c.r.o.s.o.f.t. .P.l.a.t.f.o.r.m. .C.r.y.p.t.o. .P.r.o.v.i.d.e.r...0...l.s.a.s.s...e.x.e................ElfChnk.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.896745651566555
Encrypted:	false
SSDEEP:	768:nre2Q+uYvAzBCBao/F6Cf2SEqEhwaK41HZaWRSgELNnLi:WHf
MD5:	396196233DA144BC9B1AC36AEBA3FA42
SHA1:	B5800B9F323B93BCBCFA9D2F727A9975CACD6337
SHA-256:	4A268F50173502D662F85D13944A1249B58912BCD3BC9FA6B419CB1E561D2969
SHA-512:	A0C83A765A92F558C0BBD72D418D6C8A2AB26F90A71DA6B5342C1AC98E3BB3AC0A57E6DBA86AB7334276A0058863364C36D8205EEBEAF1B29B411860DA528F61
Malicious:	false
Preview:	ElfChnk.v.......x.......v.......x...........P...`...d........................................................................X.e........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..@...v.......<..:..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.924636023538134
Encrypted:	false
SSDEEP:	384:wh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDx:wMAP1Qa5AgfQQn
MD5:	8EC9027553BC6E0AA226CBE3AA9AEC1A
SHA1:	3E261D8E27902EB9EEF0333F5716E2298FE8FA55
SHA-256:	A2261A47F8E8D6F1E200968E7080400155424C4DD140F281C48FEACD0017A010
SHA-512:	859C59B36EFF5DCEBD329ABED2952EE5ECE6B4D5A8918C341878E77ABEC82C6B2CA0F7392E5DF79C30A004ECF82664DBA87381739F55FC7D6547AC84DDA1BA65
Malicious:	false
Preview:	ElfChnk.....................................0_..0b.............................................................................o................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&..............;....................R..........**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4435307576303655
Encrypted:	false
SSDEEP:	384:3hBE0EGEq0EJE9EdEmE0S4E9/8OaExy4vEeE0TEVzEfEm/8E3VEQEoEwDEfEtEMZ:35SWOQRjEHgl4iYlz
MD5:	A8DA15633D80829F32A3E0CD50CFD995
SHA1:	CD4DD833ED62AD6DEE8A4B109A0356075CCDB8EC
SHA-256:	30BF357C2ADCC24F1A1A48EA85302CB33B8993899685FFFFDC13CD2E4A15C05F
SHA-512:	C7D808E257302F4D08623CE5C5A8D622CE946ADAA2543EE97A1AD3759CF11F93FAAFC8D786CDD4B32A1CBC1E97D5472A30B2A1EBADD5014F7F11BF2B92F1EA8B
Malicious:	false
Preview:	ElfChnk.s...............s...................@.......N...........................................................................................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F....................@...............>... ..E....................$...........(...&.......".......................F...........D...............Q......**......s....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.3316790418382953
Encrypted:	false
SSDEEP:	384:ahYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3Kl/:a1T4hy3V3
MD5:	F7D62B056AB8FE4B83092B05915DD92A
SHA1:	7310B87EC20943EE7854A907C4F807D04D148ABF
SHA-256:	337F9831E9B639FC1523A9EBBDBA186A13D82AF929262CCA31F9FE0677B18E4A
SHA-512:	23FA4D0C18EFC32B8D0A7E5472973DFE557BC793E1BA38468CF5760561700FC1F7965B5A231F76D277B49E5B5E381F8773ED88E6B472CFAC78D5332A495F33ED
Malicious:	false
Preview:	ElfChnk.........m...............m...........@.......r9{.....................................................................g..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../...........n...........**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4485744286205566
Encrypted:	false
SSDEEP:	384:GhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjDfi:GzSKEqsMuy645tZtPN
MD5:	4572B4ADCED1EA2335588876D2A4AF20
SHA1:	0F16E0FF89200599B7DB688563F2E6B656ECFD4B
SHA-256:	68B18DB8939820C2E1E49267F4DA6D5F9EEBECF40A43BE0DEE1643D96CD5FE4C
SHA-512:	6D9E98838FEE3DB11033784CA8A912608F7814D2353C14C839BC372CE4EBF0AC9D05984EA3FE0B153062BAE55CB850277100569B37ED1B798CCDCA1E7746AD57
Malicious:	false
Preview:	ElfChnk.........L...............L....................:.N....................................................................j...................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=....................................................................`..........**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1559400308203562
Encrypted:	false
SSDEEP:	384:BhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zZ:Bmw9g3Lf
MD5:	64B9990B5E7F3874310C63A28FF2269B
SHA1:	B1A4325EECAFB72D9AFF23F1759F866757699E9E
SHA-256:	3C9770DF816491A1C40167F1C53A46FB17122962B646A72F604ED3044A981DCC
SHA-512:	BC184A0543AC3022AC17527A5569CA2105E1A9B779B829A7B1FB3A72BD2B429797E1E09A229880E5803F38809A17D2FE019374D87EBC6658AB55DB837DF5C6A3
Malicious:	false
Preview:	ElfChnk.........6...............6...........(o...p...].O....................................................................\|.3.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#....................................................................X..........**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.887574143139413
Encrypted:	false
SSDEEP:	384:BhoIRbiY8sITkAI6RdkbI4IfIixIWMIPIxIJI7IyIUIgIoqIuILI:BOnDB
MD5:	59A9F7EF42800364F6BF938C549BBD94
SHA1:	43FAC818EB3960E73963CFD78F1AE4DE6A3799D6
SHA-256:	E2BD020B97A6FB59EF57126B4DC72C56E7F457A06C7F911243C77BC0C1ACC206
SHA-512:	2A62CCA656E0761FF2C1F585207C03B19E9E827C80293C9A402C01A353D47774BC97A7A48CD136862131F18434DD29245D3A1E20E88A72AF45824ECAB6B26153
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....&......................................................................e.................&.......................N...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..x...K.....................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	174960
Entropy (8bit):	5.698713278565312
Encrypted:	false
SSDEEP:	1536:+AfWFqEEdF7VlAfWFqEEdF7V5bXTAfWFqEEdF7V+/q:wc
MD5:	7E1E24649D46141E1845C0E577603572
SHA1:	D9823B62595AFC05C531DBF33CD7A2F56CDBB011
SHA-256:	41E2EB24E4C9F65C7E615D1409AD32632F9C3701EF65EEE524EED8E21E05BD2D
SHA-512:	9AFF418B318F44FFEB2C00C56D5DDB6C1EA0D897590883F21FB648E0B526931D46E0C0EA69F747C36B80C12C664781525FA607C55D0ABBE1EDFFD991F258C13A
Malicious:	false
Preview:	ElfChnk.....................................x...`...BF........................................................................V.........................................:...=...........................................................................................................................f...............?...........................m...................M...F........................................................................................2...........~..................................!/..........**..@...........kQ...f........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9969363418868648
Encrypted:	false
SSDEEP:	384:Oh1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMGmMqb+MvhMIp:OeJWU
MD5:	F3F76FCFEA8151604EA805CB80B1FF45
SHA1:	53062346A40583E0ED706493B387818CF85A608A
SHA-256:	46BE32A18F777427FCB76E515EDD8612F22823F8D5F9C75FAF64DFBC9D810BC0
SHA-512:	DF7829C3655FC7F7AF8C6F82DF8F48C3842AB6AC99B32705AC232DDD1D7398A93B3C03BA8217D055702FB8881AC8FC5DECCEAB8E2ED23F8B73C7B2737DFD00C2
Malicious:	false
Preview:	ElfChnk......................................+..0-...i........................................................................z4........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&............................................................................................................%..........**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.231994720329579
Encrypted:	false
SSDEEP:	384:ehk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS16:eBjdjP0csCk+
MD5:	2418B580C396BF3D2B2E78EF78F65991
SHA1:	5AA4D8E6E8EC06232294A57762DCF70B6A4AEC46
SHA-256:	4FA9363ED99CF66AA2B887DB72C99F7E21B364AAFE0C169B5CEACEF72E971557
SHA-512:	650C05CE840801E047324A41E74F07718BC4503AD16860C4161B31027B2D480F0DD72B1EB936F08C3985DDAE151D7340D1C7DD09C61F957694A3A800F7923F4C
Malicious:	false
Preview:	ElfChnk.........................................p...$.._......................................................................5.................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77968
Entropy (8bit):	3.337905347761276
Encrypted:	false
SSDEEP:	384:qKIjgZIIIlIBI5I/+IPI3IBCIFsWIKI//IwvIaIEI5ILI+IseIpIBhId/hDIEQAU:qKWYu/ZxGuTcrgWY
MD5:	4B6D61F581101FEB860BB4BD567758F2
SHA1:	9D4B6DD81D01ACF3451D72A4ADA1988B7CC5F4C7
SHA-256:	0D0A49EE81A32246A755B4793A390DB42D01E095DFD1457E21C6376307110F54
SHA-512:	7AB23B44D0FBE29976868982CAC13000486DBA727B60B64A5E5085CA8D828A90FF756BFD2EDBB6062449D17698C4B2DC06C75B623033BCDAEAE6ABB1D6EE9D6D
Malicious:	false
Preview:	ElfChnk.T...............T...................P...h..........................................................................?.."........................................>...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................1........................................<...............(..........**......x............f........F...(..............................................................,.......D.....!........... ....@.....f.....................x...x....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l...........&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8010759015442367
Encrypted:	false
SSDEEP:	384:Zmh6iIvcImIvITIQIoIoI3IEIMIoIBIjIIQIYIRIEMIO4I:ZmoxDJ
MD5:	697F5D7E812BBBA5F48BAEEE79161558
SHA1:	2BB9620AEAFE781DAD1250C78AE760F530C04FEF
SHA-256:	1F9630EFD18553522D80986F123499E9172D5D8949BD43F82D0964ED671CE516
SHA-512:	166A91F00C96D4B5DB8C75B843FCD2ED191CAF2D82CEB41138FD22663D481CB50BF38D5C522524C94033EE7CD3C303AFA60261F95900299C73E2E0277834C598
Malicious:	false
Preview:	ElfChnk.....................................X"...#..!.._.....................................................................8.Y............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................^...........**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9976457275581723
Encrypted:	false
SSDEEP:	768:j4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH13N:p
MD5:	8B81799FB23EDB0DFBBE63CB0A6D0091
SHA1:	08F10769E5AC65A808F3229113875C18E68F02A2
SHA-256:	199F3107FA0F478BECC0D255CA70F74B63F048F6B43015C4BCEFC7DB07358609
SHA-512:	098626BC09ECABD19653ADFE82C5CC8A73C4CD1537C28E781484F6B676E837896C892B3E0691E5D469C1972A76B646456E14907280D1040181C1F973B9302E61
Malicious:	false
Preview:	ElfChnk.....................................(...8...&..........................................................................`................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ......................................................................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	194344
Entropy (8bit):	5.268353592440892
Encrypted:	false
SSDEEP:	1536:SXYQLB7/KcCDqIRk0xN8ZX3CDqIRk0xN8ZXXXuEvR:0YQDnN
MD5:	7AD5C383D3A28F6D020F068C538523CE
SHA1:	79AC91AC4622A28459C5A1094D7F9185B46AD77E
SHA-256:	A85E98B6B12589CE7BF6F2FC229B0674C9856EA8D7C1FB8B8B856EF97ABA759C
SHA-512:	D33929BE5315E5B79C65D89DAD3085FBA4C6B524458770645F9DB3F5651748FF7B2B5F438C479B27EC8BFFE43794B7776E530AE0DC3B7F4FD05B9434B6C403F9
Malicious:	false
Preview:	ElfChnk.........:...............:...................?.........................................................................................p...........................=...........................................................................................................................f...............?...........................m...................M...F......................._T..................I........V...X..........w............................R..................?/..od......g&......&........b..**..@..............u..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7589270703948895
Encrypted:	false
SSDEEP:	384:fhP8o8Z85848V8M8g8D8R8E8y8eE8U8+8G8:fy
MD5:	DB0D7D192D45E88155DA386A4CFAA7BC
SHA1:	0CA51DB6F3145F47A7DEE55DD59804DDC20788FF
SHA-256:	4D675E0BB5F2F8FB820C9A7E60290AA18EB63DB48D85C343D67B7D1036CAF535
SHA-512:	77BF88FE30C9A2E76B610094998F26BB168BAC41DA2A70C4BCB9C7A7A67B2821C6E7F2D57535CBB47EBC07A89F69BA997028F30ED43D507CB0E9C268BDC74789
Malicious:	false
Preview:	ElfChnk.........................................8!....RE.....................................................................J>.........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................................v...........**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7675545352357376
Encrypted:	false
SSDEEP:	1536:OXh5UyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:OXLnS
MD5:	D8B108172BDDABA8F7A0020026A449FE
SHA1:	7BD06E551B48B264310A8F1157B3AD131036EF25
SHA-256:	47BF3C4F9DEB25154539C64A9DCC6AC6151B961711F7BD36B69A43C5AC938CEE
SHA-512:	E3501335EE9303FDCA94C629D5FC5CA0AD3E63D4DA0AC8174EE108700611F2F206390039607DAE6F5DE104EE5A8B53042AD0BAB62FD64A5676E53C8F47F606EA
Malicious:	false
Preview:	ElfChnk.........(...............(............J..pL.....I....................................................................Q.kc................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................O............9..........**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96696
Entropy (8bit):	3.0738755771414135
Encrypted:	false
SSDEEP:	768:U0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O4aui1J6eJOQJMBJXw2:4cEDcEa
MD5:	73F44CA5F5DB9228A0FF274E34424B1E
SHA1:	5EF7414E83EECB099C42C07F0E668D8B8231C69F
SHA-256:	A00777AF78E0A35A3038066B0FB89BD85C521090F3390044C01877619DCAA374
SHA-512:	2371B53406A138B53EA20600F26ACE5FDCD45C02242F4D00363E4401DF68BCEC6C273A46266C2E059C21E94DF03480A4F23AA7F290E900D9BBA913E4008B6388
Malicious:	false
Preview:	ElfChnk.........>...............>...........0v..`x....p.......................................................................+#................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&....]..................................................................................]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.090506760697518
Encrypted:	false
SSDEEP:	384:gkhxQiGQ5XpvVRYBQf5kNY6iT5kmFiT5kmqiT5km7iT5kNYkiT5kmNiT5kmtk5yF:ZUbGDA5eVLpBVi7CPDRmf5dX6CFLx
MD5:	42290E3A06232F3164599CEE9F822F97
SHA1:	8D081F75FC9EC36ADF10299FCB8D98822A6DDB39
SHA-256:	C0AEC98CB6185B5CEFDBA70DAED4F3CBCAC40582EF2627DB228D4785B939BAE1
SHA-512:	76B9E873732E071EEEBC6F45783EF521A2016EEAABB9AC5DBF5F2B72D0A815BC3CE7495F55B9967BB76F5801BB56256E87B8DD34B19BD740BAADA986CFA376B3
Malicious:	false
Preview:	ElfChnk.'.......-.......'.......-............1...8...a......................................................................N.Pl................X...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................1...........................................................................................&...........**......'........&.E..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.315070457008112
Encrypted:	false
SSDEEP:	384:NYU/hDGCyCkCzCRCFCZC4MCyCcC7CgzCiCoCD24F2a2EO2M2w2s023C8CJCpCFIz:NYU/dEoNTC
MD5:	C7807651248E908ECCF27697EBB71AF0
SHA1:	4FE175151F778EF674F74D25145CCCF62C52F2C8
SHA-256:	A9D4FFC731E3D8287A25FFE350D5142FE1E9CD5D377F0BD7D29BB827C2F12658
SHA-512:	5A8FA490F7BFC98FD39635AA30A0E92AA3C9FFC279424C7D23E9F2893CF7B0FC91BF1F3DAFD14CA006B437AB6E18FAA67FBF7AF96E5347FE27042B262235214D
Malicious:	false
Preview:	ElfChnk.U...............U...........................$....................................................................O...................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F............................4..............................&................................................................n...........N..........**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.482742417101403
Encrypted:	false
SSDEEP:	1536:bcPLvjwmE+ukWvw75NFyBo/QbG7YX1cchg52p5cfFSYl8ZAgRrfhXWmSY0NGQ6my:bcPLvjwmE+ukWvw75NFyBo/Qq7YX1cct
MD5:	B1F20410E64B0CD42CE4FCBF7AFC9018
SHA1:	4EE19EB81E1C99FDC1C7BA4E87F091AB124FE250
SHA-256:	7AE6BA887BEF8232508D1660717AA893FE68C75D3E4B2D48668AC1E4CD3C0461
SHA-512:	31EDD8B6257AE2C232572765C7ED08A4BA016499A3B0340D55AF1796AD633D17533C0288E07F9B5E74D19A5CF842A63468AE54F61A49F680722E95A48983DE01
Malicious:	false
Preview:	ElfChnk.....................................8i...j.............................................................................5................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&............................................................................I..........**..............XH^...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	69680
Entropy (8bit):	4.461657062929046
Encrypted:	false
SSDEEP:	1536:sCzZEJdhpbxp4HTQMhzEB1PBM+4MFGhLF/EBRyqXiUHeISNpmCzZEJdhpRSYtaSo:sCzZEdhpbxp4HTQMhzEB1PBM+4MFGh5b
MD5:	FFFBF546575C30A151F69FF99418A78E
SHA1:	4E88B02607616CF50AA4C4BA3CD53096B46F3A55
SHA-256:	0240F1EE1E4F59C9B018D8E4A2158FF26EE1B4CC56493994A0488B3FD11EF047
SHA-512:	6AE90615FFA7F62C017056035B822B76DBD4132D54FDF45B1462A69B82A5B123122211614015A3A2CBDD3F104D77A2A85C1A2D5C533C242D90363E3ED1C36F51
Malicious:	false
Preview:	ElfChnk.+.......W.......+.......W...........PW...X..t..........................................................................R................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................yM......Q7...........P..!5...0..........&...Y9........x...Q.......M.+..f........F..&...............................................................8.......P.....!....nqm......... M.+..f..W.-x..NG..-B........x...Q........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e..n30'.\|D..Q.R.a.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......L.0........S.e.cx.....(...R........1..f........F..&...............................................................8.......P.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.512081865341501
Encrypted:	false
SSDEEP:	384:Arhl787V7s7y7s7M787/7m7C7p74797kc7h7s7b7Y717c7v7b7v7vV7p73a7k7Z+:Ut/8Hh
MD5:	50465D28597F69AA4BA1836894D19750
SHA1:	CC55004E17EAAF1672D0BDAE3A746C40F6AF7593
SHA-256:	376CBE44BE97D96C93CAB0B83E5480DF2D3EA3CE0169E199BBAC9D7650F4AB93
SHA-512:	725A9F34A7A98390A365F75B2701E31331C2F3CDD1CF62BABB20C3F5655DC0798469B353E7839E8159DBBE733B58A76DA3ABDAC6E7EE4A4D672CB934AC296F49
Malicious:	false
Preview:	ElfChnk......................................n...o..-o......................................................................../V............................................=...........................................................................................................................f...............?...........................m...................M...F...........................-(..............E!..s...........&...............................................................-&..........f@..........**..@.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.2719028651564623
Encrypted:	false
SSDEEP:	384:/hc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauing:/6Ovc0S5UyEeDgLLyfrlB8Q54GJY
MD5:	104AF6C87B1FA1C965BB2D3CF70EDC8F
SHA1:	91B208CE7ACC6EDAD1ADC8C5ECBB90000E00CEA2
SHA-256:	6DB30804B563EE808F78EEC69D3A85FF7F3F0FE551306B5924530C2C0EC2738C
SHA-512:	90A83431708CD8FBDC9FAD6AF191EDF3E264D8DEB457ABBCCA8941E15DE0DD4E4C2FB2D89B281C2FA11CA5D627010C96EBE3C43B6338DCA27E7701A883F8C295
Malicious:	false
Preview:	ElfChnk.........@...............@........... s...t..?h......................................................................._R;................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................................................................w...................._..........**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8167930057519079
Encrypted:	false
SSDEEP:	384:bhGuZumutu4uEu5uOuDuyb2uPu1uyuKtuLujuVgqu:bb+
MD5:	EBB9255F7BBA5C52CE625D69FE52F60A
SHA1:	20F226B11EF3A69F56A13A5BF7530E199BFDE310
SHA-256:	5AB28568919B051FA95E534049B8BA9E606EEF6EAB53EB0ADB71545C0ED2A380
SHA-512:	D8788F58A8DE7C9BD6F7075DC65606508D14C8AD8AC75E8992174A4D35328E70635AEC36531DA5E81A8DABD931092576C60C5B831C73670D856A40BD2427CB8E
Malicious:	false
Preview:	ElfChnk......................................"..x$...k.3....................................................................$.#.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................................>...........**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.235001208884112
Encrypted:	false
SSDEEP:	384:iGhRAEA/sA/8A/gA/lA/KA/EA/DA/ZA/oA/nA//A/PAzyEAuA8AjCbALuAMAKAtZ:J0hVi+KLN61G
MD5:	50EF6DB57587CF27291B2DED1AD3C542
SHA1:	ECF5C56F998FCA95BE4BA119DC5E241C693DB891
SHA-256:	14AD1DF267604F097745CC1A5C2DC6EDFEABF7E89A69A194B5433363A847F530
SHA-512:	E774A896DA5119D270D59E02DF113CF3E2FC774A24A0A7BDDB39E5D5D614B1F905BAA81FF59790811CAF51B4B92854A06C042D869EA2C52AB19E955E9BB00E4F
Malicious:	false
Preview:	ElfChnk.........!...............!...........x.......<......................................................................t..................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F....................................................{...........................................f......................................&....j......**...............>............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.1601920702980912
Encrypted:	false
SSDEEP:	384:NhwpsWp90Np9b5p9ihp95lp949p9/pp9Wpp9tlp98Jp9jdp9qBp9BJp9A1Z1p9nP:NRZfQI5
MD5:	1A84D5BFFC6A51A8E813CA9870D46851
SHA1:	62201D49F347A7BEEA7D58DCB45D173ADBD53887
SHA-256:	CBF067DCF2548398B87EB882B7A1F26EC7989DBB4D105C4495020D63E9B5E0D8
SHA-512:	8B3198C3534387FEF8B8120ED0111F6EA02BD21FC3E8C4E74C4936BE18581C80BEF58EB512E111FF0143361E488F1F7C7D3151664E0F4FD996169C894162B24C
Malicious:	false
Preview:	ElfChnk.........'...............'..................._.z.......................................................................j.........................................<...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**............................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.0114620219781365
Encrypted:	false
SSDEEP:	384:jhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBo:jwDoh1VvpE0Y5RA8sQ
MD5:	70F943A767EE17A83B03D620404602D6
SHA1:	26A2A2C8690D3F47D6192DDC29079CA4DE7507A6
SHA-256:	AAE4D860D5B31157D69935C9A68A8958EF96D9EBB7AB346B8F750E7FD339FBE5
SHA-512:	88CAB5E94A82F49036C5DC4A3C3DE94BADB9A2244C4A32DAE6A23DFD751553B0FF9953C21B02CA0396D5DBF529C75B57D1A65D9EA86CE86D8D081E63E464D521
Malicious:	false
Preview:	ElfChnk.\...............\.............................G......................................................................\O.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..^...........*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.165801171629505
Encrypted:	false
SSDEEP:	384:thwCCRzCaCkClCzCYC/CyCVCGCMCvCtlCaf2Ca9CaECaAzCaFECa:tKFD
MD5:	9236B0363C2E488481D99C2A3B97F664
SHA1:	7DF4CAC91226C2E2E36DB78D931D4D8386177406
SHA-256:	968CA40848BDBDDB24126CF3BA1EFE51973835B62A841A13ABBC3F3F76E2AAEC
SHA-512:	7ADE9B5AE3499BB97FBBCAD1F38F530E9592F4CB4AC3472553A340E0D172704CDD3EA2DE39914F5A2ACB87934037EFDE369AF960256269AC221B5AD9724BE31C
Malicious:	false
Preview:	ElfChnk.....................................04..h6...j........................................................................o................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...........................................................................................................v)....../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	86024
Entropy (8bit):	4.638800414544038
Encrypted:	false
SSDEEP:	1536:wgDC0MXKNvQgfhgDC0MXKNvQgfUNDFEzJ03kHuy:wgDC0MXKNvQgfhgDC0MXKNvQgfUNDFE/
MD5:	882DF385C14B6DB8CA49B9B6BF465D59
SHA1:	19489A993433818116882A68E7ECA1942B8E9DFD
SHA-256:	0FDDAAA519F8FAF237FEDAA80091930F655C651378FFC95FE02D80817DFBE6A8
SHA-512:	4A66D227867D3A1F3BAECBD8BB073E794EEE5BAA67CF14143066CC83DA4B99E3953B4A1E6A22CC3549509705150E9C0097EC8464D08F18A7EC9366590E764004
Malicious:	false
Preview:	ElfChnk..&.......&.......&.......&...........M...P..$..5.....................................................................h..........................................6...=...........................................................................................................................f...............?...........................m...................M...F...............................U.......................................................................................................&...........**.......&..........f........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1810965962810462
Encrypted:	false
SSDEEP:	384:vhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUm7UmLcUmWUmnUm:vY7LU
MD5:	9D9C182984FF3C8DAFD9D7D27F9461F0
SHA1:	72E2D06B61F085737906AD835D09009CFD047203
SHA-256:	C3D5C4AD8C13B39C1EC967B6A9DFCA4ACC94E48C00D1BFAA3BCC5D7B6B134EC2
SHA-512:	2906BF522ABB70A1E2F3F3DE63C732CCAC103B7F8D54CECF22730ED08A64BA1F6243CBC95EE1F1568ED45B7E608B60303B31B7A67EFDF52778CD239FF41F58E9
Malicious:	false
Preview:	ElfChnk......................................1..(4.............................................................................................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&......................................................................................................................*..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67776
Entropy (8bit):	0.3675955178776093
Encrypted:	false
SSDEEP:	48:MGVWd88crP+8QNRBEZWTENO4brBT3oq4Z/6ykVWd88crP+8QNRBEZWTENO4brBTI:RUNVaO8Jov/6y4UNVaO8Jov/6y
MD5:	FB6A77BFC0F2CC2543E6E7E36760EF28
SHA1:	C12513E3D29C1CEE05735C5D4E5A2AAE45406434
SHA-256:	FFB1CC07E30800A2F863320FB1C70607BB0784A6750DC734AE5D1129248E9A62
SHA-512:	D4F44073C1C749509792AAB3868D1E007320A40E3C72562971328A485518BFEE1D98DAC6770C60105563D182027AC60B2764323218B82DF0B6176A7D3F8C8924
Malicious:	false
Preview:	ElfChnk...............................................N.......................................................................%+................".......................J...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**.................u..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.07967961973305
Encrypted:	false
SSDEEP:	384:VhIivhiuiMidiyiMi3iEiziXviiqYiMciEiri9iuiLsRi11iWiRmiNiHibifiGiS:VjZvaQKtM9QSp
MD5:	C0228093C6D68E6BF2A2919C4757E19E
SHA1:	4C30BEAA7AB56231126956EC83C6B9159B7C7809
SHA-256:	214406B4B4C04186B2955537F29AC633824792BABF9EE5051B0857CCF9AE2763
SHA-512:	B0E558BEF4B6A43636B87FDAA598BF8329E15920503ED2460B4D0B251BBB29B9CFAC37D35AC5DB0890A65F80A1F6F6AD85A0613CA36E550E70FE1A4354B2CE9F
Malicious:	false
Preview:	ElfChnk.y...............y....................g...i..4........................................................................L..................#..a.......................=.......................#...................................................................................................f...............?................'......P.......................M...F............................................#..............................................................................w#.......'...0..........**......y.......>}.T............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.399283020631885
Encrypted:	false
SSDEEP:	768:0yaQLza9aFadadadaZadatahaJa9aNa9aFaOSaFata1ataNa9aRahada9aJatapy:9L
MD5:	54208FDC0681EEB19DD55D526E591FB4
SHA1:	7707617FC32F341A60280B97351CD4AF79D5B7D6
SHA-256:	152F29295625822C1AAC740F1A45D28B5D74E2FC2EA6980FA8DB5212E2F8BDC1
SHA-512:	BBE089058888C966E62E7F6902B0CA877EA472E40651B173A06CE9AC479364D494FACCE1A1E338C0622CA8944ABD2CAA5B4FE05F1B7EE3569368482E2964223F
Malicious:	false
Preview:	ElfChnk.........@...............@...............`....i./.......................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................;.......................&...........**..H..............b..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3642612685419924
Encrypted:	false
SSDEEP:	384:dhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJ1qXJNXJLJXJxXJBXJfXJKH5:dQ0yUkNYwD8imLEUzL/HXxS
MD5:	727E32931085339B0D59890FD3759197
SHA1:	1281993447169E4AF0F4EEDE4F70524D766189F6
SHA-256:	66D8CFCF522ABCC5813640D9315FB0FC1497236FEBAE41E1095547E137759BFD
SHA-512:	24BF05FA33772320686E4BD6BF32512DD7BE460393304178292B93E7440B7D198A603C9EB45CCED0479A651C5D752B8E688A207B05E180793D41581E3AACE2FC
Malicious:	false
Preview:	ElfChnk......................................A...D....n........................................................................h................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........................................................C................3..........**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.339319118040676
Encrypted:	false
SSDEEP:	384:mh/mcmtmrmsm1mkmQm6m4mnmdmgmsmnmChmxmomMmqmwmHmLmlm9mGmdmpm3mfmP:mNDcxPuxE9KA
MD5:	F2254833A2ECFC2BE8343C689060E95C
SHA1:	4E4CE2B2AE58A6A2EFB7D563F17DCBA59A83D2A7
SHA-256:	A8B52451086D3042E2353D49E565422A083018D22C89F8447889BA77312DEA65
SHA-512:	38DB34911D61CA2EFE5767C0344BEFF5D81ECEB09B6F7C1F8BC34F0E6F8DEBBB010471A78AA181D4F43941C91AB5C6DFD1D26970AE766E1E208DA776D4FC5FA5
Malicious:	false
Preview:	ElfChnk.....................................@)............................................................................[=.t................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................................s...........................................%...........................................&...........*..p.............k...........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7077930323266531
Encrypted:	false
SSDEEP:	384:ohK2nl2U52N2h2Ii2wAx2wI2ff2iW2R12Qc2nT2:op
MD5:	EFAB9CB2241340892CAF25215B175900
SHA1:	379AAFFC0E9465FBC553A8CD7587F45D07274D24
SHA-256:	852B282863F4AD8B40A1CB715C9F3EA8B243472EF1D9E95035408AB586EB49BC
SHA-512:	2702DFE388394AE71F7D2F012E3003F2D3586A5CC2300605D2FF2B14A3F99E4F7443D37203E9EB37101510406C34B6258063807359C31DEDDFE2177ADCB8CBA7
Malicious:	false
Preview:	ElfChnk...............................................k.....................................................................O..w................N.......................v...=...........................................................................................................................f...............?...........................m...................M...F...............................'.......................................................................................................&...........**...............a............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 10, DIRTY
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	1.2817961984652106
Encrypted:	false
SSDEEP:	768:3kxEpP9JcY6+g4+Ga6oDXxIb13xIb13xIt13xI:3kCpP9JcY6+g4+Ga6
MD5:	DBB33B8E4D2B78C61647ACFD99C89240
SHA1:	9373F12B7039F1B52C2EA7203BC895C35788AD5C
SHA-256:	99E865093BB6F181A0CF0D1E8056DA859DFAED1EDEE104909BBA52998644E9BC
SHA-512:	0B43532A88103E9EDF9BF180716100A1B6A7596C5C50D9F7D6DEAE1BE00E4F6A7387942656EC3C4873B8200EE970FC446A955996EA8862CA6246F20154B56B90
Malicious:	false
Preview:	ElfFile.......................................................................................................................zp........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	107840
Entropy (8bit):	3.560130587611318
Encrypted:	false
SSDEEP:	384:LJhpRuVRNRFBwRkRZR5FRT3RWQGRhRW0RWCRiCuRGRNRJRWCJRkt+RW0RFR6SRUe:LJKvaFTLAJKvaFTL8
MD5:	85F1C4A1BC8C21EE1DA86249A3CDD811
SHA1:	AE575058B36E350EBE430A3656F738BD50D4A1C7
SHA-256:	EC4EA870D1354B2AB9B51F316DC3D9EAC40B4D12A3B0A43B06814F2FDAD4C5C4
SHA-512:	7DD06074E187C34779DE578D1FCF895A94BE0B6BF100BC8D30685C8DF2C98A31F3543A0064D6926FEBDE697FFCD53954B27E22A3BB0ECF0B6EBCCE008A45B64D
Malicious:	false
Preview:	ElfChnk.....................................@...@....R..........................................................................................................N ....... ..=.......................................h#......................}...3............................ ........... ..............f...h...........?.......................h.......Y.......M.......M...F...........................................f?......................................................A.......A#......................&...............**.............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.269282050125859
Encrypted:	false
SSDEEP:	384:Vhghshy2h0hEhDh9vhghp6hXghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLha8:VbsFpkBSqL8wD
MD5:	A58CC6DEC3C876BEEC16907FC49E19BA
SHA1:	C2617D099C46BD902D85BD8FE90FC6F34995BA5A
SHA-256:	BE9A153D8CFAB9F25D94444C14641599D6F8C868DB9675D3FA330E0C7C0110A6
SHA-512:	4311D7F2C987CCE1F5EE8F78B867A87BFDE8D5E28C996B2BF1347B41063F38B6CB98BE968A962064C5920B9F355AA537FE5370FB78D52C69F5B81B279C394D5D
Malicious:	false
Preview:	ElfChnk.............................................b.......................................................................<...........................................l...=...........................................................................................................................f...............?...........................m...................M...F...........................................a.......................................................................................9...&...........**..@.........................F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2593916356001515
Encrypted:	false
SSDEEP:	384:ahOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOV5VqVFlVmV8VVG:ayjbS
MD5:	14652E4148A13AE019B3CF2CC20B5812
SHA1:	0D6C33AC1CF9CF3EDB3B4632A0943BC7ED7521FC
SHA-256:	3946831B472B0248BBBB225A2253A26A693E9155C3FFF0D8CE29897E07573134
SHA-512:	0306DB2CBFEB878570FF4B4342CD6E89B056D9FE7E41029CE17FD08953749351EB65C8B942D36EB7842F6167219997D876270DC0B5528F4FFC13EB310B8F0324
Malicious:	false
Preview:	ElfChnk........."..............."...........`8...9....H4......................................................................4.................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v...........................................................................&..........*..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 5, DIRTY
Category:	dropped
Size (bytes):	4792
Entropy (8bit):	4.026965098863943
Encrypted:	false
SSDEEP:	96:EZ1RNVaO8sow/sTYS5oz/sTf/sTpi/sTpbRrjjsV/sTz:EZ9V7Xk8kozkDkNikN1vakf
MD5:	821F649921B8C7179B6C69E9390EFA83
SHA1:	6110976C31E072D4830210E59B3D94FB4ECA586C
SHA-256:	F270F04284E0DEB3EBAFB7FDA3D95D44F41E6FEEFACF922A18CCE1464CFFDB29
SHA-512:	73336DD68AF78346338F398547834D5231492CF7A97C1F7B317423ABF5D332EF7C0F101685F61AAAC8178ABE48CB910545F200BA6C8E38FA3332B1FA93996D9C
Malicious:	false
Preview:	ElfFile......................................................................................................................RyNElfChnk.........................................8..........................................................................fL..................\...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................5...............&.......................................................................................**..............r..!..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.321350579003702
Encrypted:	false
SSDEEP:	384:3h4BwBxNqObx1rBwBwQtBwBnp+/0JBwBc/wBwBwtBwBwTBwBAs0BwBABwB2oBwBI:3/NqObx/Ms/QfcjDsM
MD5:	5753C5DA2999E5EB24CC2BE76D2F0ECE
SHA1:	0DD2CE3FD1CCE96824AEDAE76C58343E7B75DF5A
SHA-256:	23D70D433A33814EE004B0D2F8BA64D1C39482293CBBAC98C09540D3FD869283
SHA-512:	ECE8D33341F2455E3F3A8D44E194F3B4E274CFAB521C1D7483A71497F372D7EF528340325DF9320A215700C5058FF04A0017E06603DF24186C068E677D0C5DE9
Malicious:	false
Preview:	ElfChnk.....................................X....1...`S~....................................................................C..w............................................=...........................................................................................................................f...............?...........................m...................M...F....................#......i...........................................................................................................&...........**..H..............A..........F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.396202402379334
Encrypted:	false
SSDEEP:	384:IMh4UEiUEfUE5UE0UEfUEtUEpUEAUELUEvUEcUEJUEBUE3UEHUERUExUEeUEaUEW:voHgSNX8+BoUYUkIO
MD5:	838CCFDA7EEB847C3F96507592B3480B
SHA1:	1D1C0CA6AFCCC861AFB6B7D2BD500657CC139AC7
SHA-256:	2E474ECD1D96758EA0BD52D3C594998DFC30DCB83270638B107B41B81FB51339
SHA-512:	59156BC3267CABA12BB8F542EF10E409F0E685731E8C916681457C9376B36A84DB13B29F006C049528E1E78D63168B9C4B521088FB08445F208432BBDC0EC749
Malicious:	false
Preview:	ElfChnk.....................................0).....N..,.....................................................................i.........................................R...=...........................................................................................................................f...............?...........................m...................M...F.......................................................................................................................................&...........**..............4.............F..&.......F...0.V%.d..wr........A..~...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	105712
Entropy (8bit):	4.449901489636788
Encrypted:	false
SSDEEP:	384:FFRUBGovbV5ohhoPXoLG9WS6CoOCoLG2oLGEoPkoPjboLG+eSoeSoLGdoLGEoPv0:Hspsay5yt0WW398Q4D2WBsmxE
MD5:	E6FFBFAE55B8849A25816086920912F0
SHA1:	9461ADA1927FE4C0F4EE4CB27C15DE3B20AB9D74
SHA-256:	FE2C8BE91C25F240390A5E3A64C52842AF13E7714C8553CFF29502B2274A3AE8
SHA-512:	4CCE5558A9F2A7D3F41BBD650760F9F9C9EB3CF9B07037FA8654EFE716F5FE545DF8E581BCDB61C03C7F2CBB658DC7E6C1C78D9ACBFAD2FB9EBA53B8DE81458A
Malicious:	false
Preview:	ElfChnk.....................................h6..x8..A)......................................................................3rP.................d...s...h...................=...................................................N...............................................w.......6......................./...................................]...........).......M...T...:.......................................................................................&...........................................F...=.......**.. ................f........0.;M&.......0.;M.j.Y)..G2.zA.......A..5...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....^...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	79904
Entropy (8bit):	4.885534819572413
Encrypted:	false
SSDEEP:	768:DWcWMzwDl3VGg5OwELSTFxCydU5ESmqiWqiZqiKqi9tWcTveb:4DX/1MZTiDiEiPiPb8
MD5:	78035F7933877CACCB2A2F6238A59C83
SHA1:	184A70BF419838E815CB069CE6735B7550BB8978
SHA-256:	94DE6972A729DE51C5D145C6F29441844D390945887A0BB4CB92F4C4C357E726
SHA-512:	045BD66FB93B9EF5AC01F73851645336316303FBBE21AC6D31D8BCA8C9868EE2EE8E97E4C41F5427F7EC62604A27BCC3C11315CFE0729D2901E10820F0D40DC1
Malicious:	false
Preview:	ElfChnk..............................................P.&......................................................................k.....................s...h...................=...................................................N...............................q...............w.......2.......................G...................................Y...........).......M...5...:...........................&.......&....................................................................... ...................................**...................f...........l&..........l...R...`....=.......A..1...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....Z...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\mssecsvc.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3784704
Entropy (8bit):	7.693085604801658
Encrypted:	false
SSDEEP:	98304:48qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8s3:48qPe1Cxcxk3ZAEUadzR8s
MD5:	433720564D376A59C4FC3F2F8ACEC030
SHA1:	1B67A91E2CFF865A48044C68450FF3E049C6FE03
SHA-256:	8A011965CE221498AEA2C6AC4D3EE14BAA25084754114A6B6B6D72DA416DF8E3
SHA-512:	40F87B8E000BDE626EEABFB434548FD2E21C2D37EF169DC331854EFD35E5B089132CC6F5865AFDFA2D260EF82F1FFBE94A1E2EE5C5C41E34AC489B23E48ACE0C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 95%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L...%U*H.....................08.......g...........@...........................g......................................................1.. 6..........................................................................................................text.............................. ....rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...vzdbmga...... g......@9............. ...................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	7.777724762407647
Encrypted:	false
SSDEEP:	98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8s3x:QqPe1Cxcxk3ZAEUadzR8sB
MD5:	79409B6F48460807480E4A574312D85F
SHA1:	5D9F64CCF13081441F2785A535E02312236445D9
SHA-256:	331E14A6594B700B6167690430C9DA72FEE72D408DD1B8C5CB155C0199033D0A
SHA-512:	AC004B3248CBC2CE7B6D566E3F5128195669E5C53C24AE13668E37FDADCB5158CC345D7A33CADFED6328A25A640C5FA612D0F0DB86989C3ACC21771B55508916
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 93%
Joe Sandbox View:	Filename: UR9TBr66am.dll, Detection: malicious, Browse Filename: eAx3JV2z84.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.142203098578501
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	542CxvZnI5.dll
File size:	5'267'459 bytes
MD5:	be3c1ef872e8e146ff78e66271ca261b
SHA1:	0e3c7374332d4a507fdbd7b30f5f78d7a4fbafcc
SHA256:	f63eb4858e66889e8b62e6e72fe5d5620995c3fccaa8cd23043c22ddb3c6aa02
SHA512:	38cb75392e90e52a874f1e0bf128f3156d0e330fd67ca68f0b109219f232235eaf39e7e207c21c31aba01b15594c65bfabea8a40856000dfc4cd41699d4f0486
SSDEEP:	98304:18qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8s3:18qPe1Cxcxk3ZAEUadzR8s
TLSH:	0D36E052D2850EA4D5E10AF61269DB50A77F2F5582AFB23E2621402F1CB7F1C9DE4F2C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F2F288825FBh
cmp dword ptr [10003140h], 00000000h
jmp 00007F2F28882618h
cmp esi, 01h
je 00007F2F288825F7h
cmp esi, 02h
jne 00007F2F28882614h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F2F288825FBh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F2F288825FEh
push edi
push esi
push ebx
call 00007F2F2888250Ah
test eax, eax
jne 00007F2F288825F6h
xor eax, eax
jmp 00007F2F28882640h
push edi
push esi
push ebx
call 00007F2F288823BCh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F2F288825FEh
test eax, eax
jne 00007F2F28882629h
push edi
push eax
push ebx
call 00007F2F288824E6h
test esi, esi
je 00007F2F288825F7h
cmp esi, 03h
jne 00007F2F28882618h
push edi
push esi
push ebx
call 00007F2F288824D5h
test eax, eax
jne 00007F2F288825F5h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F2F28882603h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F2F288825FAh
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	fe5022c5b5d015ad38b2b77fc437a5cb	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	0a77449cf0d1b94754f2c4139a743468	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.877049446105957

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T02:52:28.619850+0100	2012730	ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup	1	192.168.2.5	49261	1.1.1.1	53	UDP
2025-01-15T02:53:20.056518+0100	2012730	ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup	1	192.168.2.5	63298	1.1.1.1	53	UDP
2025-01-15T02:53:28.828299+0100	2811577	ETPRO MALWARE Possible Virut DGA NXDOMAIN Responses (com)	1	1.1.1.1	53	192.168.2.5	49370	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 02:52:09.810143948 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810240984 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810297012 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810329914 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810364008 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810386896 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.810386896 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.810396910 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810431957 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.810450077 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.810969114 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811002970 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811034918 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811059952 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.811068058 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811089993 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.811623096 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811656952 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811678886 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.811691999 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811718941 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.811741114 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.864240885 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.902426958 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.902442932 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.902501106 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.990799904 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.990911007 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:09.995798111 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.995814085 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.995899916 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:09.995912075 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932393074 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932440996 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932475090 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932508945 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932513952 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.932544947 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932569981 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.932672977 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932730913 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932744026 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.932749033 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932764053 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932779074 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.932794094 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.932830095 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.933408976 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.954765081 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.954821110 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:10.959728003 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.959757090 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.959969044 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.959995031 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:10.973617077 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.117876053 CET	49675	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:11.129908085 CET	49674	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:11.240446091 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240506887 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240541935 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240576029 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240591049 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.240611076 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240637064 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.240886927 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240920067 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240945101 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.240953922 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.240987062 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.241003990 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.241022110 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.241071939 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.256382942 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.256465912 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.261596918 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.261635065 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.261687040 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.261713982 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.261744976 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.317397118 CET	49673	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:11.730438948 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730469942 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730578899 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730595112 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730609894 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730624914 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730640888 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.730694056 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.730694056 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.730694056 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.731462955 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.731506109 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.731520891 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.731538057 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:52:11.731558084 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.731590986 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:52:11.966383934 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:11.966423988 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:11.966514111 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:11.967173100 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:11.967189074 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.755712032 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.756025076 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.760185003 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.760194063 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.760545969 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.761679888 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.761679888 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.761696100 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.762059927 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.803333044 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.932847977 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.933016062 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:12.933079004 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.933209896 CET	49716	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:12.933224916 CET	443	49716	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:16.440470934 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:16.440507889 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:16.440572023 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:16.441740036 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:16.441757917 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.243046045 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.243192911 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.248660088 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.248672962 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.249006033 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.250281096 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.250281096 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.250312090 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.250485897 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.291335106 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.422555923 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.422672033 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.423055887 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.423652887 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.423671007 CET	443	49719	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.423702955 CET	49719	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.473115921 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.473166943 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:17.473273993 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.474247932 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:17.474276066 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.257375002 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.257621050 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.259862900 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.259901047 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.260237932 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.261888027 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.261955023 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.261967897 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.262123108 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.307332993 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.432503939 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.432678938 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:18.432763100 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.432948112 CET	49720	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:18.432976961 CET	443	49720	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:20.723815918 CET	49675	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:20.739264965 CET	49674	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:20.917535067 CET	49673	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:22.702295065 CET	443	49711	23.1.237.91	192.168.2.5
Jan 15, 2025 02:52:22.703349113 CET	49711	443	192.168.2.5	23.1.237.91
Jan 15, 2025 02:52:26.934753895 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:26.934843063 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:26.935086012 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:26.935887098 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:26.935921907 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:26.942864895 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:26.942903042 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:26.943133116 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:26.944188118 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:26.944216013 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.722179890 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.722263098 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.724967003 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.724977970 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.725771904 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.727305889 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.727353096 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.727361917 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.727437019 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.755760908 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.755877018 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.758522987 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.758542061 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.759393930 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.764447927 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.764447927 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.764448881 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.764472961 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.771333933 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.811345100 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.897452116 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.897579908 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.897639036 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.897736073 CET	49742	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.897754908 CET	443	49742	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.944645882 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.944855928 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:27.945178032 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.945178032 CET	49743	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:27.945213079 CET	443	49743	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:28.638199091 CET	49754	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.638273001 CET	49755	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.643032074 CET	80	49754	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:28.643090963 CET	49754	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.643117905 CET	49754	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.643119097 CET	80	49755	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:28.643296957 CET	49755	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.643333912 CET	49755	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.647918940 CET	80	49754	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:28.647983074 CET	49754	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.648061991 CET	80	49755	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:28.648106098 CET	49755	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:28.654258013 CET	80	49754	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:28.654438019 CET	80	49755	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:33.689945936 CET	49789	445	192.168.2.5	95.214.158.125
Jan 15, 2025 02:52:33.694780111 CET	445	49789	95.214.158.125	192.168.2.5
Jan 15, 2025 02:52:33.695135117 CET	49789	445	192.168.2.5	95.214.158.125
Jan 15, 2025 02:52:33.695135117 CET	49789	445	192.168.2.5	95.214.158.125
Jan 15, 2025 02:52:33.695354939 CET	49790	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.700073957 CET	445	49789	95.214.158.125	192.168.2.5
Jan 15, 2025 02:52:33.700182915 CET	445	49790	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:33.700213909 CET	49789	445	192.168.2.5	95.214.158.125
Jan 15, 2025 02:52:33.700329065 CET	49790	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.700329065 CET	49790	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.705254078 CET	445	49790	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:33.705393076 CET	49790	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.731924057 CET	49791	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.736722946 CET	445	49791	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:33.737901926 CET	49791	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.737962961 CET	49791	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:33.742742062 CET	445	49791	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:35.662362099 CET	49824	445	192.168.2.5	138.40.81.25
Jan 15, 2025 02:52:35.667191982 CET	445	49824	138.40.81.25	192.168.2.5
Jan 15, 2025 02:52:35.667269945 CET	49824	445	192.168.2.5	138.40.81.25
Jan 15, 2025 02:52:35.667361975 CET	49824	445	192.168.2.5	138.40.81.25
Jan 15, 2025 02:52:35.667551041 CET	49825	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.672508955 CET	445	49824	138.40.81.25	192.168.2.5
Jan 15, 2025 02:52:35.672568083 CET	49824	445	192.168.2.5	138.40.81.25
Jan 15, 2025 02:52:35.672601938 CET	445	49825	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:35.672672987 CET	49825	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.672743082 CET	49825	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.673798084 CET	49826	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.677567005 CET	445	49825	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:35.677752018 CET	49825	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.678541899 CET	445	49826	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:35.678654909 CET	49826	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.678829908 CET	49826	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:35.683545113 CET	445	49826	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:37.678694010 CET	49861	445	192.168.2.5	149.11.181.160
Jan 15, 2025 02:52:37.683746099 CET	445	49861	149.11.181.160	192.168.2.5
Jan 15, 2025 02:52:37.683818102 CET	49861	445	192.168.2.5	149.11.181.160
Jan 15, 2025 02:52:37.683986902 CET	49861	445	192.168.2.5	149.11.181.160
Jan 15, 2025 02:52:37.684063911 CET	49862	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.689173937 CET	445	49861	149.11.181.160	192.168.2.5
Jan 15, 2025 02:52:37.689191103 CET	445	49862	149.11.181.1	192.168.2.5
Jan 15, 2025 02:52:37.689275026 CET	49862	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.689358950 CET	49862	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.689600945 CET	49861	445	192.168.2.5	149.11.181.160
Jan 15, 2025 02:52:37.691167116 CET	49863	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.694207907 CET	445	49862	149.11.181.1	192.168.2.5
Jan 15, 2025 02:52:37.694273949 CET	49862	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.696052074 CET	445	49863	149.11.181.1	192.168.2.5
Jan 15, 2025 02:52:37.696346045 CET	49863	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.696388006 CET	49863	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:37.701464891 CET	445	49863	149.11.181.1	192.168.2.5
Jan 15, 2025 02:52:39.694133997 CET	49900	445	192.168.2.5	181.1.73.231
Jan 15, 2025 02:52:39.698961973 CET	445	49900	181.1.73.231	192.168.2.5
Jan 15, 2025 02:52:39.700259924 CET	49900	445	192.168.2.5	181.1.73.231
Jan 15, 2025 02:52:39.700299978 CET	49900	445	192.168.2.5	181.1.73.231
Jan 15, 2025 02:52:39.700464010 CET	49902	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.705235958 CET	445	49902	181.1.73.1	192.168.2.5
Jan 15, 2025 02:52:39.705279112 CET	445	49900	181.1.73.231	192.168.2.5
Jan 15, 2025 02:52:39.705301046 CET	49902	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.705323935 CET	49900	445	192.168.2.5	181.1.73.231
Jan 15, 2025 02:52:39.705363035 CET	49902	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.706428051 CET	49903	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.710199118 CET	445	49902	181.1.73.1	192.168.2.5
Jan 15, 2025 02:52:39.711239100 CET	445	49903	181.1.73.1	192.168.2.5
Jan 15, 2025 02:52:39.711318970 CET	49902	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.711330891 CET	49903	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.711401939 CET	49903	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:52:39.716139078 CET	445	49903	181.1.73.1	192.168.2.5
Jan 15, 2025 02:52:41.766540051 CET	49939	445	192.168.2.5	94.120.0.35
Jan 15, 2025 02:52:41.772550106 CET	445	49939	94.120.0.35	192.168.2.5
Jan 15, 2025 02:52:41.772630930 CET	49939	445	192.168.2.5	94.120.0.35
Jan 15, 2025 02:52:41.774513960 CET	49939	445	192.168.2.5	94.120.0.35
Jan 15, 2025 02:52:41.780411959 CET	445	49939	94.120.0.35	192.168.2.5
Jan 15, 2025 02:52:41.780493975 CET	49939	445	192.168.2.5	94.120.0.35
Jan 15, 2025 02:52:41.797735929 CET	49940	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.802592993 CET	445	49940	94.120.0.1	192.168.2.5
Jan 15, 2025 02:52:41.802680016 CET	49940	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.805160046 CET	49940	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.810051918 CET	445	49940	94.120.0.1	192.168.2.5
Jan 15, 2025 02:52:41.810117006 CET	49940	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.872359991 CET	49942	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.878160000 CET	445	49942	94.120.0.1	192.168.2.5
Jan 15, 2025 02:52:41.878263950 CET	49942	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.883297920 CET	49942	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:52:41.891169071 CET	445	49942	94.120.0.1	192.168.2.5
Jan 15, 2025 02:52:43.725167990 CET	49974	445	192.168.2.5	193.175.220.134
Jan 15, 2025 02:52:43.730156898 CET	445	49974	193.175.220.134	192.168.2.5
Jan 15, 2025 02:52:43.730411053 CET	49975	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.730511904 CET	49974	445	192.168.2.5	193.175.220.134
Jan 15, 2025 02:52:43.730511904 CET	49974	445	192.168.2.5	193.175.220.134
Jan 15, 2025 02:52:43.735301971 CET	445	49975	193.175.220.1	192.168.2.5
Jan 15, 2025 02:52:43.735395908 CET	49975	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.735395908 CET	49975	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.735481977 CET	445	49974	193.175.220.134	192.168.2.5
Jan 15, 2025 02:52:43.735569954 CET	49974	445	192.168.2.5	193.175.220.134
Jan 15, 2025 02:52:43.736105919 CET	49976	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.740289927 CET	445	49975	193.175.220.1	192.168.2.5
Jan 15, 2025 02:52:43.740353107 CET	445	49975	193.175.220.1	192.168.2.5
Jan 15, 2025 02:52:43.740396976 CET	49975	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.740988970 CET	445	49976	193.175.220.1	192.168.2.5
Jan 15, 2025 02:52:43.741045952 CET	49976	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.741101027 CET	49976	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:52:43.745933056 CET	445	49976	193.175.220.1	192.168.2.5
Jan 15, 2025 02:52:44.294665098 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:44.294693947 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:44.294761896 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:44.305634975 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:44.305648088 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.126605988 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.126679897 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.128566980 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.128573895 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.128828049 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.131129980 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.131268978 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.131275892 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.131407022 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.175358057 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.306093931 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.308665037 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.308706045 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.308706045 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.308732986 CET	443	49986	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.308746099 CET	49986	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.739557028 CET	50008	445	192.168.2.5	198.154.22.143
Jan 15, 2025 02:52:45.744349003 CET	445	50008	198.154.22.143	192.168.2.5
Jan 15, 2025 02:52:45.745891094 CET	50008	445	192.168.2.5	198.154.22.143
Jan 15, 2025 02:52:45.745939970 CET	50008	445	192.168.2.5	198.154.22.143
Jan 15, 2025 02:52:45.746038914 CET	50009	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.750796080 CET	445	50009	198.154.22.1	192.168.2.5
Jan 15, 2025 02:52:45.750817060 CET	445	50008	198.154.22.143	192.168.2.5
Jan 15, 2025 02:52:45.750874043 CET	50008	445	192.168.2.5	198.154.22.143
Jan 15, 2025 02:52:45.750931978 CET	50009	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.750931978 CET	50009	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.751332998 CET	50010	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.755960941 CET	445	50009	198.154.22.1	192.168.2.5
Jan 15, 2025 02:52:45.756072044 CET	50009	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.756164074 CET	445	50010	198.154.22.1	192.168.2.5
Jan 15, 2025 02:52:45.756377935 CET	50010	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.756846905 CET	50010	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:52:45.761625051 CET	445	50010	198.154.22.1	192.168.2.5
Jan 15, 2025 02:52:45.851723909 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.851736069 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:45.852102995 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.852791071 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:45.852798939 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.638672113 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.638748884 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.641239882 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.641247034 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.641474962 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.657469988 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.699337959 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.709098101 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.709109068 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.709182978 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.709187031 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.883956909 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.884126902 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:46.884218931 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.925956011 CET	50015	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:52:46.925978899 CET	443	50015	40.115.3.253	192.168.2.5
Jan 15, 2025 02:52:47.755976915 CET	50048	445	192.168.2.5	39.69.187.89
Jan 15, 2025 02:52:47.760868073 CET	445	50048	39.69.187.89	192.168.2.5
Jan 15, 2025 02:52:47.760925055 CET	50048	445	192.168.2.5	39.69.187.89
Jan 15, 2025 02:52:47.761010885 CET	50048	445	192.168.2.5	39.69.187.89
Jan 15, 2025 02:52:47.761141062 CET	50049	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.765872002 CET	445	50048	39.69.187.89	192.168.2.5
Jan 15, 2025 02:52:47.765921116 CET	445	50049	39.69.187.1	192.168.2.5
Jan 15, 2025 02:52:47.765927076 CET	50048	445	192.168.2.5	39.69.187.89
Jan 15, 2025 02:52:47.765983105 CET	50049	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.766042948 CET	50049	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.766264915 CET	50050	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.771009922 CET	445	50049	39.69.187.1	192.168.2.5
Jan 15, 2025 02:52:47.771059036 CET	50049	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.771091938 CET	445	50050	39.69.187.1	192.168.2.5
Jan 15, 2025 02:52:47.771157026 CET	50050	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.771219015 CET	50050	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:52:47.776020050 CET	445	50050	39.69.187.1	192.168.2.5
Jan 15, 2025 02:52:49.770939112 CET	50083	445	192.168.2.5	160.166.64.79
Jan 15, 2025 02:52:49.775707960 CET	445	50083	160.166.64.79	192.168.2.5
Jan 15, 2025 02:52:49.777910948 CET	50083	445	192.168.2.5	160.166.64.79
Jan 15, 2025 02:52:49.777951956 CET	50083	445	192.168.2.5	160.166.64.79
Jan 15, 2025 02:52:49.778053045 CET	50084	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.783003092 CET	445	50084	160.166.64.1	192.168.2.5
Jan 15, 2025 02:52:49.783171892 CET	445	50083	160.166.64.79	192.168.2.5
Jan 15, 2025 02:52:49.783242941 CET	50083	445	192.168.2.5	160.166.64.79
Jan 15, 2025 02:52:49.783294916 CET	50084	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.783294916 CET	50084	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.783473015 CET	50085	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.788434029 CET	445	50084	160.166.64.1	192.168.2.5
Jan 15, 2025 02:52:49.788486004 CET	50084	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.788609982 CET	445	50085	160.166.64.1	192.168.2.5
Jan 15, 2025 02:52:49.788685083 CET	50085	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.788729906 CET	50085	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:52:49.793840885 CET	445	50085	160.166.64.1	192.168.2.5
Jan 15, 2025 02:52:50.045290947 CET	80	49755	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:50.045383930 CET	49755	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:50.045420885 CET	49755	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:50.047235012 CET	80	49754	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:50.047292948 CET	49754	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:50.047310114 CET	49754	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:52:50.052572966 CET	80	49755	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:50.053925037 CET	80	49754	83.133.119.197	192.168.2.5
Jan 15, 2025 02:52:51.786928892 CET	50119	445	192.168.2.5	211.132.162.104
Jan 15, 2025 02:52:51.791785955 CET	445	50119	211.132.162.104	192.168.2.5
Jan 15, 2025 02:52:51.791858912 CET	50119	445	192.168.2.5	211.132.162.104
Jan 15, 2025 02:52:51.791918039 CET	50119	445	192.168.2.5	211.132.162.104
Jan 15, 2025 02:52:51.792026043 CET	50120	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.796792030 CET	445	50120	211.132.162.1	192.168.2.5
Jan 15, 2025 02:52:51.796870947 CET	50120	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.796894073 CET	445	50119	211.132.162.104	192.168.2.5
Jan 15, 2025 02:52:51.796941042 CET	50119	445	192.168.2.5	211.132.162.104
Jan 15, 2025 02:52:51.797003031 CET	50120	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.797252893 CET	50121	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.801814079 CET	445	50120	211.132.162.1	192.168.2.5
Jan 15, 2025 02:52:51.801898003 CET	50120	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.802051067 CET	445	50121	211.132.162.1	192.168.2.5
Jan 15, 2025 02:52:51.802109957 CET	50121	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.802143097 CET	50121	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:52:51.806912899 CET	445	50121	211.132.162.1	192.168.2.5
Jan 15, 2025 02:52:53.970273972 CET	50158	445	192.168.2.5	137.175.162.138
Jan 15, 2025 02:52:53.975547075 CET	445	50158	137.175.162.138	192.168.2.5
Jan 15, 2025 02:52:53.975617886 CET	50158	445	192.168.2.5	137.175.162.138
Jan 15, 2025 02:52:53.975744963 CET	50158	445	192.168.2.5	137.175.162.138
Jan 15, 2025 02:52:53.975861073 CET	50160	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.980663061 CET	445	50160	137.175.162.1	192.168.2.5
Jan 15, 2025 02:52:53.980725050 CET	50160	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.980775118 CET	50160	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.980851889 CET	445	50158	137.175.162.138	192.168.2.5
Jan 15, 2025 02:52:53.980904102 CET	50158	445	192.168.2.5	137.175.162.138
Jan 15, 2025 02:52:53.982489109 CET	50161	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.986089945 CET	445	50160	137.175.162.1	192.168.2.5
Jan 15, 2025 02:52:53.986171007 CET	50160	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.987373114 CET	445	50161	137.175.162.1	192.168.2.5
Jan 15, 2025 02:52:53.987435102 CET	50161	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.994481087 CET	50161	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:52:53.999255896 CET	445	50161	137.175.162.1	192.168.2.5
Jan 15, 2025 02:52:55.110129118 CET	445	49791	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:55.112133026 CET	49791	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:55.112193108 CET	49791	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:55.112232924 CET	49791	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:55.117058992 CET	445	49791	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:55.117079020 CET	445	49791	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:55.976564884 CET	50192	445	192.168.2.5	148.47.58.161
Jan 15, 2025 02:52:55.981441021 CET	445	50192	148.47.58.161	192.168.2.5
Jan 15, 2025 02:52:55.981523037 CET	50192	445	192.168.2.5	148.47.58.161
Jan 15, 2025 02:52:55.981575012 CET	50192	445	192.168.2.5	148.47.58.161
Jan 15, 2025 02:52:55.981658936 CET	50193	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:55.986531019 CET	445	50193	148.47.58.1	192.168.2.5
Jan 15, 2025 02:52:55.986582994 CET	445	50192	148.47.58.161	192.168.2.5
Jan 15, 2025 02:52:55.986599922 CET	50193	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:55.986639023 CET	50192	445	192.168.2.5	148.47.58.161
Jan 15, 2025 02:52:55.986660004 CET	50193	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:55.986820936 CET	50194	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:55.991626978 CET	445	50193	148.47.58.1	192.168.2.5
Jan 15, 2025 02:52:55.991657972 CET	445	50194	148.47.58.1	192.168.2.5
Jan 15, 2025 02:52:55.991692066 CET	50193	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:55.991724968 CET	50194	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:56.007287979 CET	50194	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:52:56.012187958 CET	445	50194	148.47.58.1	192.168.2.5
Jan 15, 2025 02:52:57.043732882 CET	445	49826	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:57.046029091 CET	49826	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:57.046164036 CET	49826	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:57.046274900 CET	49826	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:52:57.051006079 CET	445	49826	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:57.051095009 CET	445	49826	138.40.81.1	192.168.2.5
Jan 15, 2025 02:52:57.991512060 CET	50228	445	192.168.2.5	140.70.135.4
Jan 15, 2025 02:52:57.996402979 CET	445	50228	140.70.135.4	192.168.2.5
Jan 15, 2025 02:52:57.996519089 CET	50228	445	192.168.2.5	140.70.135.4
Jan 15, 2025 02:52:57.996633053 CET	50228	445	192.168.2.5	140.70.135.4
Jan 15, 2025 02:52:57.996820927 CET	50229	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.001876116 CET	445	50228	140.70.135.4	192.168.2.5
Jan 15, 2025 02:52:58.001897097 CET	445	50229	140.70.135.1	192.168.2.5
Jan 15, 2025 02:52:58.001952887 CET	50228	445	192.168.2.5	140.70.135.4
Jan 15, 2025 02:52:58.002000093 CET	50229	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.002089977 CET	50229	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.002584934 CET	50230	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.006984949 CET	445	50229	140.70.135.1	192.168.2.5
Jan 15, 2025 02:52:58.007072926 CET	50229	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.007409096 CET	445	50230	140.70.135.1	192.168.2.5
Jan 15, 2025 02:52:58.007472038 CET	50230	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.007520914 CET	50230	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:52:58.012289047 CET	445	50230	140.70.135.1	192.168.2.5
Jan 15, 2025 02:52:58.114564896 CET	50232	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:58.119405031 CET	445	50232	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:58.119508982 CET	50232	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:58.119618893 CET	50232	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:52:58.124420881 CET	445	50232	95.214.158.1	192.168.2.5
Jan 15, 2025 02:52:59.207958937 CET	445	49863	149.11.181.1	192.168.2.5
Jan 15, 2025 02:52:59.208129883 CET	49863	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:59.208220959 CET	49863	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:59.208336115 CET	49863	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:52:59.213133097 CET	445	49863	149.11.181.1	192.168.2.5
Jan 15, 2025 02:52:59.213145018 CET	445	49863	149.11.181.1	192.168.2.5
Jan 15, 2025 02:53:00.023058891 CET	50244	445	192.168.2.5	72.151.164.132
Jan 15, 2025 02:53:00.027998924 CET	445	50244	72.151.164.132	192.168.2.5
Jan 15, 2025 02:53:00.028106928 CET	50244	445	192.168.2.5	72.151.164.132
Jan 15, 2025 02:53:00.028224945 CET	50244	445	192.168.2.5	72.151.164.132
Jan 15, 2025 02:53:00.028376102 CET	50245	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.033078909 CET	445	50244	72.151.164.132	192.168.2.5
Jan 15, 2025 02:53:00.033165932 CET	50244	445	192.168.2.5	72.151.164.132
Jan 15, 2025 02:53:00.033209085 CET	445	50245	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:00.033302069 CET	50245	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.033380032 CET	50245	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.033701897 CET	50246	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.038311005 CET	445	50245	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:00.038429022 CET	50245	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.038511992 CET	445	50246	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:00.038618088 CET	50246	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.038655996 CET	50246	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:00.043442011 CET	445	50246	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:00.052165985 CET	50247	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:53:00.057061911 CET	445	50247	138.40.81.1	192.168.2.5
Jan 15, 2025 02:53:00.057152987 CET	50247	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:53:00.057224989 CET	50247	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:53:00.062025070 CET	445	50247	138.40.81.1	192.168.2.5
Jan 15, 2025 02:53:01.112339973 CET	445	49903	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:01.112481117 CET	49903	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:01.112705946 CET	49903	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:01.112801075 CET	49903	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:01.117552042 CET	445	49903	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:01.117609024 CET	445	49903	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:02.021202087 CET	50261	445	192.168.2.5	26.51.77.154
Jan 15, 2025 02:53:02.026083946 CET	445	50261	26.51.77.154	192.168.2.5
Jan 15, 2025 02:53:02.026177883 CET	50261	445	192.168.2.5	26.51.77.154
Jan 15, 2025 02:53:02.026263952 CET	50261	445	192.168.2.5	26.51.77.154
Jan 15, 2025 02:53:02.026376009 CET	50262	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.032730103 CET	445	50262	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:02.032800913 CET	50262	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.032871962 CET	445	50261	26.51.77.154	192.168.2.5
Jan 15, 2025 02:53:02.032892942 CET	50262	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.032931089 CET	50261	445	192.168.2.5	26.51.77.154
Jan 15, 2025 02:53:02.033145905 CET	50263	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.038492918 CET	445	50263	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:02.038585901 CET	50263	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.038609982 CET	445	50262	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:02.038659096 CET	50262	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.039206982 CET	50263	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:02.044043064 CET	445	50263	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:02.223984003 CET	50266	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:53:02.228842020 CET	445	50266	149.11.181.1	192.168.2.5
Jan 15, 2025 02:53:02.229016066 CET	50266	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:53:02.229016066 CET	50266	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:53:02.233800888 CET	445	50266	149.11.181.1	192.168.2.5
Jan 15, 2025 02:53:04.036808014 CET	50278	445	192.168.2.5	113.235.186.154
Jan 15, 2025 02:53:04.041739941 CET	445	50278	113.235.186.154	192.168.2.5
Jan 15, 2025 02:53:04.041814089 CET	50278	445	192.168.2.5	113.235.186.154
Jan 15, 2025 02:53:04.041906118 CET	50278	445	192.168.2.5	113.235.186.154
Jan 15, 2025 02:53:04.042118073 CET	50279	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.046861887 CET	445	50278	113.235.186.154	192.168.2.5
Jan 15, 2025 02:53:04.046920061 CET	50278	445	192.168.2.5	113.235.186.154
Jan 15, 2025 02:53:04.046996117 CET	445	50279	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:04.047095060 CET	50279	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.047096014 CET	50279	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.047301054 CET	50280	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.052181005 CET	445	50279	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:04.052220106 CET	445	50280	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:04.052267075 CET	50279	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.052280903 CET	50280	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.052375078 CET	50280	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:04.057113886 CET	445	50280	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:04.114536047 CET	50282	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:04.119404078 CET	445	50282	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:04.119568110 CET	50282	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:04.119568110 CET	50282	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:04.124418974 CET	445	50282	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:05.106426954 CET	445	49976	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:05.109925985 CET	49976	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:05.109976053 CET	49976	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:05.110030890 CET	49976	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:05.114944935 CET	445	49976	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:05.114990950 CET	445	49976	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:06.052187920 CET	50297	445	192.168.2.5	91.63.153.58
Jan 15, 2025 02:53:06.057044029 CET	445	50297	91.63.153.58	192.168.2.5
Jan 15, 2025 02:53:06.057117939 CET	50297	445	192.168.2.5	91.63.153.58
Jan 15, 2025 02:53:06.057163954 CET	50297	445	192.168.2.5	91.63.153.58
Jan 15, 2025 02:53:06.057380915 CET	50298	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.062200069 CET	445	50298	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:06.062289000 CET	50298	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.062289000 CET	50298	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.062428951 CET	50299	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.064284086 CET	445	50297	91.63.153.58	192.168.2.5
Jan 15, 2025 02:53:06.067198038 CET	445	50299	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:06.067251921 CET	50299	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.067270041 CET	50299	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.067646980 CET	445	50297	91.63.153.58	192.168.2.5
Jan 15, 2025 02:53:06.067701101 CET	50297	445	192.168.2.5	91.63.153.58
Jan 15, 2025 02:53:06.067771912 CET	445	50298	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:06.067899942 CET	50298	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:06.072015047 CET	445	50299	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:06.210370064 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:06.210393906 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:06.210467100 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:06.211373091 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:06.211383104 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.016448021 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.016601086 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.026791096 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.026808977 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.027734041 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.030390024 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.030515909 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.030520916 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.030694008 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.071332932 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.106090069 CET	445	50010	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:07.106232882 CET	50010	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:07.106257915 CET	50010	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:07.106291056 CET	50010	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:07.111061096 CET	445	50010	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:07.111076117 CET	445	50010	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:07.205177069 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.205394983 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:07.205460072 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.205586910 CET	50300	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:07.205601931 CET	443	50300	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:08.068057060 CET	50312	445	192.168.2.5	221.170.202.170
Jan 15, 2025 02:53:08.073044062 CET	445	50312	221.170.202.170	192.168.2.5
Jan 15, 2025 02:53:08.073241949 CET	50312	445	192.168.2.5	221.170.202.170
Jan 15, 2025 02:53:08.073241949 CET	50312	445	192.168.2.5	221.170.202.170
Jan 15, 2025 02:53:08.073358059 CET	50313	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.078124046 CET	445	50313	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:08.078217030 CET	445	50312	221.170.202.170	192.168.2.5
Jan 15, 2025 02:53:08.078241110 CET	50313	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.078301907 CET	50312	445	192.168.2.5	221.170.202.170
Jan 15, 2025 02:53:08.078304052 CET	50313	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.078563929 CET	50314	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.083106041 CET	445	50313	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:08.083277941 CET	50313	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.083324909 CET	445	50314	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:08.083380938 CET	50314	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.083425045 CET	50314	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:08.088212013 CET	445	50314	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:08.114516020 CET	50315	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:08.119271040 CET	445	50315	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:08.119339943 CET	50315	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:08.119386911 CET	50315	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:08.124140978 CET	445	50315	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:09.159061909 CET	445	50050	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:09.159192085 CET	50050	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:09.159332991 CET	50050	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:09.159429073 CET	50050	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:09.164053917 CET	445	50050	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:09.164167881 CET	445	50050	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:09.796125889 CET	445	49942	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:09.796233892 CET	49942	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:09.796320915 CET	49942	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:09.796400070 CET	49942	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:09.801115036 CET	445	49942	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:09.801256895 CET	445	49942	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:09.963219881 CET	50316	445	192.168.2.5	172.2.157.167
Jan 15, 2025 02:53:09.968090057 CET	445	50316	172.2.157.167	192.168.2.5
Jan 15, 2025 02:53:09.968203068 CET	50316	445	192.168.2.5	172.2.157.167
Jan 15, 2025 02:53:09.970602989 CET	50316	445	192.168.2.5	172.2.157.167
Jan 15, 2025 02:53:09.975528002 CET	445	50316	172.2.157.167	192.168.2.5
Jan 15, 2025 02:53:09.975600958 CET	50316	445	192.168.2.5	172.2.157.167
Jan 15, 2025 02:53:09.977983952 CET	50317	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:09.982795000 CET	445	50317	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:09.982887983 CET	50317	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:09.985435009 CET	50317	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:09.990247011 CET	445	50317	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:09.990355015 CET	50317	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:09.994036913 CET	50318	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:09.998951912 CET	445	50318	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:09.999022007 CET	50318	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:10.002051115 CET	50318	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:10.006891012 CET	445	50318	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:10.124213934 CET	50319	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:10.129210949 CET	445	50319	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:10.129312038 CET	50319	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:10.137989998 CET	50319	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:10.142766953 CET	445	50319	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:11.154299021 CET	445	50085	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:11.154367924 CET	50085	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:11.154556990 CET	50085	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:11.154556990 CET	50085	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:11.159374952 CET	445	50085	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:11.159389973 CET	445	50085	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:11.352607965 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:11.352658987 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:11.352782011 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:11.353432894 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:11.353447914 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:11.692992926 CET	50321	445	192.168.2.5	80.134.5.25
Jan 15, 2025 02:53:11.697922945 CET	445	50321	80.134.5.25	192.168.2.5
Jan 15, 2025 02:53:11.698106050 CET	50321	445	192.168.2.5	80.134.5.25
Jan 15, 2025 02:53:11.698106050 CET	50321	445	192.168.2.5	80.134.5.25
Jan 15, 2025 02:53:11.698173046 CET	50322	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.703067064 CET	445	50322	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:11.703125954 CET	50322	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.703140020 CET	445	50321	80.134.5.25	192.168.2.5
Jan 15, 2025 02:53:11.703166008 CET	50322	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.703187943 CET	50321	445	192.168.2.5	80.134.5.25
Jan 15, 2025 02:53:11.703377008 CET	50323	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.708050013 CET	445	50322	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:11.708103895 CET	50322	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.708138943 CET	445	50323	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:11.708195925 CET	50323	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.708219051 CET	50323	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:11.712997913 CET	445	50323	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:12.131320953 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.131390095 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.140533924 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.140552998 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.140777111 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.142208099 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.142349005 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.142354965 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.142471075 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.161334991 CET	50324	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:12.166209936 CET	445	50324	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:12.166280985 CET	50324	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:12.166306973 CET	50324	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:12.171075106 CET	445	50324	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:12.183336973 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.317111015 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.317339897 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.317392111 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.317529917 CET	50320	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:12.317547083 CET	443	50320	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:12.818080902 CET	50325	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:12.822978020 CET	445	50325	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:12.823048115 CET	50325	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:12.827941895 CET	50325	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:12.832726955 CET	445	50325	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:13.188628912 CET	445	50121	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:13.188703060 CET	50121	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:13.188750982 CET	50121	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:13.188798904 CET	50121	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:13.193612099 CET	445	50121	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:13.193623066 CET	445	50121	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:13.333453894 CET	50326	445	192.168.2.5	51.62.241.233
Jan 15, 2025 02:53:13.338366985 CET	445	50326	51.62.241.233	192.168.2.5
Jan 15, 2025 02:53:13.338447094 CET	50326	445	192.168.2.5	51.62.241.233
Jan 15, 2025 02:53:13.338500023 CET	50326	445	192.168.2.5	51.62.241.233
Jan 15, 2025 02:53:13.338613987 CET	50327	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.344002008 CET	445	50327	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:13.344064951 CET	50327	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.344108105 CET	50327	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.344136953 CET	445	50326	51.62.241.233	192.168.2.5
Jan 15, 2025 02:53:13.344183922 CET	50326	445	192.168.2.5	51.62.241.233
Jan 15, 2025 02:53:13.344301939 CET	50328	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.351491928 CET	445	50328	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:13.351561069 CET	50328	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.351593018 CET	50328	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.351803064 CET	445	50327	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:13.351857901 CET	50327	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:13.373023033 CET	445	50328	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:14.161367893 CET	50329	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:14.166188002 CET	445	50329	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:14.166274071 CET	50329	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:14.166295052 CET	50329	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:14.171019077 CET	445	50329	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:14.871778011 CET	50330	445	192.168.2.5	57.0.54.102
Jan 15, 2025 02:53:14.876586914 CET	445	50330	57.0.54.102	192.168.2.5
Jan 15, 2025 02:53:14.876796007 CET	50330	445	192.168.2.5	57.0.54.102
Jan 15, 2025 02:53:14.876902103 CET	50330	445	192.168.2.5	57.0.54.102
Jan 15, 2025 02:53:14.877084017 CET	50331	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.881920099 CET	445	50330	57.0.54.102	192.168.2.5
Jan 15, 2025 02:53:14.881931067 CET	445	50331	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:14.882008076 CET	50330	445	192.168.2.5	57.0.54.102
Jan 15, 2025 02:53:14.882021904 CET	50331	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.885247946 CET	50331	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.890041113 CET	445	50331	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:14.890115976 CET	50331	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.895329952 CET	50332	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.900244951 CET	445	50332	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:14.900331974 CET	50332	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.900371075 CET	50332	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:14.905128002 CET	445	50332	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:15.360476017 CET	445	50161	137.175.162.1	192.168.2.5
Jan 15, 2025 02:53:15.360541105 CET	50161	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:15.363646030 CET	50161	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:15.363646030 CET	50161	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:15.368510962 CET	445	50161	137.175.162.1	192.168.2.5
Jan 15, 2025 02:53:15.368520975 CET	445	50161	137.175.162.1	192.168.2.5
Jan 15, 2025 02:53:16.192655087 CET	50333	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:16.197468996 CET	445	50333	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:16.197648048 CET	50333	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:16.197648048 CET	50333	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:16.202425957 CET	445	50333	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:16.302442074 CET	50334	445	192.168.2.5	174.70.176.190
Jan 15, 2025 02:53:16.307224035 CET	445	50334	174.70.176.190	192.168.2.5
Jan 15, 2025 02:53:16.307331085 CET	50334	445	192.168.2.5	174.70.176.190
Jan 15, 2025 02:53:16.307395935 CET	50334	445	192.168.2.5	174.70.176.190
Jan 15, 2025 02:53:16.307533026 CET	50335	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.312263966 CET	445	50334	174.70.176.190	192.168.2.5
Jan 15, 2025 02:53:16.312361002 CET	445	50335	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:16.312369108 CET	445	50334	174.70.176.190	192.168.2.5
Jan 15, 2025 02:53:16.312410116 CET	50335	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.312446117 CET	50334	445	192.168.2.5	174.70.176.190
Jan 15, 2025 02:53:16.312494993 CET	50335	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.312737942 CET	50336	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.317333937 CET	445	50335	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:16.317411900 CET	50335	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.317492962 CET	445	50336	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:16.317590952 CET	50336	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.317611933 CET	50336	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:16.322453976 CET	445	50336	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:17.374237061 CET	445	50194	148.47.58.1	192.168.2.5
Jan 15, 2025 02:53:17.374325991 CET	50194	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:17.394575119 CET	50194	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:17.394718885 CET	50194	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:17.399490118 CET	445	50194	148.47.58.1	192.168.2.5
Jan 15, 2025 02:53:17.399566889 CET	445	50194	148.47.58.1	192.168.2.5
Jan 15, 2025 02:53:17.630461931 CET	50337	445	192.168.2.5	109.99.7.155
Jan 15, 2025 02:53:17.635236025 CET	445	50337	109.99.7.155	192.168.2.5
Jan 15, 2025 02:53:17.635303974 CET	50337	445	192.168.2.5	109.99.7.155
Jan 15, 2025 02:53:17.635365963 CET	50337	445	192.168.2.5	109.99.7.155
Jan 15, 2025 02:53:17.635468960 CET	50338	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.640314102 CET	445	50338	109.99.7.1	192.168.2.5
Jan 15, 2025 02:53:17.640345097 CET	445	50337	109.99.7.155	192.168.2.5
Jan 15, 2025 02:53:17.640382051 CET	50338	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.640400887 CET	50337	445	192.168.2.5	109.99.7.155
Jan 15, 2025 02:53:17.640485048 CET	50338	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.640737057 CET	50339	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.645452023 CET	445	50338	109.99.7.1	192.168.2.5
Jan 15, 2025 02:53:17.645526886 CET	50338	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.645581007 CET	445	50339	109.99.7.1	192.168.2.5
Jan 15, 2025 02:53:17.645634890 CET	50339	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.645663977 CET	50339	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:17.650460005 CET	445	50339	109.99.7.1	192.168.2.5
Jan 15, 2025 02:53:17.818835974 CET	445	50336	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:17.818962097 CET	50336	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:17.819019079 CET	50336	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:17.819019079 CET	50336	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:17.823858023 CET	445	50336	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:17.823868990 CET	445	50336	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:18.364526033 CET	50340	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:18.369520903 CET	445	50340	137.175.162.1	192.168.2.5
Jan 15, 2025 02:53:18.369610071 CET	50340	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:18.369688988 CET	50340	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:18.374557972 CET	445	50340	137.175.162.1	192.168.2.5
Jan 15, 2025 02:53:18.865128994 CET	50341	445	192.168.2.5	62.182.54.185
Jan 15, 2025 02:53:18.870071888 CET	445	50341	62.182.54.185	192.168.2.5
Jan 15, 2025 02:53:18.870277882 CET	50341	445	192.168.2.5	62.182.54.185
Jan 15, 2025 02:53:18.870277882 CET	50341	445	192.168.2.5	62.182.54.185
Jan 15, 2025 02:53:18.870414019 CET	50342	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.875322104 CET	445	50342	62.182.54.1	192.168.2.5
Jan 15, 2025 02:53:18.875332117 CET	445	50341	62.182.54.185	192.168.2.5
Jan 15, 2025 02:53:18.875401974 CET	50341	445	192.168.2.5	62.182.54.185
Jan 15, 2025 02:53:18.875438929 CET	50342	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.875708103 CET	50343	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.875751972 CET	50342	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.880536079 CET	445	50343	62.182.54.1	192.168.2.5
Jan 15, 2025 02:53:18.880554914 CET	445	50342	62.182.54.1	192.168.2.5
Jan 15, 2025 02:53:18.880611897 CET	50343	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.880681038 CET	50343	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.880728960 CET	50342	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:18.885495901 CET	445	50343	62.182.54.1	192.168.2.5
Jan 15, 2025 02:53:19.356791019 CET	445	50230	140.70.135.1	192.168.2.5
Jan 15, 2025 02:53:19.356901884 CET	50230	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:19.356946945 CET	50230	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:19.357002974 CET	50230	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:19.361784935 CET	445	50230	140.70.135.1	192.168.2.5
Jan 15, 2025 02:53:19.361794949 CET	445	50230	140.70.135.1	192.168.2.5
Jan 15, 2025 02:53:19.499252081 CET	445	50232	95.214.158.1	192.168.2.5
Jan 15, 2025 02:53:19.499475002 CET	50232	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:53:19.499475002 CET	50232	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:53:19.499584913 CET	50232	445	192.168.2.5	95.214.158.1
Jan 15, 2025 02:53:19.504328966 CET	445	50232	95.214.158.1	192.168.2.5
Jan 15, 2025 02:53:19.504354000 CET	445	50232	95.214.158.1	192.168.2.5
Jan 15, 2025 02:53:19.552243948 CET	50344	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.559099913 CET	445	50344	95.214.158.2	192.168.2.5
Jan 15, 2025 02:53:19.559247971 CET	50344	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.559366941 CET	50344	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.560652971 CET	50345	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.564304113 CET	445	50344	95.214.158.2	192.168.2.5
Jan 15, 2025 02:53:19.565464973 CET	445	50345	95.214.158.2	192.168.2.5
Jan 15, 2025 02:53:19.565536022 CET	50345	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.565735102 CET	445	50344	95.214.158.2	192.168.2.5
Jan 15, 2025 02:53:19.565800905 CET	50344	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.566175938 CET	50345	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:19.571026087 CET	445	50345	95.214.158.2	192.168.2.5
Jan 15, 2025 02:53:20.058927059 CET	50346	445	192.168.2.5	111.48.240.74
Jan 15, 2025 02:53:20.063808918 CET	445	50346	111.48.240.74	192.168.2.5
Jan 15, 2025 02:53:20.063880920 CET	50346	445	192.168.2.5	111.48.240.74
Jan 15, 2025 02:53:20.063968897 CET	50346	445	192.168.2.5	111.48.240.74
Jan 15, 2025 02:53:20.064075947 CET	50347	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.068896055 CET	445	50347	111.48.240.1	192.168.2.5
Jan 15, 2025 02:53:20.068998098 CET	50347	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.069048882 CET	445	50346	111.48.240.74	192.168.2.5
Jan 15, 2025 02:53:20.069106102 CET	50346	445	192.168.2.5	111.48.240.74
Jan 15, 2025 02:53:20.072278023 CET	50349	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.072671890 CET	50348	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.077280998 CET	80	50349	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:20.077368975 CET	50349	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.077416897 CET	50349	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.077543020 CET	80	50348	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:20.077675104 CET	50348	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.077696085 CET	50348	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.080379009 CET	50347	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.082226992 CET	80	50349	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:20.082292080 CET	50349	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.082510948 CET	80	50348	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:20.082562923 CET	50348	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:20.082709074 CET	50350	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.085258007 CET	445	50347	111.48.240.1	192.168.2.5
Jan 15, 2025 02:53:20.085370064 CET	50347	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.087126970 CET	80	50349	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:20.087544918 CET	80	50348	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:20.087579012 CET	445	50350	111.48.240.1	192.168.2.5
Jan 15, 2025 02:53:20.087645054 CET	50350	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.087680101 CET	50350	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:20.092540026 CET	445	50350	111.48.240.1	192.168.2.5
Jan 15, 2025 02:53:20.395855904 CET	50351	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:20.400768042 CET	445	50351	148.47.58.1	192.168.2.5
Jan 15, 2025 02:53:20.400935888 CET	50351	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:20.400935888 CET	50351	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:20.405838966 CET	445	50351	148.47.58.1	192.168.2.5
Jan 15, 2025 02:53:20.833336115 CET	50352	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:20.838291883 CET	445	50352	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:20.838433027 CET	50352	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:20.838619947 CET	50352	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:20.844336033 CET	445	50352	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:21.156111956 CET	50353	445	192.168.2.5	136.85.90.113
Jan 15, 2025 02:53:21.161096096 CET	445	50353	136.85.90.113	192.168.2.5
Jan 15, 2025 02:53:21.164622068 CET	50353	445	192.168.2.5	136.85.90.113
Jan 15, 2025 02:53:21.164736032 CET	50353	445	192.168.2.5	136.85.90.113
Jan 15, 2025 02:53:21.164891958 CET	50354	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.169693947 CET	445	50353	136.85.90.113	192.168.2.5
Jan 15, 2025 02:53:21.169725895 CET	445	50354	136.85.90.1	192.168.2.5
Jan 15, 2025 02:53:21.169830084 CET	50353	445	192.168.2.5	136.85.90.113
Jan 15, 2025 02:53:21.169836044 CET	50354	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.169898033 CET	50354	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.170156956 CET	50355	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.174892902 CET	445	50354	136.85.90.1	192.168.2.5
Jan 15, 2025 02:53:21.175040960 CET	445	50355	136.85.90.1	192.168.2.5
Jan 15, 2025 02:53:21.175211906 CET	50354	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.175316095 CET	50355	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.175338984 CET	50355	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:21.180202961 CET	445	50355	136.85.90.1	192.168.2.5
Jan 15, 2025 02:53:21.405309916 CET	445	50246	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:21.405641079 CET	50246	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:21.405724049 CET	50246	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:21.405770063 CET	50246	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:21.410531998 CET	445	50246	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:21.410542965 CET	445	50246	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:21.419850111 CET	445	50247	138.40.81.1	192.168.2.5
Jan 15, 2025 02:53:21.419969082 CET	50247	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:53:21.420058966 CET	50247	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:53:21.420094013 CET	50247	445	192.168.2.5	138.40.81.1
Jan 15, 2025 02:53:21.425026894 CET	445	50247	138.40.81.1	192.168.2.5
Jan 15, 2025 02:53:21.425036907 CET	445	50247	138.40.81.1	192.168.2.5
Jan 15, 2025 02:53:21.477376938 CET	50356	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.482208967 CET	445	50356	138.40.81.2	192.168.2.5
Jan 15, 2025 02:53:21.484765053 CET	50356	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.489902020 CET	50356	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.490407944 CET	50357	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.494740009 CET	445	50356	138.40.81.2	192.168.2.5
Jan 15, 2025 02:53:21.495223999 CET	445	50357	138.40.81.2	192.168.2.5
Jan 15, 2025 02:53:21.495299101 CET	50356	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.495342016 CET	50357	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.503665924 CET	50357	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:21.508527994 CET	445	50357	138.40.81.2	192.168.2.5
Jan 15, 2025 02:53:22.175446033 CET	50358	445	192.168.2.5	20.15.180.0
Jan 15, 2025 02:53:22.180335045 CET	445	50358	20.15.180.0	192.168.2.5
Jan 15, 2025 02:53:22.180480957 CET	50358	445	192.168.2.5	20.15.180.0
Jan 15, 2025 02:53:22.180530071 CET	50358	445	192.168.2.5	20.15.180.0
Jan 15, 2025 02:53:22.180671930 CET	50359	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.185442924 CET	445	50358	20.15.180.0	192.168.2.5
Jan 15, 2025 02:53:22.185544014 CET	50358	445	192.168.2.5	20.15.180.0
Jan 15, 2025 02:53:22.185564041 CET	445	50359	20.15.180.1	192.168.2.5
Jan 15, 2025 02:53:22.185625076 CET	50359	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.185777903 CET	50359	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.186093092 CET	50360	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.190582037 CET	445	50359	20.15.180.1	192.168.2.5
Jan 15, 2025 02:53:22.190653086 CET	50359	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.190905094 CET	445	50360	20.15.180.1	192.168.2.5
Jan 15, 2025 02:53:22.190954924 CET	50360	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.190995932 CET	50360	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:22.196078062 CET	445	50360	20.15.180.1	192.168.2.5
Jan 15, 2025 02:53:22.348632097 CET	445	50352	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:22.348784924 CET	50352	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:22.348989964 CET	50352	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:22.349030018 CET	50352	445	192.168.2.5	174.70.176.1
Jan 15, 2025 02:53:22.354890108 CET	445	50352	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:22.354921103 CET	445	50352	174.70.176.1	192.168.2.5
Jan 15, 2025 02:53:22.359184027 CET	80	49710	2.23.77.188	192.168.2.5
Jan 15, 2025 02:53:22.359476089 CET	49710	80	192.168.2.5	2.23.77.188
Jan 15, 2025 02:53:22.360616922 CET	49710	80	192.168.2.5	2.23.77.188
Jan 15, 2025 02:53:22.364687920 CET	50361	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:22.365461111 CET	80	49710	2.23.77.188	192.168.2.5
Jan 15, 2025 02:53:22.369616032 CET	445	50361	140.70.135.1	192.168.2.5
Jan 15, 2025 02:53:22.369708061 CET	50361	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:22.369772911 CET	50361	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:22.374627113 CET	445	50361	140.70.135.1	192.168.2.5
Jan 15, 2025 02:53:22.411724091 CET	50362	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.416634083 CET	445	50362	174.70.176.2	192.168.2.5
Jan 15, 2025 02:53:22.416764021 CET	50362	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.416884899 CET	50362	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.417217970 CET	50363	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.421751976 CET	445	50362	174.70.176.2	192.168.2.5
Jan 15, 2025 02:53:22.421818972 CET	50362	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.422056913 CET	445	50363	174.70.176.2	192.168.2.5
Jan 15, 2025 02:53:22.422115088 CET	50363	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.422162056 CET	50363	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:22.426939011 CET	445	50363	174.70.176.2	192.168.2.5
Jan 15, 2025 02:53:23.115010023 CET	50365	445	192.168.2.5	214.224.11.142
Jan 15, 2025 02:53:23.119867086 CET	445	50365	214.224.11.142	192.168.2.5
Jan 15, 2025 02:53:23.119944096 CET	50365	445	192.168.2.5	214.224.11.142
Jan 15, 2025 02:53:23.120080948 CET	50365	445	192.168.2.5	214.224.11.142
Jan 15, 2025 02:53:23.120117903 CET	50366	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.124957085 CET	445	50366	214.224.11.1	192.168.2.5
Jan 15, 2025 02:53:23.124970913 CET	445	50365	214.224.11.142	192.168.2.5
Jan 15, 2025 02:53:23.125108957 CET	50366	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.125108957 CET	50366	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.125132084 CET	50365	445	192.168.2.5	214.224.11.142
Jan 15, 2025 02:53:23.125272989 CET	50367	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.130085945 CET	445	50367	214.224.11.1	192.168.2.5
Jan 15, 2025 02:53:23.130100012 CET	445	50366	214.224.11.1	192.168.2.5
Jan 15, 2025 02:53:23.130142927 CET	50367	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.130156994 CET	50366	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.130197048 CET	50367	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:23.136209011 CET	445	50367	214.224.11.1	192.168.2.5
Jan 15, 2025 02:53:23.438982010 CET	445	50263	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:23.439172983 CET	50263	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:23.439173937 CET	50263	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:23.439419031 CET	50263	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:23.444041014 CET	445	50263	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:23.444297075 CET	445	50263	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:23.575627089 CET	445	50266	149.11.181.1	192.168.2.5
Jan 15, 2025 02:53:23.575773954 CET	50266	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:53:23.575773954 CET	50266	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:53:23.575865030 CET	50266	445	192.168.2.5	149.11.181.1
Jan 15, 2025 02:53:23.580668926 CET	445	50266	149.11.181.1	192.168.2.5
Jan 15, 2025 02:53:23.580682039 CET	445	50266	149.11.181.1	192.168.2.5
Jan 15, 2025 02:53:23.630470991 CET	50368	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.635328054 CET	445	50368	149.11.181.2	192.168.2.5
Jan 15, 2025 02:53:23.635387897 CET	50368	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.635510921 CET	50368	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.635790110 CET	50369	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.640290022 CET	445	50368	149.11.181.2	192.168.2.5
Jan 15, 2025 02:53:23.640419006 CET	445	50368	149.11.181.2	192.168.2.5
Jan 15, 2025 02:53:23.640456915 CET	50368	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.640640974 CET	445	50369	149.11.181.2	192.168.2.5
Jan 15, 2025 02:53:23.640712976 CET	50369	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.640750885 CET	50369	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:23.645591974 CET	445	50369	149.11.181.2	192.168.2.5
Jan 15, 2025 02:53:23.990114927 CET	50370	445	192.168.2.5	117.140.42.50
Jan 15, 2025 02:53:23.995037079 CET	445	50370	117.140.42.50	192.168.2.5
Jan 15, 2025 02:53:23.995126963 CET	50370	445	192.168.2.5	117.140.42.50
Jan 15, 2025 02:53:23.995189905 CET	50370	445	192.168.2.5	117.140.42.50
Jan 15, 2025 02:53:23.995347023 CET	50371	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.000279903 CET	445	50371	117.140.42.1	192.168.2.5
Jan 15, 2025 02:53:24.000293016 CET	445	50370	117.140.42.50	192.168.2.5
Jan 15, 2025 02:53:24.000354052 CET	50370	445	192.168.2.5	117.140.42.50
Jan 15, 2025 02:53:24.000370979 CET	50371	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.000405073 CET	50371	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.000576019 CET	50372	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.005494118 CET	445	50372	117.140.42.1	192.168.2.5
Jan 15, 2025 02:53:24.005558968 CET	50372	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.005606890 CET	445	50371	117.140.42.1	192.168.2.5
Jan 15, 2025 02:53:24.005615950 CET	50372	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.005673885 CET	50371	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:24.011085033 CET	445	50372	117.140.42.1	192.168.2.5
Jan 15, 2025 02:53:24.411403894 CET	50373	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:24.417916059 CET	445	50373	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:24.418051958 CET	50373	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:24.418051958 CET	50373	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:24.423856020 CET	445	50373	72.151.164.1	192.168.2.5
Jan 15, 2025 02:53:24.818154097 CET	50374	445	192.168.2.5	78.74.197.76
Jan 15, 2025 02:53:24.823383093 CET	445	50374	78.74.197.76	192.168.2.5
Jan 15, 2025 02:53:24.823450089 CET	50374	445	192.168.2.5	78.74.197.76
Jan 15, 2025 02:53:24.823580980 CET	50374	445	192.168.2.5	78.74.197.76
Jan 15, 2025 02:53:24.823667049 CET	50375	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.828471899 CET	445	50375	78.74.197.1	192.168.2.5
Jan 15, 2025 02:53:24.828542948 CET	50375	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.828588009 CET	50375	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.828764915 CET	445	50374	78.74.197.76	192.168.2.5
Jan 15, 2025 02:53:24.828794956 CET	50376	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.828821898 CET	50374	445	192.168.2.5	78.74.197.76
Jan 15, 2025 02:53:24.833631039 CET	445	50375	78.74.197.1	192.168.2.5
Jan 15, 2025 02:53:24.833645105 CET	445	50376	78.74.197.1	192.168.2.5
Jan 15, 2025 02:53:24.833688021 CET	50375	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.833750010 CET	50376	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.833795071 CET	50376	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:24.838553905 CET	445	50376	78.74.197.1	192.168.2.5
Jan 15, 2025 02:53:25.420125008 CET	445	50280	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:25.420205116 CET	50280	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:25.420336962 CET	50280	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:25.420371056 CET	50280	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:25.425192118 CET	445	50280	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:25.425208092 CET	445	50280	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:25.499414921 CET	445	50282	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:25.499541998 CET	50282	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:25.499583960 CET	50282	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:25.499619961 CET	50282	445	192.168.2.5	181.1.73.1
Jan 15, 2025 02:53:25.504364967 CET	445	50282	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:25.504389048 CET	445	50282	181.1.73.1	192.168.2.5
Jan 15, 2025 02:53:25.553194046 CET	50377	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.558368921 CET	445	50377	181.1.73.2	192.168.2.5
Jan 15, 2025 02:53:25.558448076 CET	50377	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.558593035 CET	50377	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.558696032 CET	50378	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.563529015 CET	445	50378	181.1.73.2	192.168.2.5
Jan 15, 2025 02:53:25.563585997 CET	50378	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.563599110 CET	50378	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.563704014 CET	445	50377	181.1.73.2	192.168.2.5
Jan 15, 2025 02:53:25.563788891 CET	50377	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:25.568417072 CET	445	50378	181.1.73.2	192.168.2.5
Jan 15, 2025 02:53:25.583440065 CET	50379	445	192.168.2.5	100.43.221.186
Jan 15, 2025 02:53:25.588221073 CET	445	50379	100.43.221.186	192.168.2.5
Jan 15, 2025 02:53:25.588350058 CET	50379	445	192.168.2.5	100.43.221.186
Jan 15, 2025 02:53:25.588365078 CET	50379	445	192.168.2.5	100.43.221.186
Jan 15, 2025 02:53:25.588459969 CET	50380	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.593287945 CET	445	50380	100.43.221.1	192.168.2.5
Jan 15, 2025 02:53:25.593303919 CET	445	50379	100.43.221.186	192.168.2.5
Jan 15, 2025 02:53:25.593367100 CET	50379	445	192.168.2.5	100.43.221.186
Jan 15, 2025 02:53:25.593365908 CET	50380	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.593455076 CET	50380	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.593605995 CET	50381	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.598403931 CET	445	50381	100.43.221.1	192.168.2.5
Jan 15, 2025 02:53:25.598417044 CET	445	50380	100.43.221.1	192.168.2.5
Jan 15, 2025 02:53:25.598483086 CET	50380	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.598531961 CET	50381	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.598531961 CET	50381	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:25.603336096 CET	445	50381	100.43.221.1	192.168.2.5
Jan 15, 2025 02:53:26.442650080 CET	50383	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:26.447606087 CET	445	50383	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:26.447684050 CET	50383	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:26.447701931 CET	50383	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:26.452585936 CET	445	50383	26.51.77.1	192.168.2.5
Jan 15, 2025 02:53:27.454430103 CET	445	50299	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:27.454708099 CET	50299	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:27.454709053 CET	50299	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:27.454709053 CET	50299	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:27.459662914 CET	445	50299	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:27.459692955 CET	445	50299	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:28.427206993 CET	50389	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:28.432077885 CET	445	50389	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:28.436166048 CET	50389	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:28.436239958 CET	50389	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:28.441108942 CET	445	50389	113.235.186.1	192.168.2.5
Jan 15, 2025 02:53:28.865295887 CET	50393	443	192.168.2.5	165.160.15.20
Jan 15, 2025 02:53:28.865333080 CET	443	50393	165.160.15.20	192.168.2.5
Jan 15, 2025 02:53:28.865397930 CET	50393	443	192.168.2.5	165.160.15.20
Jan 15, 2025 02:53:29.450062990 CET	445	50314	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:29.451452971 CET	50314	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:29.488343954 CET	50314	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:29.488399029 CET	50314	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:29.493371010 CET	445	50314	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:29.493412971 CET	445	50314	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:29.513782024 CET	445	50315	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:29.513870001 CET	50315	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:29.519244909 CET	50315	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:29.519409895 CET	50315	445	192.168.2.5	193.175.220.1
Jan 15, 2025 02:53:29.524343014 CET	445	50315	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:29.524379969 CET	445	50315	193.175.220.1	192.168.2.5
Jan 15, 2025 02:53:29.671921015 CET	50397	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.676824093 CET	445	50397	193.175.220.2	192.168.2.5
Jan 15, 2025 02:53:29.676920891 CET	50397	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.677002907 CET	50397	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.677432060 CET	50399	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.682077885 CET	445	50397	193.175.220.2	192.168.2.5
Jan 15, 2025 02:53:29.682185888 CET	50397	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.682269096 CET	445	50399	193.175.220.2	192.168.2.5
Jan 15, 2025 02:53:29.682341099 CET	50399	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.682540894 CET	50399	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:29.687354088 CET	445	50399	193.175.220.2	192.168.2.5
Jan 15, 2025 02:53:30.128844976 CET	50402	443	192.168.2.5	162.159.140.166
Jan 15, 2025 02:53:30.128879070 CET	443	50402	162.159.140.166	192.168.2.5
Jan 15, 2025 02:53:30.128942966 CET	50402	443	192.168.2.5	162.159.140.166
Jan 15, 2025 02:53:30.458682060 CET	50405	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:30.463555098 CET	445	50405	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:30.463632107 CET	50405	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:30.463655949 CET	50405	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:30.468489885 CET	445	50405	91.63.153.1	192.168.2.5
Jan 15, 2025 02:53:31.393714905 CET	445	50318	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:31.393990040 CET	50318	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:31.394028902 CET	50318	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:31.394068956 CET	50318	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:31.401319981 CET	445	50318	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:31.401334047 CET	445	50318	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:31.499144077 CET	445	50319	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:31.501964092 CET	50319	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:31.502007961 CET	50319	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:31.502041101 CET	50319	445	192.168.2.5	198.154.22.1
Jan 15, 2025 02:53:31.508368015 CET	445	50319	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:31.508701086 CET	445	50319	198.154.22.1	192.168.2.5
Jan 15, 2025 02:53:31.567600012 CET	50416	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.574031115 CET	445	50416	198.154.22.2	192.168.2.5
Jan 15, 2025 02:53:31.574112892 CET	50416	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.574186087 CET	50416	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.574433088 CET	50417	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.580739975 CET	445	50417	198.154.22.2	192.168.2.5
Jan 15, 2025 02:53:31.581274033 CET	445	50416	198.154.22.2	192.168.2.5
Jan 15, 2025 02:53:31.581357956 CET	50416	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.581583023 CET	50417	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.581619024 CET	50417	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:31.588376999 CET	445	50417	198.154.22.2	192.168.2.5
Jan 15, 2025 02:53:32.520725012 CET	50429	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:32.525566101 CET	445	50429	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:32.525727034 CET	50429	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:32.525809050 CET	50429	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:32.530574083 CET	445	50429	221.170.202.1	192.168.2.5
Jan 15, 2025 02:53:33.076354027 CET	445	50323	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:33.076435089 CET	50323	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:33.076484919 CET	50323	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:33.076495886 CET	50323	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:33.081373930 CET	445	50323	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:33.081387043 CET	445	50323	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:33.544461966 CET	445	50324	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:33.544548988 CET	50324	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:33.544641018 CET	50324	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:33.544686079 CET	50324	445	192.168.2.5	39.69.187.1
Jan 15, 2025 02:53:33.549495935 CET	445	50324	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:33.549506903 CET	445	50324	39.69.187.1	192.168.2.5
Jan 15, 2025 02:53:33.599335909 CET	50447	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.604258060 CET	445	50447	39.69.187.2	192.168.2.5
Jan 15, 2025 02:53:33.604343891 CET	50447	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.604480028 CET	50447	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.604814053 CET	50448	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.609299898 CET	445	50447	39.69.187.2	192.168.2.5
Jan 15, 2025 02:53:33.609363079 CET	50447	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.609626055 CET	445	50448	39.69.187.2	192.168.2.5
Jan 15, 2025 02:53:33.609684944 CET	50448	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.609713078 CET	50448	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:33.614495039 CET	445	50448	39.69.187.2	192.168.2.5
Jan 15, 2025 02:53:34.396042109 CET	50466	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:34.400950909 CET	445	50466	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:34.401031971 CET	50466	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:34.401062012 CET	50466	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:34.405821085 CET	445	50466	172.2.157.1	192.168.2.5
Jan 15, 2025 02:53:34.753463984 CET	445	50328	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:34.753983974 CET	50328	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:34.757040024 CET	50328	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:34.757101059 CET	50328	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:34.761991024 CET	445	50328	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:34.762022972 CET	445	50328	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:34.867676020 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:34.867755890 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:34.867846966 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:34.868779898 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:34.868818045 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.528950930 CET	445	50329	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:35.529247046 CET	50329	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:35.529247046 CET	50329	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:35.529247046 CET	50329	445	192.168.2.5	160.166.64.1
Jan 15, 2025 02:53:35.534236908 CET	445	50329	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:35.534276009 CET	445	50329	160.166.64.1	192.168.2.5
Jan 15, 2025 02:53:35.586702108 CET	50498	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.591754913 CET	445	50498	160.166.64.2	192.168.2.5
Jan 15, 2025 02:53:35.591855049 CET	50498	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.591948986 CET	50498	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.592286110 CET	50499	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.596929073 CET	445	50498	160.166.64.2	192.168.2.5
Jan 15, 2025 02:53:35.597002983 CET	50498	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.597182035 CET	445	50499	160.166.64.2	192.168.2.5
Jan 15, 2025 02:53:35.597265005 CET	50499	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.597299099 CET	50499	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:35.602153063 CET	445	50499	160.166.64.2	192.168.2.5
Jan 15, 2025 02:53:35.659358978 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.659435987 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.661595106 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.661602020 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.661813021 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.664314032 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.664375067 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.664381027 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.664515972 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.711352110 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.837127924 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.837202072 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:35.837385893 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.837500095 CET	50475	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:35.837518930 CET	443	50475	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:36.083638906 CET	50514	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:36.088515043 CET	445	50514	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:36.088705063 CET	50514	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:36.088892937 CET	50514	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:36.093775034 CET	445	50514	80.134.5.1	192.168.2.5
Jan 15, 2025 02:53:36.267486095 CET	445	50332	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:36.268997908 CET	50332	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:36.269040108 CET	50332	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:36.269088030 CET	50332	445	192.168.2.5	57.0.54.1
Jan 15, 2025 02:53:36.274044037 CET	445	50332	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:36.274076939 CET	445	50332	57.0.54.1	192.168.2.5
Jan 15, 2025 02:53:37.565840006 CET	445	50333	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:37.565956116 CET	50333	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:37.588645935 CET	50333	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:37.588700056 CET	50333	445	192.168.2.5	211.132.162.1
Jan 15, 2025 02:53:37.593489885 CET	445	50333	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:37.593502045 CET	445	50333	211.132.162.1	192.168.2.5
Jan 15, 2025 02:53:37.670566082 CET	50608	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.675512075 CET	445	50608	211.132.162.2	192.168.2.5
Jan 15, 2025 02:53:37.675594091 CET	50608	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.678419113 CET	50608	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.683307886 CET	445	50608	211.132.162.2	192.168.2.5
Jan 15, 2025 02:53:37.683367014 CET	50608	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.685887098 CET	445	50325	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:37.685973883 CET	50325	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:37.686244011 CET	50325	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:37.687969923 CET	50325	445	192.168.2.5	94.120.0.1
Jan 15, 2025 02:53:37.691045046 CET	445	50325	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:37.692703009 CET	445	50325	94.120.0.1	192.168.2.5
Jan 15, 2025 02:53:37.701277018 CET	50614	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.706151962 CET	445	50614	211.132.162.2	192.168.2.5
Jan 15, 2025 02:53:37.706248045 CET	50614	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.706290007 CET	50614	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:37.711019039 CET	445	50614	211.132.162.2	192.168.2.5
Jan 15, 2025 02:53:37.756604910 CET	50623	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.764123917 CET	445	50623	94.120.0.2	192.168.2.5
Jan 15, 2025 02:53:37.764198065 CET	50623	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.765141964 CET	50623	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.765783072 CET	50625	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.770059109 CET	445	50623	94.120.0.2	192.168.2.5
Jan 15, 2025 02:53:37.770136118 CET	50623	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.770673990 CET	445	50625	94.120.0.2	192.168.2.5
Jan 15, 2025 02:53:37.770765066 CET	50625	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.771167994 CET	50625	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:37.771445990 CET	50626	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:37.775950909 CET	445	50625	94.120.0.2	192.168.2.5
Jan 15, 2025 02:53:37.776276112 CET	445	50626	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:37.776340961 CET	50626	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:37.776405096 CET	50626	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:37.781155109 CET	445	50626	51.62.241.1	192.168.2.5
Jan 15, 2025 02:53:38.651071072 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:38.651103020 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:38.651191950 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:38.652040958 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:38.652055979 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.030719042 CET	445	50339	109.99.7.1	192.168.2.5
Jan 15, 2025 02:53:39.033979893 CET	50339	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:39.466344118 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.466449976 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.469096899 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.469118118 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.469342947 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.470988989 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.471067905 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.471081972 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.471200943 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.515321970 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.648668051 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.648854017 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.649202108 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.649287939 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.649328947 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.649328947 CET	50673	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:53:39.649353981 CET	443	50673	40.115.3.253	192.168.2.5
Jan 15, 2025 02:53:39.675362110 CET	445	50614	211.132.162.2	192.168.2.5
Jan 15, 2025 02:53:39.675445080 CET	50614	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:39.784677029 CET	445	50340	137.175.162.1	192.168.2.5
Jan 15, 2025 02:53:39.785974979 CET	50340	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:40.231450081 CET	445	50343	62.182.54.1	192.168.2.5
Jan 15, 2025 02:53:40.231570005 CET	50343	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:40.896150112 CET	50369	445	192.168.2.5	149.11.181.2
Jan 15, 2025 02:53:40.896317959 CET	50357	445	192.168.2.5	138.40.81.2
Jan 15, 2025 02:53:40.896399975 CET	50378	445	192.168.2.5	181.1.73.2
Jan 15, 2025 02:53:40.896461010 CET	50345	445	192.168.2.5	95.214.158.2
Jan 15, 2025 02:53:40.896473885 CET	50417	445	192.168.2.5	198.154.22.2
Jan 15, 2025 02:53:40.896537066 CET	50361	445	192.168.2.5	140.70.135.1
Jan 15, 2025 02:53:40.896585941 CET	50340	445	192.168.2.5	137.175.162.1
Jan 15, 2025 02:53:40.896589994 CET	50339	445	192.168.2.5	109.99.7.1
Jan 15, 2025 02:53:40.896595955 CET	50343	445	192.168.2.5	62.182.54.1
Jan 15, 2025 02:53:40.896642923 CET	50351	445	192.168.2.5	148.47.58.1
Jan 15, 2025 02:53:40.896651030 CET	50350	445	192.168.2.5	111.48.240.1
Jan 15, 2025 02:53:40.896684885 CET	50355	445	192.168.2.5	136.85.90.1
Jan 15, 2025 02:53:40.896684885 CET	50360	445	192.168.2.5	20.15.180.1
Jan 15, 2025 02:53:40.896701097 CET	50363	445	192.168.2.5	174.70.176.2
Jan 15, 2025 02:53:40.896722078 CET	50367	445	192.168.2.5	214.224.11.1
Jan 15, 2025 02:53:40.896747112 CET	50372	445	192.168.2.5	117.140.42.1
Jan 15, 2025 02:53:40.896770954 CET	50373	445	192.168.2.5	72.151.164.1
Jan 15, 2025 02:53:40.896811008 CET	50381	445	192.168.2.5	100.43.221.1
Jan 15, 2025 02:53:40.896828890 CET	50389	445	192.168.2.5	113.235.186.1
Jan 15, 2025 02:53:40.896847010 CET	50383	445	192.168.2.5	26.51.77.1
Jan 15, 2025 02:53:40.896881104 CET	50405	445	192.168.2.5	91.63.153.1
Jan 15, 2025 02:53:40.896898985 CET	50376	445	192.168.2.5	78.74.197.1
Jan 15, 2025 02:53:40.896898985 CET	50399	445	192.168.2.5	193.175.220.2
Jan 15, 2025 02:53:40.896934986 CET	50429	445	192.168.2.5	221.170.202.1
Jan 15, 2025 02:53:40.896948099 CET	50448	445	192.168.2.5	39.69.187.2
Jan 15, 2025 02:53:40.897006035 CET	50466	445	192.168.2.5	172.2.157.1
Jan 15, 2025 02:53:40.897027016 CET	50514	445	192.168.2.5	80.134.5.1
Jan 15, 2025 02:53:40.897085905 CET	50499	445	192.168.2.5	160.166.64.2
Jan 15, 2025 02:53:40.897268057 CET	50626	445	192.168.2.5	51.62.241.1
Jan 15, 2025 02:53:40.897494078 CET	50614	445	192.168.2.5	211.132.162.2
Jan 15, 2025 02:53:40.897599936 CET	50625	445	192.168.2.5	94.120.0.2
Jan 15, 2025 02:53:41.435311079 CET	80	50349	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:41.435446978 CET	50349	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:41.435477972 CET	50349	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:41.440335035 CET	80	50349	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:41.441080093 CET	80	50348	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:41.441169024 CET	50348	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:41.441314936 CET	50348	80	192.168.2.5	83.133.119.197
Jan 15, 2025 02:53:41.446158886 CET	80	50348	83.133.119.197	192.168.2.5
Jan 15, 2025 02:53:48.072501898 CET	50393	443	192.168.2.5	165.160.15.20
Jan 15, 2025 02:53:48.072587013 CET	50402	443	192.168.2.5	162.159.140.166
Jan 15, 2025 02:53:50.755043030 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:53:50.755197048 CET	49709	80	192.168.2.5	199.232.210.172
Jan 15, 2025 02:53:50.755259037 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:53:50.778693914 CET	443	49713	40.126.32.74	192.168.2.5
Jan 15, 2025 02:53:50.778708935 CET	80	49709	199.232.210.172	192.168.2.5
Jan 15, 2025 02:53:50.778721094 CET	443	49708	40.126.32.74	192.168.2.5
Jan 15, 2025 02:53:50.778770924 CET	49713	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:53:50.778800964 CET	49709	80	192.168.2.5	199.232.210.172
Jan 15, 2025 02:53:50.778825045 CET	49708	443	192.168.2.5	40.126.32.74
Jan 15, 2025 02:53:52.520773888 CET	49712	80	192.168.2.5	2.23.77.188
Jan 15, 2025 02:53:52.520865917 CET	49714	80	192.168.2.5	199.232.210.172
Jan 15, 2025 02:53:52.525845051 CET	80	49712	2.23.77.188	192.168.2.5
Jan 15, 2025 02:53:52.525912046 CET	49712	80	192.168.2.5	2.23.77.188
Jan 15, 2025 02:53:52.526072025 CET	80	49714	199.232.210.172	192.168.2.5
Jan 15, 2025 02:53:52.526129007 CET	49714	80	192.168.2.5	199.232.210.172
Jan 15, 2025 02:54:08.905970097 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:08.906008959 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:08.906132936 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:08.906879902 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:08.906893015 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.685252905 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.686130047 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.687483072 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.687489986 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.687702894 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.689848900 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.689914942 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.689918995 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.690109015 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.731329918 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.860188007 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.860534906 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:09.860598087 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.860810041 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.860810041 CET	50674	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:09.860826969 CET	443	50674	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:15.197304964 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:15.197417021 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:15.197638035 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:15.198807001 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:15.198848963 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.022548914 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.022784948 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.024878025 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.024920940 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.025755882 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.027256012 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.027312040 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.027324915 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.027443886 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.075336933 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.204216957 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.204427004 CET	443	50675	40.115.3.253	192.168.2.5
Jan 15, 2025 02:54:16.204499006 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.204596996 CET	50675	443	192.168.2.5	40.115.3.253
Jan 15, 2025 02:54:16.204617023 CET	443	50675	40.115.3.253	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 02:52:28.628537893 CET	53	49261	1.1.1.1	192.168.2.5
Jan 15, 2025 02:52:28.637531996 CET	53	50545	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:20.063275099 CET	53	63298	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:20.071408033 CET	53	49701	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.625679970 CET	53	61074	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.637932062 CET	53	58853	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.649024963 CET	53	59110	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.657320976 CET	53	51454	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.659904957 CET	53	63606	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.667602062 CET	53	59790	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.677233934 CET	53	52106	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.692116022 CET	53	64593	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.816900015 CET	53	57890	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.828299046 CET	53	49370	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.844815969 CET	53	56582	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.850725889 CET	53	58513	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.860759974 CET	53	59259	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.873577118 CET	53	58235	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.883143902 CET	53	64420	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.892829895 CET	53	60166	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:28.902348995 CET	53	56228	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.056904078 CET	53	62246	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.067460060 CET	53	58632	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.077272892 CET	53	58162	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.089653015 CET	53	56833	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.105268002 CET	53	54326	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.118685961 CET	53	50069	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.277283907 CET	53	62084	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.636749983 CET	53	54762	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.681135893 CET	53	62284	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.690737009 CET	53	52101	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.708195925 CET	53	57274	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.874986887 CET	53	50582	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.884753942 CET	53	60795	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:29.894979000 CET	53	60659	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:30.051013947 CET	53	51337	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:30.061243057 CET	53	58382	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:30.071105003 CET	53	59206	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:30.081501007 CET	53	64949	1.1.1.1	192.168.2.5
Jan 15, 2025 02:53:30.092191935 CET	53	51321	1.1.1.1	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 02:52:28.628537893 CET	1.1.1.1	192.168.2.5	0x787c	Server failure (2)	ilo.brenz.pl	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:52:28.637531996 CET	1.1.1.1	192.168.2.5	0xef3d	Server failure (2)	ant.trenz.pl	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:20.063275099 CET	1.1.1.1	192.168.2.5	0xbd90	Server failure (2)	ilo.brenz.pl	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:20.071408033 CET	1.1.1.1	192.168.2.5	0xecc5	Server failure (2)	ant.trenz.pl	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.625679970 CET	1.1.1.1	192.168.2.5	0x413f	Name error (3)	akzoeg.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.637932062 CET	1.1.1.1	192.168.2.5	0xacab	Name error (3)	pojfeg.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.649024963 CET	1.1.1.1	192.168.2.5	0xd26f	Name error (3)	ersgvh.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.657320976 CET	1.1.1.1	192.168.2.5	0x4715	Name error (3)	kiieiy.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.659904957 CET	1.1.1.1	192.168.2.5	0xb15b	Name error (3)	qiurmh.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.667602062 CET	1.1.1.1	192.168.2.5	0x6826	Name error (3)	oaqqkf.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.677233934 CET	1.1.1.1	192.168.2.5	0x7b83	Name error (3)	abyeya.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.692116022 CET	1.1.1.1	192.168.2.5	0x7a16	Name error (3)	oqpzuo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.816900015 CET	1.1.1.1	192.168.2.5	0xcdc6	Name error (3)	rxexyq.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.828299046 CET	1.1.1.1	192.168.2.5	0xd82b	Name error (3)	lepdbj.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.844815969 CET	1.1.1.1	192.168.2.5	0xf5cc	Name error (3)	poqxaa.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.850725889 CET	1.1.1.1	192.168.2.5	0x872a	Name error (3)	voydqz.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.860759974 CET	1.1.1.1	192.168.2.5	0x5025	Name error (3)	rqegva.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.873577118 CET	1.1.1.1	192.168.2.5	0xe810	Name error (3)	ebohzv.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.883143902 CET	1.1.1.1	192.168.2.5	0x361d	Name error (3)	fxumem.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.892829895 CET	1.1.1.1	192.168.2.5	0xa9fb	Name error (3)	ezaeqf.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:28.902348995 CET	1.1.1.1	192.168.2.5	0x3d22	Name error (3)	kkuzud.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.056904078 CET	1.1.1.1	192.168.2.5	0x2e71	Name error (3)	imdznk.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.067460060 CET	1.1.1.1	192.168.2.5	0x7838	Name error (3)	slnmhg.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.077272892 CET	1.1.1.1	192.168.2.5	0x36d5	Name error (3)	tkkvba.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.089653015 CET	1.1.1.1	192.168.2.5	0x9174	Name error (3)	urxxuf.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.105268002 CET	1.1.1.1	192.168.2.5	0x9b79	Name error (3)	toexkd.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.118685961 CET	1.1.1.1	192.168.2.5	0xc2b1	Name error (3)	oacbaq.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.277283907 CET	1.1.1.1	192.168.2.5	0x175a	Name error (3)	ogoeuu.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.636749983 CET	1.1.1.1	192.168.2.5	0xdbfc	Name error (3)	ngemix.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.681135893 CET	1.1.1.1	192.168.2.5	0xbf84	Name error (3)	bjeako.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.690737009 CET	1.1.1.1	192.168.2.5	0x2106	Name error (3)	xzgrlj.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.708195925 CET	1.1.1.1	192.168.2.5	0x868c	Name error (3)	uteyyp.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.874986887 CET	1.1.1.1	192.168.2.5	0x6d74	Name error (3)	vttzwu.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.884753942 CET	1.1.1.1	192.168.2.5	0xfede	Name error (3)	xdzsqn.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:29.894979000 CET	1.1.1.1	192.168.2.5	0xde4c	Name error (3)	dkrbtp.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:30.051013947 CET	1.1.1.1	192.168.2.5	0xb785	Name error (3)	asjuen.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:30.061243057 CET	1.1.1.1	192.168.2.5	0x548c	Name error (3)	remieu.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:30.071105003 CET	1.1.1.1	192.168.2.5	0x19ac	Name error (3)	kfguna.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:30.081501007 CET	1.1.1.1	192.168.2.5	0xfef8	Name error (3)	eijfjn.com	none	none	A (IP address)	IN (0x0001)	false
Jan 15, 2025 02:53:30.092191935 CET	1.1.1.1	192.168.2.5	0xdd26	Name error (3)	yscyez.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49754	83.133.119.197	80

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 02:52:28.643117905 CET	20	OUT	Data Raw: c2 92 ab 3f f4 8d 52 4f e2 37 63 b1 5c 20 03 f4 ae 8c f3 1c Data Ascii: ?RO7c\
Jan 15, 2025 02:52:28.647983074 CET	26	OUT	Data Raw: 41 1b 4f 7b 96 6b c4 53 ea ae cc 21 b8 3c 1e 58 a6 87 d4 58 2f bc c3 dc 21 22 Data Ascii: AO{kS!<XX/!"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49755	83.133.119.197	80

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 02:52:28.643333912 CET	20	OUT	Data Raw: 1a ae 5f 87 ef d8 86 d2 b1 c1 2f 62 69 65 9a ec f5 1e 2f c6 Data Ascii: _/bie/
Jan 15, 2025 02:52:28.648106098 CET	26	OUT	Data Raw: 95 92 46 cb ca 3c 20 a6 52 bf 48 f2 f2 3d d0 7b 21 1a ca fd 29 5a cc 9b 00 be Data Ascii: F< RH={!)Z

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	50349	83.133.119.197	80

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 02:53:20.077416897 CET	20	OUT	Data Raw: b3 52 89 4e 25 0b f6 a6 0c ec 04 60 7a 68 5a c3 77 ea a3 6e Data Ascii: RN%`zhZwn
Jan 15, 2025 02:53:20.082292080 CET	26	OUT	Data Raw: 06 ab 9f e1 ea 14 29 da 18 7a a0 20 1a a0 9e 49 e7 12 f3 a4 ed 93 25 57 00 8f Data Ascii: )z I%W

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	50348	83.133.119.197	80

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 02:53:20.077696085 CET	20	OUT	Data Raw: a4 be f5 08 f5 c6 f8 c5 bc 79 fd ea fa bd 52 b3 e4 67 f3 8d Data Ascii: yRg
Jan 15, 2025 02:53:20.082562923 CET	26	OUT	Data Raw: 4d 55 f0 6e dd 61 c7 4b d7 3b b9 7f 0a b9 37 c5 6d af be f3 ed a0 db 74 e8 41 Data Ascii: MUnaK;7mtA

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.5	49716	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 69 37 42 76 47 65 74 6c 55 36 66 67 6a 61 56 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 37 31 37 61 39 63 63 33 36 37 35 62 32 36 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Xi7BvGetlU6fgjaV.1Context: c717a9cc3675b269
2025-01-15 01:52:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 69 37 42 76 47 65 74 6c 55 36 66 67 6a 61 56 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 37 31 37 61 39 63 63 33 36 37 35 62 32 36 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Xi7BvGetlU6fgjaV.2Context: c717a9cc3675b269<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:12 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 58 69 37 42 76 47 65 74 6c 55 36 66 67 6a 61 56 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 37 31 37 61 39 63 63 33 36 37 35 62 32 36 39 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: Xi7BvGetlU6fgjaV.3Context: c717a9cc3675b269
2025-01-15 01:52:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 41 63 4a 55 43 42 44 70 6b 4b 54 45 61 5a 75 59 74 4d 58 50 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xAcJUCBDpkKTEaZuYtMXPQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.5	49719	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 58 5a 46 67 56 6c 74 49 6d 30 57 53 59 71 47 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 61 65 38 34 31 35 32 62 36 61 30 31 36 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: XZFgVltIm0WSYqG9.1Context: 24ae84152b6a0166
2025-01-15 01:52:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 58 5a 46 67 56 6c 74 49 6d 30 57 53 59 71 47 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 61 65 38 34 31 35 32 62 36 61 30 31 36 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: XZFgVltIm0WSYqG9.2Context: 24ae84152b6a0166<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:17 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 58 5a 46 67 56 6c 74 49 6d 30 57 53 59 71 47 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 34 61 65 38 34 31 35 32 62 36 61 30 31 36 36 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: XZFgVltIm0WSYqG9.3Context: 24ae84152b6a0166
2025-01-15 01:52:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 4e 35 2b 6b 32 49 35 78 45 79 46 68 53 36 32 39 6c 4a 74 75 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FN5+k2I5xEyFhS629lJtug.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.5	49720	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 43 2b 30 41 74 4c 46 56 30 4b 45 73 4c 72 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 37 38 31 36 37 63 37 33 30 39 35 35 65 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: RC+0AtLFV0KEsLrz.1Context: 8978167c730955ea
2025-01-15 01:52:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:18 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 52 43 2b 30 41 74 4c 46 56 30 4b 45 73 4c 72 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 37 38 31 36 37 63 37 33 30 39 35 35 65 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: RC+0AtLFV0KEsLrz.2Context: 8978167c730955ea<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 43 2b 30 41 74 4c 46 56 30 4b 45 73 4c 72 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 37 38 31 36 37 63 37 33 30 39 35 35 65 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: RC+0AtLFV0KEsLrz.3Context: 8978167c730955ea<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-15 01:52:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 52 74 35 6c 4d 51 4d 35 45 47 6a 4d 38 49 6d 6b 6e 47 43 4d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8Rt5lMQM5EGjM8ImknGCMg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49742	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:27 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 7a 47 2f 7a 34 77 58 68 30 65 33 72 6b 6c 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 32 30 64 64 31 31 66 36 61 37 34 33 64 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: LzG/z4wXh0e3rklw.1Context: 1b20dd11f6a743dd
2025-01-15 01:52:27 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:27 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 7a 47 2f 7a 34 77 58 68 30 65 33 72 6b 6c 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 32 30 64 64 31 31 66 36 61 37 34 33 64 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: LzG/z4wXh0e3rklw.2Context: 1b20dd11f6a743dd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:27 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4c 7a 47 2f 7a 34 77 58 68 30 65 33 72 6b 6c 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 32 30 64 64 31 31 66 36 61 37 34 33 64 64 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: LzG/z4wXh0e3rklw.3Context: 1b20dd11f6a743dd
2025-01-15 01:52:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 65 6e 36 4a 69 43 63 71 30 53 69 75 7a 49 66 70 78 36 54 39 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Qen6JiCcq0SiuzIfpx6T9w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49743	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:27 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 37 57 76 4a 79 32 71 42 55 53 36 53 54 5a 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 61 34 33 65 61 62 38 35 32 31 33 63 36 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: n7WvJy2qBUS6STZz.1Context: d2a43eab85213c6b
2025-01-15 01:52:27 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:27 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 37 57 76 4a 79 32 71 42 55 53 36 53 54 5a 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 61 34 33 65 61 62 38 35 32 31 33 63 36 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: n7WvJy2qBUS6STZz.2Context: d2a43eab85213c6b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:27 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 37 57 76 4a 79 32 71 42 55 53 36 53 54 5a 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 61 34 33 65 61 62 38 35 32 31 33 63 36 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: n7WvJy2qBUS6STZz.3Context: d2a43eab85213c6b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-15 01:52:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 52 36 47 78 58 7a 50 44 55 71 63 41 4f 49 37 4f 61 61 57 44 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YR6GxXzPDUqcAOI7OaaWDg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49986	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:45 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 66 47 2f 35 48 4c 59 4a 69 45 32 71 66 51 51 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 39 65 31 62 30 30 61 63 65 34 66 39 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: fG/5HLYJiE2qfQQg.1Context: a19e1b00ace4f9c0
2025-01-15 01:52:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:45 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 66 47 2f 35 48 4c 59 4a 69 45 32 71 66 51 51 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 39 65 31 62 30 30 61 63 65 34 66 39 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: fG/5HLYJiE2qfQQg.2Context: a19e1b00ace4f9c0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:45 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 66 47 2f 35 48 4c 59 4a 69 45 32 71 66 51 51 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 31 39 65 31 62 30 30 61 63 65 34 66 39 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: fG/5HLYJiE2qfQQg.3Context: a19e1b00ace4f9c0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-15 01:52:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 62 50 38 47 42 30 4c 31 55 2b 76 33 57 54 6b 54 48 43 55 45 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4bP8GB0L1U+v3WTkTHCUEg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	50015	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:52:46 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 50 4d 57 67 66 61 4e 33 6b 65 56 50 70 59 64 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 35 35 35 31 38 37 39 34 33 36 35 37 66 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mPMWgfaN3keVPpYd.1Context: 71555187943657f0
2025-01-15 01:52:46 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:52:46 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 50 4d 57 67 66 61 4e 33 6b 65 56 50 70 59 64 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 35 35 35 31 38 37 39 34 33 36 35 37 66 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mPMWgfaN3keVPpYd.2Context: 71555187943657f0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:52:46 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 6d 50 4d 57 67 66 61 4e 33 6b 65 56 50 70 59 64 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 35 35 35 31 38 37 39 34 33 36 35 37 66 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: mPMWgfaN3keVPpYd.3Context: 71555187943657f0
2025-01-15 01:52:46 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:52:46 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 4a 6e 77 49 6d 73 57 44 45 6d 63 64 46 41 69 37 67 61 62 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4JnwImsWDEmcdFAi7gabaw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	50300	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:53:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 56 70 53 32 58 70 4b 78 51 6b 61 33 49 34 6a 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 61 63 35 32 31 32 35 32 31 64 63 33 61 66 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: VpS2XpKxQka3I4jM.1Context: dac5212521dc3af1
2025-01-15 01:53:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:53:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 56 70 53 32 58 70 4b 78 51 6b 61 33 49 34 6a 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 61 63 35 32 31 32 35 32 31 64 63 33 61 66 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: VpS2XpKxQka3I4jM.2Context: dac5212521dc3af1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:53:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 56 70 53 32 58 70 4b 78 51 6b 61 33 49 34 6a 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 61 63 35 32 31 32 35 32 31 64 63 33 61 66 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: VpS2XpKxQka3I4jM.3Context: dac5212521dc3af1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-15 01:53:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:53:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 70 33 76 51 7a 37 6e 31 6b 61 6a 4b 49 74 57 49 4e 4e 67 64 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ep3vQz7n1kajKItWINNgdg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	50320	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:53:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 4c 4d 35 50 75 72 44 48 6b 65 34 6b 64 69 61 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 38 35 63 30 65 31 64 62 36 39 31 30 36 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HLM5PurDHke4kdia.1Context: 3d85c0e1db691067
2025-01-15 01:53:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:53:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 4c 4d 35 50 75 72 44 48 6b 65 34 6b 64 69 61 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 38 35 63 30 65 31 64 62 36 39 31 30 36 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HLM5PurDHke4kdia.2Context: 3d85c0e1db691067<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:53:12 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 48 4c 4d 35 50 75 72 44 48 6b 65 34 6b 64 69 61 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 64 38 35 63 30 65 31 64 62 36 39 31 30 36 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: HLM5PurDHke4kdia.3Context: 3d85c0e1db691067
2025-01-15 01:53:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:53:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 55 67 65 4a 38 6c 64 71 6d 55 71 6e 38 32 49 75 46 6a 69 6e 47 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: UgeJ8ldqmUqn82IuFjinGA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	50475	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:53:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6f 38 61 4e 66 73 33 7a 50 30 69 55 50 38 41 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 35 62 33 34 66 61 38 39 33 64 63 30 65 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: o8aNfs3zP0iUP8AI.1Context: 7b5b34fa893dc0e4
2025-01-15 01:53:35 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:53:35 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6f 38 61 4e 66 73 33 7a 50 30 69 55 50 38 41 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 35 62 33 34 66 61 38 39 33 64 63 30 65 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: o8aNfs3zP0iUP8AI.2Context: 7b5b34fa893dc0e4<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:53:35 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6f 38 61 4e 66 73 33 7a 50 30 69 55 50 38 41 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 62 35 62 33 34 66 61 38 39 33 64 63 30 65 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: o8aNfs3zP0iUP8AI.3Context: 7b5b34fa893dc0e4<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-15 01:53:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:53:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 64 31 45 4a 61 74 6a 67 55 4f 51 57 6c 4f 57 79 4b 41 57 55 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ud1EJatjgUOQWlOWyKAWUg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	50673	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:53:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 50 41 5a 55 47 30 67 63 45 65 61 49 74 77 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 33 62 36 34 32 39 37 65 38 30 39 64 62 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hPAZUG0gcEeaItwK.1Context: b13b64297e809db7
2025-01-15 01:53:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:53:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 50 41 5a 55 47 30 67 63 45 65 61 49 74 77 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 33 62 36 34 32 39 37 65 38 30 39 64 62 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: hPAZUG0gcEeaItwK.2Context: b13b64297e809db7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:53:39 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 68 50 41 5a 55 47 30 67 63 45 65 61 49 74 77 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 31 33 62 36 34 32 39 37 65 38 30 39 64 62 37 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: hPAZUG0gcEeaItwK.3Context: b13b64297e809db7
2025-01-15 01:53:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:53:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 30 6c 66 43 45 51 47 4b 55 47 38 4b 30 63 78 32 39 50 76 4e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: z0lfCEQGKUG8K0cx29PvNw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	50674	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:54:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 63 6f 78 4a 66 2f 6c 6c 6b 47 57 61 31 79 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 65 64 38 35 32 38 35 37 36 64 38 34 38 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NcoxJf/llkGWa1yO.1Context: 96ed8528576d8480
2025-01-15 01:54:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:54:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 63 6f 78 4a 66 2f 6c 6c 6b 47 57 61 31 79 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 65 64 38 35 32 38 35 37 36 64 38 34 38 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NcoxJf/llkGWa1yO.2Context: 96ed8528576d8480<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:54:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 63 6f 78 4a 66 2f 6c 6c 6b 47 57 61 31 79 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 65 64 38 35 32 38 35 37 36 64 38 34 38 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NcoxJf/llkGWa1yO.3Context: 96ed8528576d8480<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-15 01:54:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:54:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 52 63 66 77 63 44 45 72 6b 4f 45 66 46 71 42 37 37 58 54 63 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XRcfwcDErkOEfFqB77XTcw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	50675	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-15 01:54:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 59 39 71 79 78 4c 47 2f 55 65 4f 41 63 2f 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 65 30 38 34 32 35 32 32 34 61 31 65 39 37 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mY9qyxLG/UeOAc/F.1Context: be08425224a1e97a
2025-01-15 01:54:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2025-01-15 01:54:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 59 39 71 79 78 4c 47 2f 55 65 4f 41 63 2f 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 65 30 38 34 32 35 32 32 34 61 31 65 39 37 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 30 74 6d 6a 44 79 7a 73 73 67 73 73 6a 55 72 36 6f 71 35 30 72 31 43 6d 55 38 67 67 46 59 6b 46 49 46 77 4c 6f 59 65 56 47 63 6c 38 2b 46 35 64 5a 42 72 4c 41 56 4e 37 61 62 62 71 7a 73 6e 4a 47 6d 2b 55 79 74 64 37 59 4e 31 50 70 45 57 74 47 36 4d 30 75 6b 70 34 48 50 78 62 4d 56 77 57 53 70 61 2b 50 45 37 51 31 43 58 65 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mY9qyxLG/UeOAc/F.2Context: be08425224a1e97a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQ0tmjDyzssgssjUr6oq50r1CmU8ggFYkFIFwLoYeVGcl8+F5dZBrLAVN7abbqzsnJGm+Uytd7YN1PpEWtG6M0ukp4HPxbMVwWSpa+PE7Q1CXe
2025-01-15 01:54:16 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 6d 59 39 71 79 78 4c 47 2f 55 65 4f 41 63 2f 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 65 30 38 34 32 35 32 32 34 61 31 65 39 37 61 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: mY9qyxLG/UeOAc/F.3Context: be08425224a1e97a
2025-01-15 01:54:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-15 01:54:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 33 71 42 6a 59 4c 79 30 32 30 65 54 49 53 38 6d 5a 51 4e 2b 7a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 3qBjYLy020eTIS8mZQN+zA.0Payload parsing failed.

Target ID:	0
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll"
Imagebase:	0x730000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\542CxvZnI5.dll,PlayGame
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",#1
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'784'704 bytes
MD5 hash:	433720564D376A59C4FC3F2F8ACEC030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.2367955469.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.2155806207.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000005.00000002.2372011334.000000007FE40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000000.2155929134.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 95%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6156c0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000002.3402551905.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000002.3403262644.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.2157612272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:52:14
Start date:	14/01/2025
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff654c90000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000008.00000002.3403585451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000008.00000002.3402846585.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000008.00000000.2159244338.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:52:15
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.3402992756.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.3403852852.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000000.2162403933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:52:16
Start date:	14/01/2025
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"fontdrvhost.exe"
Imagebase:	0x7ff7b5950000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000002.3493795280.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000002.3402819580.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000000.2172969564.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:52:16
Start date:	14/01/2025
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	"fontdrvhost.exe"
Imagebase:	0x7ff7b5950000
File size:	827'408 bytes
MD5 hash:	BBCB897697B3442657C7D6E3EDDBD25F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000000.2174451067.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000002.3402735400.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000002.3493788665.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	20:52:16
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k RPCSS -p
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.3403150697.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.3403935827.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.2175662143.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	20:52:16
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.2179195689.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000002.3400994676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000002.3400610797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	20:52:17
Start date:	14/01/2025
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff79d4a0000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000002.3403338621.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000000.2181731693.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000002.3493625570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:52:17
Start date:	14/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\542CxvZnI5.dll",PlayGame
Imagebase:	0xe40000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:52:17
Start date:	14/01/2025
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3'784'704 bytes
MD5 hash:	433720564D376A59C4FC3F2F8ACEC030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000010.00000000.2185024353.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000010.00000002.2367251245.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000010.00000000.2185188875.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:52:17
Start date:	14/01/2025
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3'784'704 bytes
MD5 hash:	433720564D376A59C4FC3F2F8ACEC030
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.3006271461.000000007FE40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000011.00000002.2983639240.00000000024C3000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.2980597130.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000011.00000002.2979906966.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000011.00000000.2188065513.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000011.00000002.2982951688.0000000001FA0000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000011.00000000.2188241979.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:52:17
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000002.3402282133.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.2190133611.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000002.3402842670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	20:52:18
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000002.3400697506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000002.3400562813.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000000.2193268117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	20:52:18
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.2196070682.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000002.3403105922.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000002.3402428958.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	20:52:18
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000002.3403522882.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.2198977925.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000002.3404464062.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	20:52:19
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000016.00000000.2202870396.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000016.00000002.3404523967.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000016.00000002.3403542982.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	20:52:19
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000002.3400997195.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000002.3400698716.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000000.2205891354.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	20:52:21
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.3400695649.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.2223034706.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.3401226137.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	20:52:21
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000002.3400704837.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000000.2223988543.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000002.3401117945.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	20:52:21
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.2228632401.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.3403667247.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.3404729920.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	20:52:22
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.2236151257.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000002.3401002112.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000002.3400703981.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	20:52:23
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001C.00000000.2241048704.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001C.00000002.3403893417.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001C.00000002.3404976335.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	20:52:23
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000002.3402243073.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000000.2247232722.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000002.3401707801.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	20:52:23
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000002.3402432003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000000.2248711553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000002.3401875690.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	20:52:24
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000002.3401714846.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000002.3402354767.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000000.2253051631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	20:52:24
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000002.3405291179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000000.2254076183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000002.3404111410.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	20:52:24
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000002.3404348411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000002.3405677404.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000000.2256281044.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	20:52:24
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000000.2258234045.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000002.3404477534.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000002.3405775251.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	20:52:24
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000002.3405944268.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000000.2259095161.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000002.3404573979.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	20:52:25
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000002.3402001391.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000000.2262953528.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000002.3402662179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	20:52:25
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000002.3406217056.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000000.2264447813.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000002.3404889708.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	20:52:25
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000002.3402824272.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000000.2267954326.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000002.3402229166.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	20:52:26
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000027.00000002.3406467423.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000027.00000002.3405187204.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000027.00000000.2271192362.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	20:52:26
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000000.2275357508.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000002.3406751993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000002.3405487489.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	20:52:26
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000029.00000000.2276062758.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000029.00000002.3402235476.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000029.00000002.3402829287.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.7%
Total number of Nodes:	634
Total number of Limit Nodes:	3

Executed Functions

Function 00AD042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 287
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00AD04BE
GetVersion.KERNEL32 ref: 00AD0500
VirtualAlloc.KERNEL32(00000000,000076FC,08001000,00000040), ref: 00AD0528
CloseHandle.KERNELBASE(?), ref: 00AD05AD

Strings

csrs, xrefs: 00AD0826
\BaseNamedObjects\qsttVt, xrefs: 00AD0709, 00AD0726, 00AD0734
\BaseNamedObjects\qsttVt, xrefs: 00AD0708

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$AllocCloseModuleVersionVirtual
String ID: \BaseNamedObjects\qsttVt$\BaseNamedObjects\qsttVt$csrs
API String ID: 3017432202-1323636118
Opcode ID: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction ID: 7d66780ce2e84aae8e160708174802d39c618fe116bf39eb3d1152bb37a2fade
Opcode Fuzzy Hash: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction Fuzzy Hash: A0B18B71614249FFEB219F20D809FAE3BA9EF41711F04412AFD0A9E281C7F1AB45DB65

Function 00AD05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 192
stringnativeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 00AD05AD
GetModuleHandleA.KERNEL32(00AD05EC), ref: 00AD05F2
lstrcpyW.KERNEL32(\BaseNamedObjects\qsttVt,\BaseNamedObjects\qsttVt,?,?,?,?), ref: 00AD070A
lstrcpyW.KERNEL32(\BaseNamedObjects\qsttVt,?), ref: 00AD0727
lstrcatW.KERNEL32(\BaseNamedObjects\qsttVt,\qsttVt), ref: 00AD0735
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000076FC,00000000,?,00000002,00000000,00000040), ref: 00AD0765
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00AD0780
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD07C3
Process32First.KERNEL32 ref: 00AD07D6
Process32Next.KERNEL32 ref: 00AD07E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD07FF
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 00AD083C
CloseHandle.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD0857
CloseHandle.KERNELBASE ref: 00AD0866

Strings

csrs, xrefs: 00AD0826
\BaseNamedObjects\qsttVt, xrefs: 00AD0709, 00AD0726, 00AD0734
\BaseNamedObjects\qsttVt, xrefs: 00AD0708

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\qsttVt$\BaseNamedObjects\qsttVt$csrs
API String ID: 1545766225-1323636118
Opcode ID: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction ID: 53d6151e64933bc42ae61b309bf5a736567cc01b2034f31e5ec370622739af7f
Opcode Fuzzy Hash: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction Fuzzy Hash: 8F716A31500209FFEB259F20D849FAE3BADEF45711F04402AED0A9E291C7B5AF459B69

Function 00AD1169 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 328
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00AD115C,00AD0790,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD1169

Part of subcall function 00AD1190: GetProcAddress.KERNEL32(00000000,00AD117A), ref: 00AD1191

Strings

\qsttVt, xrefs: 00AD11C0

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: \qsttVt
API String ID: 2574300362-188326006
Opcode ID: 1e35bcb8b8532a76048d0d86edb04d2014c8a2691d4d50d2cd834940a34cba53
Instruction ID: 978591bf8bf87abb4ff433b377978e46bc8d4eb2b671bbc846fcf6c05fce6a48
Opcode Fuzzy Hash: 1e35bcb8b8532a76048d0d86edb04d2014c8a2691d4d50d2cd834940a34cba53
Instruction Fuzzy Hash: AEA17B659582937BCB629B358C894E9BF61EB3336474846EFE043CF783E2128947C791

Function 00AD2529 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenSection.NTDLL(?,0000000E), ref: 00AD2558

Strings

\BaseNamedObjects\qsttVt, xrefs: 00AD2545

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: OpenSection
String ID: \BaseNamedObjects\qsttVt
API String ID: 1950954290-689536162
Opcode ID: c6b8e9e32f6dcba079ef7aea98ec054ed3ce8beadf41c2fd00718ee6712a4e74
Instruction ID: b3aacc91b347d59d7f115e11f4200a74d00a3252589c1a9605fbc5584bb4d301
Opcode Fuzzy Hash: c6b8e9e32f6dcba079ef7aea98ec054ed3ce8beadf41c2fd00718ee6712a4e74
Instruction Fuzzy Hash: C2E0D8F17401063EFB185719CC07FF7218DDB80601F048508F914DA080E5F4DF1182B8

Function 00AD256E Relevance: 3.1, APIs: 2, Instructions: 66
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AD2529: NtOpenSection.NTDLL(?,0000000E), ref: 00AD2558

NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B6FC,00000000,?,00000002,00100000,00000040), ref: 00AD259E
CloseHandle.KERNELBASE(00000000,0000B6FC,00000000,?,00000002,00100000,00000040,00000000,0000B6FC,00000000,?,00AD080F), ref: 00AD25A6

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Section$CloseHandleOpenView
String ID:
API String ID: 2731707328-0
Opcode ID: 021b1acb1bf40c706123403cc397f8585b61a767fc7f0a33a1c3ace3a91a31f2
Instruction ID: b2e73985a9a7b7b952443b30ab2ea9ac9dfdd61704f696baa1779b37126f5dbf
Opcode Fuzzy Hash: 021b1acb1bf40c706123403cc397f8585b61a767fc7f0a33a1c3ace3a91a31f2
Instruction Fuzzy Hash: 1F212CB4300606AAEB28DB25DD96FA97369EFA0740F000129FD1A8F2D4DBB1AF55C754

Function 00AD141C Relevance: 3.0, APIs: 2, Instructions: 38
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?,00000001,00000000,00000000,00000002), ref: 00AD1454
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000,?,00000001,00000000,00000000,00000002), ref: 00AD1464

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 7157bc59c0e3de482e8bd6b2610b223013a43f583be5db88b94377e31208a128
Instruction ID: 01f7e7575b44af39e84b9ee94f66a89c6d22cfdb503e39dbcfd023e7ab42d64d
Opcode Fuzzy Hash: 7157bc59c0e3de482e8bd6b2610b223013a43f583be5db88b94377e31208a128
Instruction Fuzzy Hash: 9FF08236542520BBD6206F56CC8EED77E28EF533A0F144956F4484E156C2A28BA5D3E4

Function 00AD2471 Relevance: 3.0, APIs: 2, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00AD2495
NtWriteVirtualMemory.NTDLL ref: 00AD249E

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$ProtectWrite
String ID:
API String ID: 151266762-0
Opcode ID: 17dce67c487cc0ef90ba526871884689c6391e914ce978ece8a073020b9af88e
Instruction ID: bec36d184e0d76b253c82774af185ce515cf0d17d059aebebe1b98a4915fad90
Opcode Fuzzy Hash: 17dce67c487cc0ef90ba526871884689c6391e914ce978ece8a073020b9af88e
Instruction Fuzzy Hash: 7AE0ECA06502007FF5185B159C5BF7B391DDB41A45F410108FA0A98184F9A15E14467A

Function 00AD1444 Relevance: 3.0, APIs: 2, Instructions: 22
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?,00000001,00000000,00000000,00000002), ref: 00AD1454
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000,?,00000001,00000000,00000000,00000002), ref: 00AD1464

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 98fd101a259c938ae854db39385a2a060802fe35a78288dc9bd6859ea4aae5d1
Instruction ID: 0db5ea05f469a6ff49ad20a45e501a6d4802517c6c4e4fc049ea7a79551dc49b
Opcode Fuzzy Hash: 98fd101a259c938ae854db39385a2a060802fe35a78288dc9bd6859ea4aae5d1
Instruction Fuzzy Hash: 06D05E31603030BBD6302E0A8C0EED73D1DEF537B0F004400F80C8A191C1A28EA1C6F5

Function 00A7302F Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2367775905.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367835613.0000000000401000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367898202.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367955469.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367955469.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2368099020.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4656093ae1c7bbb04d21488f95fe7bddf1a9615c02ec3ad5a29a1aa1a73d1730
Instruction ID: 423065dfefecc7dea162951949b78e36b3c1b093d43354c81d1a365680741e01
Opcode Fuzzy Hash: 4656093ae1c7bbb04d21488f95fe7bddf1a9615c02ec3ad5a29a1aa1a73d1730
Instruction Fuzzy Hash: 28118C737042519BEB119E2CCD81EAE7762EFC4324F10C31AA5085F182CA3296439681

Function 7FE36573 Relevance: .0, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18debca8f2dd2d1ca2f8adb3937bfd968cff8255c5041bfcf825438cbb2dca55
Instruction ID: 682ed4916e240e91bb3464655f64230a32071a9ff5bd5beac95eb51c5ce772d4
Opcode Fuzzy Hash: 18debca8f2dd2d1ca2f8adb3937bfd968cff8255c5041bfcf825438cbb2dca55
Instruction Fuzzy Hash:

Function 00AD07A6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62
processthreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AD1444: LookupPrivilegeValueA.ADVAPI32(00000000,?,?,00000001,00000000,00000000,00000002), ref: 00AD1454
Part of subcall function 00AD1444: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000,?,00000001,00000000,00000000,00000002), ref: 00AD1464

CloseHandle.KERNELBASE(?), ref: 00AD05AD
FreeLibrary.KERNEL32(75070000,?,00AD0795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD07B2
CloseHandle.KERNELBASE(?,?,00AD0795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD07B9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD07C3
Process32First.KERNEL32 ref: 00AD07D6
Process32Next.KERNEL32 ref: 00AD07E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD07FF
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 00AD083C
CloseHandle.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00AD0857
CloseHandle.KERNELBASE ref: 00AD0866

Strings

csrs, xrefs: 00AD0826

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 3908997113-2321902090
Opcode ID: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction ID: 123a81c40f25fdebda7a90497da1887e2f3515fa74237ab6176f182a5619d291
Opcode Fuzzy Hash: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction Fuzzy Hash: 21112E71506205FBEB255F21CD4DFBE3A6DEF44711F00002EF94B9A192DBB09B41966A

Function 7FE343D2 Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FE3433F,?,7FE34321,?,7FE342FD), ref: 7FE34426

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84c08d243356dc0fc919d1563c1c0c01b0b950833543c4e03403cfd72bfabd16
Instruction ID: 8717e8b6497a710bd36704dbfe5b8924ce3f99e2975c281af0b22079df04dbef
Opcode Fuzzy Hash: 84c08d243356dc0fc919d1563c1c0c01b0b950833543c4e03403cfd72bfabd16
Instruction Fuzzy Hash: 5F21257060530ABAEB264E608D4DBFA366D9F01308F514239F91B9E094E7F56F05D714

Function 00AD05BA Relevance: 1.3, APIs: 1, Instructions: 7
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000000A,00AD0856,?,00000000,00000000,-00003BCA,00000002,00000000,?,00000000), ref: 00AD05C1

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cbe9f769ebb1c608110980d8cf827f438a34bc7706bd5e9152dadd0aa2487085
Instruction ID: 964d894fd2a793776e974d311a5db8452aeb17e8a98a3e14336dc8c19994ee66
Opcode Fuzzy Hash: cbe9f769ebb1c608110980d8cf827f438a34bc7706bd5e9152dadd0aa2487085
Instruction Fuzzy Hash: 52B01238240304D5DA140910640EF443B24BF01B11FE04056FA070C1C406E00600180D

Non-executed Functions

Function 00AD3CC8 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00AD3CBD), ref: 00AD3CC8

Part of subcall function 00AD3CDD: GetProcAddress.KERNEL32(00000000,00AD3CD3), ref: 00AD3CDE
Part of subcall function 00AD3CDD: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AD3CF1
Part of subcall function 00AD3CDD: GetTickCount.KERNEL32 ref: 00AD3D25
Part of subcall function 00AD3CDD: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AD6E32,00000000,00000000,00000000,00000000), ref: 00AD3DF7

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ADVAPI32.DLL, xrefs: 00AD3CF0
020a00 . . :#997242831 +*, xrefs: 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3734769084-2898123092
Opcode ID: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction ID: 255b576ff8016ab71e2a2e3b426d281b27046e8c722242e88a42ec6686f35b3f
Opcode Fuzzy Hash: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction Fuzzy Hash: 06C1E572515259BEDF35AF24CC1ABEA3BACEF11300F00051BF84A9E181D6F45F45CAA6

Function 7FE3042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 287memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 7FE304BE
GetVersion.KERNEL32 ref: 7FE30500
VirtualAlloc.KERNEL32(00000000,000076FC,08001000,00000040), ref: 7FE30528
CloseHandle.KERNEL32(?), ref: 7FE305AD

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE30709, 7FE30726, 7FE30734
\BaseNamedObjects\yietVt, xrefs: 7FE30708
csrs, xrefs: 7FE30826

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$AllocCloseModuleVersionVirtual
String ID: \BaseNamedObjects\yietVt$\BaseNamedObjects\yietVt$csrs
API String ID: 3017432202-3480717028
Opcode ID: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction ID: 04f34b70a3527beab436bb0bff5453feb2d818ff2f8925b7a06916a221e9b453
Opcode Fuzzy Hash: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction Fuzzy Hash: D3B1AC71915349FFEB229F20CC09BEA3BA9EF41719F404129EE0A9E181C7F0AB45CB55

Function 7FE305F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 192stringnativeprocessCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 7FE305AD
GetModuleHandleA.KERNEL32(7FE305EC), ref: 7FE305F2
lstrcpyW.KERNEL32(\BaseNamedObjects\yietVt,\BaseNamedObjects\yietVt,?,?,?,?), ref: 7FE3070A
lstrcpyW.KERNEL32(\BaseNamedObjects\yietVt,?), ref: 7FE30727
lstrcatW.KERNEL32(\BaseNamedObjects\yietVt,\yietVt), ref: 7FE30735
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000076FC,00000000,?,00000002,00000000,00000040), ref: 7FE30765
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FE30780
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE307C3
Process32First.KERNEL32 ref: 7FE307D6
Process32Next.KERNEL32 ref: 7FE307E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE307FF
CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 7FE3083C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE30857
CloseHandle.KERNEL32 ref: 7FE30866

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE30709, 7FE30726, 7FE30734
\BaseNamedObjects\yietVt, xrefs: 7FE30708
csrs, xrefs: 7FE30826

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\yietVt$\BaseNamedObjects\yietVt$csrs
API String ID: 1545766225-3480717028
Opcode ID: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction ID: 5f8d29788b043f7579ddb3552f6ead3fe933542943f9b5d3a9fd129d50e69607
Opcode Fuzzy Hash: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction Fuzzy Hash: F8717E31901219FFDB229F10CC4DBAD3BAEEF45719F800029EA0A9E191C7B5AB45DB55

Function 00AD3820 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(00AD74C0), ref: 00AD3831
Sleep.KERNEL32(0000EA60), ref: 00AD38A3
InternetGetConnectedState.WININET(?,00000000), ref: 00AD38BC
gethostbyname.WS2_32(0D278061), ref: 00AD38FE
socket.WS2_32(00000002,00000001,00000000), ref: 00AD3913
ioctlsocket.WS2_32(?,8004667E), ref: 00AD392C
connect.WS2_32(?,?,00000010), ref: 00AD3945
Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00AD3953
closesocket.WS2_32 ref: 00AD39B2

Strings

ceiphj.com, xrefs: 00AD3883

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
String ID: ceiphj.com
API String ID: 159131500-6118775
Opcode ID: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction ID: 03dab0c03696cbb48b8462064fafa246a57d4c98600274ddb68a437c2a9b6177
Opcode Fuzzy Hash: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction Fuzzy Hash: 1341E272705249BADB315F248C5DBADBA6EAF85710F04401AF90A9E2C1D6F18F00C625

Function 00AD3372 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00AD33DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00AD33FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00AD3425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00AD3432
UnmapViewOfFile.KERNEL32(?), ref: 00AD344A

Strings

\Device\PhysicalMemory, xrefs: 00AD3372
C:,, xrefs: 00AD33A6

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$\Device\PhysicalMemory
API String ID: 2985292042-1440550476
Opcode ID: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction ID: 3347d35f520ad2ad6cb8c8480a12756c5046917d8116c21bfe01025f46d17f17
Opcode Fuzzy Hash: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction Fuzzy Hash: 34819BB2500208FFEF248F14CC8AAAA37BCEF44711F504559FD1A9B291D6B0AF558AA5

Function 7FE33372 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FE333DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FE333FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FE33425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FE33432
UnmapViewOfFile.KERNEL32(?), ref: 7FE3344A

Strings

\Device\PhysicalMemory, xrefs: 7FE33372
C:,, xrefs: 7FE333A6

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$\Device\PhysicalMemory
API String ID: 2985292042-1440550476
Opcode ID: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction ID: dae858870bd32466b7bddd82511c493b39ec6c13607736059af140c559e1dea1
Opcode Fuzzy Hash: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction Fuzzy Hash: 8781CC71900208FFEB258F14CC8AEAA37BDEF04704F914518FD1A9B291D6B0AF55DBA4

Function 00AD3397 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00AD33DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00AD33FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00AD3425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00AD3432
UnmapViewOfFile.KERNEL32(?), ref: 00AD344A

Strings

ysic, xrefs: 00AD33E2, 00AD33F8
C:,, xrefs: 00AD33A6

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$ysic
API String ID: 2985292042-2852681185
Opcode ID: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction ID: e5d39e792b0a550b1476985585d03d1798d987fb9f5b82fb56589eb60b6aae1b
Opcode Fuzzy Hash: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction Fuzzy Hash: 89116D71140609FBEB248F10CC5AFAB367CEF88704F504519FB1A9A290D7B4AF248655

Function 7FE33397 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FE333DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FE333FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FE33425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FE33432
UnmapViewOfFile.KERNEL32(?), ref: 7FE3344A

Strings

ysic, xrefs: 7FE333E2, 7FE333F8
C:,, xrefs: 7FE333A6

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$ysic
API String ID: 2985292042-2852681185
Opcode ID: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction ID: c22d13a93bd3b9c73f168f7cf7bdc03220e19a3a5620524a59d81e800a0a7989
Opcode Fuzzy Hash: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction Fuzzy Hash: 94115B74940609FFEB258F10CC5AFAB367DEF88704F404518EA1A9A291D7B46F289654

Function 00AD27A1 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,00AD279D,00000000,?), ref: 00AD27A2
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00AD279D,00000000,?), ref: 00AD27BD
InternetReadFile.WININET(?,?,00000104), ref: 00AD27D7
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00AD279D,00000000,?), ref: 00AD27ED
CloseHandle.KERNEL32(?,00000104,?,00000000,?,00AD279D,00000000,?), ref: 00AD27F9
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00AD279D), ref: 00AD281D
InternetCloseHandle.WININET(?), ref: 00AD282D
InternetCloseHandle.WININET(00000000), ref: 00AD2834

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
String ID:
API String ID: 3452404049-0
Opcode ID: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction ID: 3b8ca853eee6214f1c13ae3b1aba47129e2d059189a50d4634309c32f6723930
Opcode Fuzzy Hash: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction Fuzzy Hash: CB116DB1142606BBEB350B20CC4DFEF7A6CEF95B11F004519FA0A8D181DBB09E50D6B9

Function 7FE34BD7 Relevance: 7.1, Strings: 5, Instructions: 887COMMON

Download Yara Rule

Strings

!, xrefs: 7FE34CA3
&, xrefs: 7FE35550
(, xrefs: 7FE358DD
&, xrefs: 7FE3554A
@, xrefs: 7FE35051

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: !$&$&$($@
API String ID: 823142352-3998544071
Opcode ID: 935d3fe01e483ae9b1e380af8f2d7e4f9ebb9ebdfa7ef0ecd0523d0a373f3978
Instruction ID: 42dae100fec18222106f7dafdc1752d7360eb2aa2eb29d0e1fc5392f25e0b5cc
Opcode Fuzzy Hash: 935d3fe01e483ae9b1e380af8f2d7e4f9ebb9ebdfa7ef0ecd0523d0a373f3978
Instruction Fuzzy Hash: 8382023190534AEFDB26CF28C8497997BBAEF40319F944219C82A8F285D3F4AF51CB51

Function 00AD24A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\qsttVt), ref: 00AD24B4
lstrlenW.KERNEL32(?), ref: 00AD24BB
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00AD2510

Strings

\BaseNamedObjects\qsttVt, xrefs: 00AD24B2

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\qsttVt
API String ID: 2597515329-689536162
Opcode ID: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction ID: 6d2c312854f6121ce401f046694641950b81a493101a9980076e275459001e0b
Opcode Fuzzy Hash: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction Fuzzy Hash: 9F01A4B0B803057AF7305B79CC8FF5A7A68DF81B50F508518F719AE1C4D6B89A0483A9

Function 7FE324A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\yietVt), ref: 7FE324B4
lstrlenW.KERNEL32(?), ref: 7FE324BB
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FE32510

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE324B2

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\yietVt
API String ID: 2597515329-129974550
Opcode ID: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction ID: 9d30c6d5b88624d8d5e8cf60965674804df526b05ac6bdb63d529ecfc8a1f6c0
Opcode Fuzzy Hash: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction Fuzzy Hash: 1D01A4B0B803057AF7305B79CC8FF5A7E68DF81B50F908518F718AE1C4D6B89A0483A9

Function 7FE32529 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,0000000E), ref: 7FE32558

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE32545

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: OpenSection
String ID: \BaseNamedObjects\yietVt
API String ID: 1950954290-129974550
Opcode ID: c6b8e9e32f6dcba079ef7aea98ec054ed3ce8beadf41c2fd00718ee6712a4e74
Instruction ID: b3aacc91b347d59d7f115e11f4200a74d00a3252589c1a9605fbc5584bb4d301
Opcode Fuzzy Hash: c6b8e9e32f6dcba079ef7aea98ec054ed3ce8beadf41c2fd00718ee6712a4e74
Instruction Fuzzy Hash: C2E0D8F17401063EFB185719CC07FF7218DDB80601F048508F914DA080E5F4DF1182B8

Function 7FE3256E Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 7FE32529: NtOpenSection.NTDLL(?,0000000E), ref: 7FE32558

NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B6FC,00000000,?,00000002,00100000,00000040), ref: 7FE3259E
CloseHandle.KERNEL32(00000000,0000B6FC,00000000,?,00000002,00100000,00000040,00000000,0000B6FC,00000000,?,7FE3080F), ref: 7FE325A6

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Section$CloseHandleOpenView
String ID:
API String ID: 2731707328-0
Opcode ID: 021b1acb1bf40c706123403cc397f8585b61a767fc7f0a33a1c3ace3a91a31f2
Instruction ID: 7e00d63353bb450a698177bfab7b78e78f9df3cb21cfb0c2f97f42846b99aac6
Opcode Fuzzy Hash: 021b1acb1bf40c706123403cc397f8585b61a767fc7f0a33a1c3ace3a91a31f2
Instruction Fuzzy Hash: DF215E70701706BADB14CE29CC99BE97369EF80B44F800118F9AA8E1D4DBB1BF55C754

Function 7FE3141C Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FE31454
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FE31464

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 7157bc59c0e3de482e8bd6b2610b223013a43f583be5db88b94377e31208a128
Instruction ID: 01f7e7575b44af39e84b9ee94f66a89c6d22cfdb503e39dbcfd023e7ab42d64d
Opcode Fuzzy Hash: 7157bc59c0e3de482e8bd6b2610b223013a43f583be5db88b94377e31208a128
Instruction Fuzzy Hash: 9FF08236542520BBD6206F56CC8EED77E28EF533A0F144956F4484E156C2A28BA5D3E4

Function 7FE32471 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FE32495
NtWriteVirtualMemory.NTDLL ref: 7FE3249E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$ProtectWrite
String ID:
API String ID: 151266762-0
Opcode ID: 17dce67c487cc0ef90ba526871884689c6391e914ce978ece8a073020b9af88e
Instruction ID: bec36d184e0d76b253c82774af185ce515cf0d17d059aebebe1b98a4915fad90
Opcode Fuzzy Hash: 17dce67c487cc0ef90ba526871884689c6391e914ce978ece8a073020b9af88e
Instruction Fuzzy Hash: 7AE0ECA06502007FF5185B159C5BF7B391DDB41A45F410108FA0A98184F9A15E14467A

Function 7FE31444 Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FE31454
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FE31464

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 98fd101a259c938ae854db39385a2a060802fe35a78288dc9bd6859ea4aae5d1
Instruction ID: 0db5ea05f469a6ff49ad20a45e501a6d4802517c6c4e4fc049ea7a79551dc49b
Opcode Fuzzy Hash: 98fd101a259c938ae854db39385a2a060802fe35a78288dc9bd6859ea4aae5d1
Instruction Fuzzy Hash: 06D05E31603030BBD6302E0A8C0EED73D1DEF537B0F004400F80C8A191C1A28EA1C6F5

Function 00AD28C2 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction ID: b5ba4eb2f9a533b20c83361a45d7c357f26364b44b0134e84347205d32ac30b9
Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction Fuzzy Hash: 6A314A326006158FEB248E38C85079AB7F2FBA0304F10863DE557E7690E675FA89CBC0

Function 7FE328C2 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction ID: ca3a9a37b74bf7aa586a4064ea8576876fc0c0323dbac7bcaac21d1f4a8500d1
Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
Instruction Fuzzy Hash: D4312732A006158BEB148E38C84478AB3F2FF80308F50863CE597E7598E675F689CBC0

Function 00AD025E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4547b3fe3f7ade73cb4b8cd50c3b6c2eeef74501d41428d812dece7d1f783b26
Instruction ID: 81a9d6d4fa21d13140c361b215f045ee1f13936df36b75a41ee8aed2659f6ea5
Opcode Fuzzy Hash: 4547b3fe3f7ade73cb4b8cd50c3b6c2eeef74501d41428d812dece7d1f783b26
Instruction Fuzzy Hash: 100147723451459BD720EF28CD88FEDB7A1EBC8334F24832AF5555B28AD732B281C651

Function 7FE3025E Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572a3687137416e2f1393bb95436ee19a00af6eeea5e865505a5396fd5f2180a
Instruction ID: 8b3b2c02e8159a845957be8b6a6804547998441cb8766027518aa4d06a51a22c
Opcode Fuzzy Hash: 572a3687137416e2f1393bb95436ee19a00af6eeea5e865505a5396fd5f2180a
Instruction Fuzzy Hash: 77012472A052415AD721DF28CC8CB9EBBA1EFC433CF508365E6544A08ADB32A281C791

Function 00A79868 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2369222468.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2367775905.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367835613.0000000000401000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367898202.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367955469.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2367955469.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2368099020.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2368237677.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3fcd72a7bd03043e237b6fb81569234861e2c05d060d0b7c2db648b0d2632e
Instruction ID: 94d818b1ef28d16b92e94c67afe63a3f6943ffa20059e7ad0ce01537133526f2
Opcode Fuzzy Hash: 7d3fcd72a7bd03043e237b6fb81569234861e2c05d060d0b7c2db648b0d2632e
Instruction Fuzzy Hash: B1D067714082568FC7512BA4DC4D6DEFBA4AF84382F118829B59A94061DEA489819B53

Function 00AD3BCF Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 00AD3C33
GetProcAddress.KERNEL32(00000000,00000002), ref: 00AD3C66
GetProcAddress.KERNEL32(00000000,00AD3CD3), ref: 00AD3CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AD3CF1
GetTickCount.KERNEL32 ref: 00AD3D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AD6E32,00000000,00000000,00000000,00000000), ref: 00AD3DF7

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ADVAPI32.DLL, xrefs: 00AD3CF0
020a00 . . :#997242831 +*, xrefs: 00AD3C32, 00AD3C98, 00AD3CA8, 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3969011833-2898123092
Opcode ID: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction ID: 8151d29ed86bca491de4e1773e54f6c2de13c0aa2291fd2ad5e740f5a9b794cf
Opcode Fuzzy Hash: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction Fuzzy Hash: F9F10572519258BEDF35AF24CC5ABEA7BACEF11300F00451BE84A9F181D6F05F45CAA6

Function 7FE33BCF Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 7FE33C33
GetProcAddress.KERNEL32(00000000,00000002), ref: 7FE33C66
GetProcAddress.KERNEL32(00000000,7FE33CD3), ref: 7FE33CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE33CF1
GetTickCount.KERNEL32 ref: 7FE33D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE36E32,00000000,00000000,00000000,00000000), ref: 7FE33DF7

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
ADVAPI32.DLL, xrefs: 7FE33CF0
020a00 . . :#997242831 +*, xrefs: 7FE33C32, 7FE33C98, 7FE33CA8, 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3969011833-1880045089
Opcode ID: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction ID: da1604d828438dcac60165ae72afd15238aa5ff539de2de622a5dcc37a23a33c
Opcode Fuzzy Hash: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction Fuzzy Hash: 44F1057191A349BEDB229F20CC5EBDA7BACEF41304F40451AE8499F081D6F46F45CBA6

Function 00AD3C54 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00AD3C4C), ref: 00AD3C54
GetProcAddress.KERNEL32(00000000,00000002), ref: 00AD3C66
GetProcAddress.KERNEL32(00000000,00AD3CD3), ref: 00AD3CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AD3CF1
GetTickCount.KERNEL32 ref: 00AD3D25

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ADVAPI32.DLL, xrefs: 00AD3CF0
020a00 . . :#997242831 +*, xrefs: 00AD3CA8, 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2837544101-2898123092
Opcode ID: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction ID: f3a67a0a7350aed83eef8a1491480b57fb22319146da1518df07b34107d263a2
Opcode Fuzzy Hash: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction Fuzzy Hash: 46E10671519259BEDF35AF30CC5ABEA3BACEF11300F00051BE84A9E182D6F05F45CAA6

Function 7FE33C54 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FE33C4C), ref: 7FE33C54
GetProcAddress.KERNEL32(00000000,00000002), ref: 7FE33C66
GetProcAddress.KERNEL32(00000000,7FE33CD3), ref: 7FE33CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE33CF1
GetTickCount.KERNEL32 ref: 7FE33D25

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
ADVAPI32.DLL, xrefs: 7FE33CF0
020a00 . . :#997242831 +*, xrefs: 7FE33CA8, 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2837544101-1880045089
Opcode ID: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction ID: 70a4d518b3b81bee048e16ce87541070b4c0732f49a9e57f97ab6540a5d80f79
Opcode Fuzzy Hash: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction Fuzzy Hash: 86E1177191A345BEDB269F30CC5EBEA7BACEF41300F40451AE8498E081D6F46F45CBA6

Function 00AD3C82 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00AD3C77), ref: 00AD3C82
GetSystemDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 00AD3C99

Part of subcall function 00AD3CB1: lstrcat.KERNEL32(020a00 . . :#997242831 +*,00AD3CA4), ref: 00AD3CB2
Part of subcall function 00AD3CB1: GetProcAddress.KERNEL32(00000000,00AD3CD3), ref: 00AD3CDE
Part of subcall function 00AD3CB1: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AD3CF1
Part of subcall function 00AD3CB1: GetTickCount.KERNEL32 ref: 00AD3D25
Part of subcall function 00AD3CB1: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AD6E32,00000000,00000000,00000000,00000000), ref: 00AD3DF7

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ADVAPI32.DLL, xrefs: 00AD3CF0
020a00 . . :#997242831 +*, xrefs: 00AD3C98, 00AD3CA8, 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 215653160-2898123092
Opcode ID: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction ID: 5416825b854dd29231142e2045ac573d03f6646c759c7858448cabf52c307d98
Opcode Fuzzy Hash: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction Fuzzy Hash: 83D1F572515259BEDF35AF20CC5ABEA3BACEF11300F00451AF84A9E182D6F45F45CBA6

Function 7FE33C82 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FE33C77), ref: 7FE33C82
GetSystemDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 7FE33C99

Part of subcall function 7FE33CB1: lstrcat.KERNEL32(020a00 . . :#997242831 +*,7FE33CA4), ref: 7FE33CB2
Part of subcall function 7FE33CB1: GetProcAddress.KERNEL32(00000000,7FE33CD3), ref: 7FE33CDE
Part of subcall function 7FE33CB1: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE33CF1
Part of subcall function 7FE33CB1: GetTickCount.KERNEL32 ref: 7FE33D25
Part of subcall function 7FE33CB1: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE36E32,00000000,00000000,00000000,00000000), ref: 7FE33DF7

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
ADVAPI32.DLL, xrefs: 7FE33CF0
020a00 . . :#997242831 +*, xrefs: 7FE33C98, 7FE33CA8, 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 215653160-1880045089
Opcode ID: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction ID: 83dcdcace0a305a03f866234c87c2166a0dafa159639c374a62d1877331dd441
Opcode Fuzzy Hash: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction Fuzzy Hash: 62D1067191A349BEDB269F30CC5EBEA3BACEF41300F40451AE8499E081D6F46F45CBA5

Function 00AD3CB1 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(020a00 . . :#997242831 +*,00AD3CA4), ref: 00AD3CB2

Part of subcall function 00AD3CC8: LoadLibraryA.KERNEL32(00AD3CBD), ref: 00AD3CC8
Part of subcall function 00AD3CC8: GetProcAddress.KERNEL32(00000000,00AD3CD3), ref: 00AD3CDE
Part of subcall function 00AD3CC8: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AD3CF1
Part of subcall function 00AD3CC8: GetTickCount.KERNEL32 ref: 00AD3D25
Part of subcall function 00AD3CC8: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AD6E32,00000000,00000000,00000000,00000000), ref: 00AD3DF7

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ADVAPI32.DLL, xrefs: 00AD3CF0
020a00 . . :#997242831 +*, xrefs: 00AD3CB1, 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2038497427-2898123092
Opcode ID: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction ID: 68674a65dcacff37754a8e8cc12ac445b37c3bbd00cb11b3aeaeaba76037c588
Opcode Fuzzy Hash: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction Fuzzy Hash: 85D1F472515259BEDF35AF34CC1ABEA3BACEF11300F00051AF84A9E181D6F45F45CAA6

Function 7FE33CB1 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(020a00 . . :#997242831 +*,7FE33CA4), ref: 7FE33CB2

Part of subcall function 7FE33CC8: LoadLibraryA.KERNEL32(7FE33CBD), ref: 7FE33CC8
Part of subcall function 7FE33CC8: GetProcAddress.KERNEL32(00000000,7FE33CD3), ref: 7FE33CDE
Part of subcall function 7FE33CC8: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE33CF1
Part of subcall function 7FE33CC8: GetTickCount.KERNEL32 ref: 7FE33D25
Part of subcall function 7FE33CC8: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE36E32,00000000,00000000,00000000,00000000), ref: 7FE33DF7

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
ADVAPI32.DLL, xrefs: 7FE33CF0
020a00 . . :#997242831 +*, xrefs: 7FE33CB1, 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2038497427-1880045089
Opcode ID: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction ID: 4ff958fbc77df0c06950529926399d06ecb6471fa7ea1c68174c22b5ddb7eb65
Opcode Fuzzy Hash: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction Fuzzy Hash: E9D1067191A349BEDB269F30CC5EBEA7BACEF41300F40451AE8499E081D6F46F45CBA5

Function 7FE33CC8 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FE33CBD), ref: 7FE33CC8

Part of subcall function 7FE33CDD: GetProcAddress.KERNEL32(00000000,7FE33CD3), ref: 7FE33CDE
Part of subcall function 7FE33CDD: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE33CF1
Part of subcall function 7FE33CDD: GetTickCount.KERNEL32 ref: 7FE33D25
Part of subcall function 7FE33CDD: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE36E32,00000000,00000000,00000000,00000000), ref: 7FE33DF7

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
ADVAPI32.DLL, xrefs: 7FE33CF0
020a00 . . :#997242831 +*, xrefs: 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3734769084-1880045089
Opcode ID: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction ID: d7a75b92e3d121634934339876560cbfcea646d92f54ea58f82db6636dbb7707
Opcode Fuzzy Hash: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction Fuzzy Hash: 05C1F87191A345BEDB269F30CC5EBDA7BACEF41300F80451AE8499E081D6F46F45CBA5

Function 00AD3F21 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205networkthreadlibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00AD3F15), ref: 00AD3F21
WSAStartup.WS2_32(00000101), ref: 00AD3F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00AD3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00AD3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AD3F91
lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00AD3FE2
gethostbyname.WS2_32(ilo.brenz.pl), ref: 00AD3FF1
socket.WS2_32(00000002,00000001,00000000), ref: 00AD4022
connect.WS2_32(6F6C6902,00AD3A9B,00000010), ref: 00AD403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 00AD4086
wsprintfA.USER32 ref: 00AD4104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 00AD4132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,00AD6E32,00000099,6F6C6902,6F6C6902,00AD3AE4,00000014,00000000), ref: 00AD413B
RtlExitUserThread.NTDLL(00000000), ref: 00AD425B

Strings

C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ilo.brenz.pl, xrefs: 00AD3FE1, 00AD3FF0
020a00 . . :#997242831 +*, xrefs: 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
String ID: 020a00 . . :#997242831 +*$C:\WINDOWS\SYSTEM32\IMM32.DLL$ilo.brenz.pl
API String ID: 3947895852-2013876662
Opcode ID: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction ID: fe5248c2a45eb6e640fe31c1f8c6008f9dfb3265a81ac95f64759c9dbe6e222b
Opcode Fuzzy Hash: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction Fuzzy Hash: 5381CF71505249BFEF359F24C81ABEA7BACEF45300F04060AF85A5E291D6F09F45C7AA

Function 7FE33F21 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205networkthreadlibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FE33F15), ref: 7FE33F21
WSAStartup.WS2_32(00000101), ref: 7FE33F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE33F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE33F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE33F91
lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FE33FE2
gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FE33FF1
socket.WS2_32(00000002,00000001,00000000), ref: 7FE34022
connect.WS2_32(6F6C6902,7FE33A9B,00000010), ref: 7FE3403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE34086
wsprintfA.USER32 ref: 7FE34104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 7FE34132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,7FE36E32,00000099,6F6C6902,6F6C6902,7FE33AE4,00000014,00000000), ref: 7FE3413B
RtlExitUserThread.NTDLL(00000000), ref: 7FE3425B

Strings

ilo.brenz.pl, xrefs: 7FE33FE1, 7FE33FF0
\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
020a00 . . :#997242831 +*, xrefs: 7FE34113, 7FE34152

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT$ilo.brenz.pl
API String ID: 3947895852-2481640231
Opcode ID: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction ID: c49a2c14bca3a15c4feb8626536a0a70f50950f38cdf95da694c6cce0e188f31
Opcode Fuzzy Hash: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction Fuzzy Hash: 7F81D271909349FEEB219F30CC1DBDA7BADEF41304F800649E85A5E091D6F4AB45CB99

Function 00AD3CDD Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371networklibrarythreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00AD3CD3), ref: 00AD3CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AD3CF1
GetTickCount.KERNEL32 ref: 00AD3D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AD6E32,00000000,00000000,00000000,00000000), ref: 00AD3DF7
CreateThread.KERNEL32(00000000,00000000,00AD3623,00000000,00000000), ref: 00AD3ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 00AD3EDB
WSAStartup.WS2_32(00000101), ref: 00AD3F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00AD3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00AD3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AD3F91
socket.WS2_32(00000002,00000001,00000000), ref: 00AD4022
connect.WS2_32(6F6C6902,00AD3A9B,00000010), ref: 00AD403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 00AD4086
wsprintfA.USER32 ref: 00AD4104
SetEvent.KERNEL32(000003D8,?,00000000), ref: 00AD421F
Sleep.KERNEL32(00007530,?,00000000), ref: 00AD4230
ResetEvent.KERNEL32(000003D8,?,00000000), ref: 00AD4243

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
ADVAPI32.DLL, xrefs: 00AD3CF0
020a00 . . :#997242831 +*, xrefs: 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 927156256-2898123092
Opcode ID: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction ID: 383fe12cf6e5059fe91e2678d253756f6ee73d91b0939745e113397651b5b88c
Opcode Fuzzy Hash: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction Fuzzy Hash: 96D1F472515258BEDF35AF24CC5ABEA3BACEF15300F00051AF84A9E182D6F45F45CBA6

Function 7FE33CDD Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371networklibrarythreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,7FE33CD3), ref: 7FE33CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE33CF1
GetTickCount.KERNEL32 ref: 7FE33D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE36E32,00000000,00000000,00000000,00000000), ref: 7FE33DF7
CreateThread.KERNEL32(00000000,00000000,7FE33623,00000000,00000000), ref: 7FE33ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 7FE33EDB
WSAStartup.WS2_32(00000101), ref: 7FE33F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE33F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE33F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE33F91
socket.WS2_32(00000002,00000001,00000000), ref: 7FE34022
connect.WS2_32(6F6C6902,7FE33A9B,00000010), ref: 7FE3403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE34086
wsprintfA.USER32 ref: 7FE34104
SetEvent.KERNEL32(00000644,?,00000000), ref: 7FE3421F
Sleep.KERNEL32(00007530,?,00000000), ref: 7FE34230
ResetEvent.KERNEL32(00000644,?,00000000), ref: 7FE34243

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
ADVAPI32.DLL, xrefs: 7FE33CF0
020a00 . . :#997242831 +*, xrefs: 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 927156256-1880045089
Opcode ID: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction ID: 5ef1025bd57abed28f7472cc32f9ff5e11ae30dcc27ab3629cd55a7518a2afca
Opcode Fuzzy Hash: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction Fuzzy Hash: FDD1E37191A349BEDB269F30CC5EBEA7BACEF41300F40451AE8499E081D6F46F45CBA5

Function 00AD3E5E Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00AD3E52), ref: 00AD3E5F
GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 00AD3E74
wsprintfA.USER32 ref: 00AD3E89
CreateThread.KERNEL32(00000000,00000000,00AD3623,00000000,00000000), ref: 00AD3ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 00AD3EDB
WSAStartup.WS2_32(00000101), ref: 00AD3F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00AD3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00AD3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AD3F91

Part of subcall function 00AD3397: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00AD33DC
Part of subcall function 00AD3397: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00AD33FB
Part of subcall function 00AD3397: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00AD3425
Part of subcall function 00AD3397: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00AD3432
Part of subcall function 00AD3397: UnmapViewOfFile.KERNEL32(?), ref: 00AD344A

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
020a00 . . :#997242831 +*, xrefs: 00AD3E71, 00AD3E86, 00AD4113, 00AD4152
C:,, xrefs: 00AD3E88

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
String ID: 020a00 . . :#997242831 +*$C:,$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 3630706530-3879727862
Opcode ID: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction ID: 0fe6675104d39a8230c60ab3a41a3442f2f8d1e004f3421bd32eaa2e095780eb
Opcode Fuzzy Hash: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction Fuzzy Hash: B491DE72505249BFEB35AF24CC5ABEA7B6CEF45300F00460AF85A5E181D6F06F45CBA6

Function 7FE33E5E Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,7FE33E52), ref: 7FE33E5F
GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 7FE33E74
wsprintfA.USER32 ref: 7FE33E89
CreateThread.KERNEL32(00000000,00000000,7FE33623,00000000,00000000), ref: 7FE33ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 7FE33EDB
WSAStartup.WS2_32(00000101), ref: 7FE33F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE33F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE33F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE33F91

Part of subcall function 7FE33397: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FE333DC
Part of subcall function 7FE33397: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FE333FB
Part of subcall function 7FE33397: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FE33425
Part of subcall function 7FE33397: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FE33432
Part of subcall function 7FE33397: UnmapViewOfFile.KERNEL32(?), ref: 7FE3344A

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
020a00 . . :#997242831 +*, xrefs: 7FE33E71, 7FE33E86, 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E
C:,, xrefs: 7FE33E88

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
String ID: 020a00 . . :#997242831 +*$C:,$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3630706530-3937138646
Opcode ID: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction ID: e287b5dbb4dcb83f0000e9e9e189b7e46bf931402bad6951306266e8dca3cb8a
Opcode Fuzzy Hash: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction Fuzzy Hash: 5691C07190A349BEDB219F20CC5EBEA7B6CEF41304F40465AE8595F081D6F06F45CBA6

Function 00AD3E47 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262networklibrarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00AD3E3B), ref: 00AD3E47

Part of subcall function 00AD3E5E: GetProcAddress.KERNEL32(00000000,00AD3E52), ref: 00AD3E5F
Part of subcall function 00AD3E5E: GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 00AD3E74
Part of subcall function 00AD3E5E: wsprintfA.USER32 ref: 00AD3E89
Part of subcall function 00AD3E5E: CreateThread.KERNEL32(00000000,00000000,00AD3623,00000000,00000000), ref: 00AD3ED2
Part of subcall function 00AD3E5E: CloseHandle.KERNEL32(?,8CAEFD3D), ref: 00AD3EDB
Part of subcall function 00AD3E5E: WSAStartup.WS2_32(00000101), ref: 00AD3F60

CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00AD3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00AD3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AD3F91
socket.WS2_32(00000002,00000001,00000000), ref: 00AD4022
connect.WS2_32(6F6C6902,00AD3A9B,00000010), ref: 00AD403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 00AD4086
wsprintfA.USER32 ref: 00AD4104

Strings

SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AD3E9E
C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
020a00 . . :#997242831 +*, xrefs: 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$C:\WINDOWS\SYSTEM32\IMM32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
API String ID: 2507355515-3602139811
Opcode ID: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction ID: 4d26e04371ae7356be0087a3f02ca1cb807f32e572a39b7413589c1eb7b95703
Opcode Fuzzy Hash: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction Fuzzy Hash: AC91F372509245BFDB21AF34CC5ABEA7BACEF55300F00461AF84A4E182D6F05F45C7A6

Function 7FE33E47 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262networklibrarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FE33E3B), ref: 7FE33E47

Part of subcall function 7FE33E5E: GetProcAddress.KERNEL32(00000000,7FE33E52), ref: 7FE33E5F
Part of subcall function 7FE33E5E: GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 7FE33E74
Part of subcall function 7FE33E5E: wsprintfA.USER32 ref: 7FE33E89
Part of subcall function 7FE33E5E: CreateThread.KERNEL32(00000000,00000000,7FE33623,00000000,00000000), ref: 7FE33ED2
Part of subcall function 7FE33E5E: CloseHandle.KERNEL32(?,8CAEFD3D), ref: 7FE33EDB
Part of subcall function 7FE33E5E: WSAStartup.WS2_32(00000101), ref: 7FE33F60

CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE33F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE33F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE33F91
socket.WS2_32(00000002,00000001,00000000), ref: 7FE34022
connect.WS2_32(6F6C6902,7FE33A9B,00000010), ref: 7FE3403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE34086
wsprintfA.USER32 ref: 7FE34104

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
020a00 . . :#997242831 +*, xrefs: 7FE34113, 7FE34152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE33E9E

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2507355515-4156410515
Opcode ID: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction ID: 855f5b7b019b07e2a89f946e0bb5f816d22db4f82193620642819dc2dbd1b454
Opcode Fuzzy Hash: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction Fuzzy Hash: 22910671919745BEDB229F30CC5EBEA7BACEF41300F40465AE84A5E081D6F0AF45C7A6

Function 00AD4103 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00AD4022
connect.WS2_32(6F6C6902,00AD3A9B,00000010), ref: 00AD403C
wsprintfA.USER32 ref: 00AD4104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 00AD4132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,00AD6E32,00000099,6F6C6902,6F6C6902,00AD3AE4,00000014,00000000), ref: 00AD413B
Sleep.KERNEL32(00000064,?,?,?,Function_000037AB,6F6C6902,?,?,00000023,00AD6E32,00000099,6F6C6902,6F6C6902,00AD3AE4,00000014,00000000), ref: 00AD41D4
GetTickCount.KERNEL32 ref: 00AD41DD
closesocket.WS2_32(6F6C6902), ref: 00AD4201
SetEvent.KERNEL32(000003D8,?,00000000), ref: 00AD421F
Sleep.KERNEL32(00007530,?,00000000), ref: 00AD4230
ResetEvent.KERNEL32(000003D8,?,00000000), ref: 00AD4243

Strings

C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
020a00 . . :#997242831 +*, xrefs: 00AD4103, 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$C:\WINDOWS\SYSTEM32\IMM32.DLL
API String ID: 2506426657-2921996410
Opcode ID: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction ID: 3210b0315255ceb2088307f16aeacc17951357c811bda3fc8dc437aa4a9a8305
Opcode Fuzzy Hash: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction Fuzzy Hash: B061E471504249BBEF359F34C91ABEE7B6CAF55300F04060AF85A5E281D2F09F45C79A

Function 7FE34103 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 7FE34022
connect.WS2_32(6F6C6902,7FE33A9B,00000010), ref: 7FE3403C
wsprintfA.USER32 ref: 7FE34104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 7FE34132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,7FE36E32,00000099,6F6C6902,6F6C6902,7FE33AE4,00000014,00000000), ref: 7FE3413B
Sleep.KERNEL32(00000064,?,?,?,Function_000037AB,6F6C6902,?,?,00000023,7FE36E32,00000099,6F6C6902,6F6C6902,7FE33AE4,00000014,00000000), ref: 7FE341D4
GetTickCount.KERNEL32 ref: 7FE341DD
closesocket.WS2_32(6F6C6902), ref: 7FE34201
SetEvent.KERNEL32(00000644,?,00000000), ref: 7FE3421F
Sleep.KERNEL32(00007530,?,00000000), ref: 7FE34230
ResetEvent.KERNEL32(00000644,?,00000000), ref: 7FE34243

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
020a00 . . :#997242831 +*, xrefs: 7FE34103, 7FE34113, 7FE34152

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT
API String ID: 2506426657-2210051122
Opcode ID: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction ID: 76272657368349d062e88a1bc77ba226330b7c07dac0fd75f08f595097f98bff
Opcode Fuzzy Hash: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction Fuzzy Hash: D5610471909349BEEB229F34CC1DBDE7BADEF41304F800649E85A5E081C2F0AB44C7A9

Function 00AD3EF2 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00AD3EE6), ref: 00AD3EF2

Part of subcall function 00AD3F21: LoadLibraryA.KERNEL32(00AD3F15), ref: 00AD3F21
Part of subcall function 00AD3F21: WSAStartup.WS2_32(00000101), ref: 00AD3F60
Part of subcall function 00AD3F21: CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00AD3F7B
Part of subcall function 00AD3F21: CloseHandle.KERNEL32(?,00000000), ref: 00AD3F84
Part of subcall function 00AD3F21: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AD3F91
Part of subcall function 00AD3F21: socket.WS2_32(00000002,00000001,00000000), ref: 00AD4022
Part of subcall function 00AD3F21: connect.WS2_32(6F6C6902,00AD3A9B,00000010), ref: 00AD403C
Part of subcall function 00AD3F21: GetVersionExA.KERNEL32(?,?,00000000), ref: 00AD4086

Strings

C:\WINDOWS\SYSTEM32\IMM32.DLL, xrefs: 00AD4151
020a00 . . :#997242831 +*, xrefs: 00AD4113, 00AD4152

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$C:\WINDOWS\SYSTEM32\IMM32.DLL
API String ID: 3793714048-2921996410
Opcode ID: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction ID: e7326dcdfcfc5d651a254a083b37986d4ca5c0d037ccf80289be79a5826b7f16
Opcode Fuzzy Hash: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction Fuzzy Hash: FA61B171505249BFEB35AF34CC1ABEA7BACEF55300F04060AF85A5E181D6F05F4587AA

Function 7FE33EF2 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FE33EE6), ref: 7FE33EF2

Part of subcall function 7FE33F21: LoadLibraryA.KERNEL32(7FE33F15), ref: 7FE33F21
Part of subcall function 7FE33F21: WSAStartup.WS2_32(00000101), ref: 7FE33F60
Part of subcall function 7FE33F21: CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE33F7B
Part of subcall function 7FE33F21: CloseHandle.KERNEL32(?,00000000), ref: 7FE33F84
Part of subcall function 7FE33F21: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE33F91
Part of subcall function 7FE33F21: socket.WS2_32(00000002,00000001,00000000), ref: 7FE34022
Part of subcall function 7FE33F21: connect.WS2_32(6F6C6902,7FE33A9B,00000010), ref: 7FE3403C
Part of subcall function 7FE33F21: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE34086

Strings

\DEVICE\AFD\ENDPOINT, xrefs: 7FE34151
020a00 . . :#997242831 +*, xrefs: 7FE34113, 7FE34152

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT
API String ID: 3793714048-2210051122
Opcode ID: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction ID: 4e920c301c49f875f50b73b01831a6672dbc736e801ca3cbe81cd66c3204aae9
Opcode Fuzzy Hash: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction Fuzzy Hash: A361D37190A349BEDB219F34CC1EBDA7BACEF41314F400659E8595F081D2F0AB45C7AA

Function 7FE33820 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(7FE374C0), ref: 7FE33831
Sleep.KERNEL32(0000EA60), ref: 7FE338A3
InternetGetConnectedState.WININET(?,00000000), ref: 7FE338BC
gethostbyname.WS2_32(0D278061), ref: 7FE338FE
socket.WS2_32(00000002,00000001,00000000), ref: 7FE33913
ioctlsocket.WS2_32(?,8004667E), ref: 7FE3392C
connect.WS2_32(?,?,00000010), ref: 7FE33945
Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FE33953
closesocket.WS2_32 ref: 7FE339B2

Strings

toexkd.com, xrefs: 7FE33883

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
String ID: toexkd.com
API String ID: 159131500-233167519
Opcode ID: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction ID: deb79b1937d1423498e0a7a80cbe143ebc5a87d424a5e867cfedaf71006b2062
Opcode Fuzzy Hash: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction Fuzzy Hash: 0041BE31A06349FEEB314E248C4DFEABB6EEF86714F404019F94A9E0C0D6F5AB40D664

Function 7FE307A6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 7FE31444: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FE31454
Part of subcall function 7FE31444: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FE31464

CloseHandle.KERNEL32(?), ref: 7FE305AD
FreeLibrary.KERNEL32(75070000,?,7FE30795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE307B2
CloseHandle.KERNEL32(?,?,7FE30795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE307B9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE307C3
Process32First.KERNEL32 ref: 7FE307D6
Process32Next.KERNEL32 ref: 7FE307E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE307FF
CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 7FE3083C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE30857
CloseHandle.KERNEL32 ref: 7FE30866

Strings

csrs, xrefs: 7FE30826

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 3908997113-2321902090
Opcode ID: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction ID: 92ca5db62fc4d460b14863946a251a09930613efaf769028bb5080d10fdb1b25
Opcode Fuzzy Hash: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction Fuzzy Hash: EC116031906204FBEB211F21CD4DBBF3A7DEF40755F40001DFA4A9A091DBB09B01D66A

Function 00AD2762 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 00AD2786

Part of subcall function 00AD27A1: GetTempFileNameA.KERNEL32(?,00AD279D,00000000,?), ref: 00AD27A2
Part of subcall function 00AD27A1: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00AD279D,00000000,?), ref: 00AD27BD
Part of subcall function 00AD27A1: InternetReadFile.WININET(?,?,00000104), ref: 00AD27D7
Part of subcall function 00AD27A1: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00AD279D,00000000,?), ref: 00AD27ED
Part of subcall function 00AD27A1: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00AD279D,00000000,?), ref: 00AD27F9
Part of subcall function 00AD27A1: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00AD279D), ref: 00AD281D
Part of subcall function 00AD27A1: InternetCloseHandle.WININET(?), ref: 00AD282D

InternetCloseHandle.WININET(00000000), ref: 00AD2834

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
String ID:
API String ID: 1995088466-0
Opcode ID: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction ID: b57de49abcbe2e75262144659881376b2e63ac9d2e4ef6441280cad3a97b8607
Opcode Fuzzy Hash: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction Fuzzy Hash: E621AEB1146306BFE7311B20CC8EFEB7A6CEFA1B00F004119FA0989191D7B19E41C6B6

Function 7FE32762 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 7FE32786

Part of subcall function 7FE327A1: GetTempFileNameA.KERNEL32(?,7FE3279D,00000000,?), ref: 7FE327A2
Part of subcall function 7FE327A1: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FE3279D,00000000,?), ref: 7FE327BD
Part of subcall function 7FE327A1: InternetReadFile.WININET(?,?,00000104), ref: 7FE327D7
Part of subcall function 7FE327A1: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FE3279D,00000000,?), ref: 7FE327ED
Part of subcall function 7FE327A1: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FE3279D,00000000,?), ref: 7FE327F9
Part of subcall function 7FE327A1: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FE3279D), ref: 7FE3281D
Part of subcall function 7FE327A1: InternetCloseHandle.WININET(?), ref: 7FE3282D

InternetCloseHandle.WININET(00000000), ref: 7FE32834

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
String ID:
API String ID: 1995088466-0
Opcode ID: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction ID: c98827b822e57f48b5d4a43ef92a54b34b66a7b4a04052ca5de360e27e3fb09a
Opcode Fuzzy Hash: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction Fuzzy Hash: 1621E4B1146306BFE7211B20DC8DFEF7A6CEF91B00F004119FA498D081D7B1AA51C6B6

Function 7FE327A1 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,7FE3279D,00000000,?), ref: 7FE327A2
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FE3279D,00000000,?), ref: 7FE327BD
InternetReadFile.WININET(?,?,00000104), ref: 7FE327D7
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FE3279D,00000000,?), ref: 7FE327ED
CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FE3279D,00000000,?), ref: 7FE327F9
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FE3279D), ref: 7FE3281D
InternetCloseHandle.WININET(?), ref: 7FE3282D
InternetCloseHandle.WININET(00000000), ref: 7FE32834

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
String ID:
API String ID: 3452404049-0
Opcode ID: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction ID: a77174973ad35195ef94212858385f5fa4a2173b876276f6e60842574595c7ec
Opcode Fuzzy Hash: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction Fuzzy Hash: 7F116DB1142606BFEB250B20DC4DFEF7A7DEF85B11F404518FA4A8D081DBB0AA50C6B9

Function 00AD10C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(0371FEC8), ref: 00AD1137
GetProcAddress.KERNEL32(00000000,00AD11D0), ref: 00AD1142

Strings

.DLL, xrefs: 00AD112D

Memory Dump Source

Source File: 00000005.00000002.2369512201.0000000000AD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ad0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction ID: c4c892f3d81becd70c436f6c399543c71994ad8f9dc4728b4453257fc16400ae
Opcode Fuzzy Hash: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction Fuzzy Hash: 7C01B530205206BADB64DF2CC949AEA37B8EF05342F10461AFA1B8B655C7709F80DB95

Function 7FE310C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(039CFF54), ref: 7FE31137
GetProcAddress.KERNEL32(00000000,7FE311D0), ref: 7FE31142

Strings

.DLL, xrefs: 7FE3112D

Memory Dump Source

Source File: 00000005.00000002.2371948554.000000007FE30000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe30000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction ID: a78e103fc99eeb5c5ea1456bc366a5c5cd3c11171152997d3bb8b369502d5a1c
Opcode Fuzzy Hash: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction Fuzzy Hash: 4F01D234D00206EADB568E38CC4DADE37BDEF05366F80451ED81A8F049CA78AB40CF92

Analysis Process: mssecsvc.exePID: 1536, Parent PID: 2504COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	353
Total number of Limit Nodes:	2

Executed Functions

Function 7FE443D2 Relevance: 7.6, APIs: 5, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,65676E61,?,?,7FE4433F,?,7FE44321,?,7FE442FD), ref: 7FE443DD
SetFileAttributesA.KERNELBASE(?,00000000,?,65676E61,?,?,7FE4433F,?,7FE44321,?,7FE442FD), ref: 7FE443F1
CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FE4433F,?,7FE44321,?,7FE442FD), ref: 7FE44426
CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FE4449E
MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FE444D3

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$MappingView
String ID:
API String ID: 1961427682-0
Opcode ID: 84c08d243356dc0fc919d1563c1c0c01b0b950833543c4e03403cfd72bfabd16
Instruction ID: 2b4a20b50233f56e7f54b5ec202d99873a4131f26e0425720c375215398a4466
Opcode Fuzzy Hash: 84c08d243356dc0fc919d1563c1c0c01b0b950833543c4e03403cfd72bfabd16
Instruction Fuzzy Hash: A821257030530ABAEB268E609C45BFA366DAF01309F10522DFD1B9E094E7F56F059724

Function 00A7978C Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2368320753.0000000000A79000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.2367044654.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367106897.0000000000401000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367191422.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367251245.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367251245.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367401562.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367554645.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000010.00000002.2367554645.0000000000A73000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a5208f5583e3e8a4c206ae09a1fa44213f94f53e0937a0e400661ffe3e79a0
Instruction ID: 2690efa9ad7035e50de8b6dfc28f8e1c0f8c5438f21500557be6f5db97a0216b
Opcode Fuzzy Hash: 55a5208f5583e3e8a4c206ae09a1fa44213f94f53e0937a0e400661ffe3e79a0
Instruction Fuzzy Hash: FF115C334255004ACA28BF789F029AF77A0FB55732F41C61EF65C460C2DA215A02A657

Non-executed Functions

Function 7FE4042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 287
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 7FE404BE
GetVersion.KERNEL32 ref: 7FE40500
VirtualAlloc.KERNEL32(00000000,000076FC,08001000,00000040), ref: 7FE40528
CloseHandle.KERNEL32(?), ref: 7FE405AD

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE40708
\BaseNamedObjects\yietVt, xrefs: 7FE40709, 7FE40726, 7FE40734
csrs, xrefs: 7FE40826

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$AllocCloseModuleVersionVirtual
String ID: \BaseNamedObjects\yietVt$\BaseNamedObjects\yietVt$csrs
API String ID: 3017432202-3480717028
Opcode ID: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction ID: 362143324f21d03dcc94089ff1d624cf613d2d90f0004315fb29ef9caf22fe9f
Opcode Fuzzy Hash: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction Fuzzy Hash: 6AB19931515309FFEB229F60E809BEA3BA9EF45715F001029FA0A9E181C7F4AB45CB59

Function 7FE405F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 192
stringnativeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?), ref: 7FE405AD
GetModuleHandleA.KERNEL32(7FE405EC), ref: 7FE405F2
lstrcpyW.KERNEL32(\BaseNamedObjects\yietVt,\BaseNamedObjects\yietVt,?,?,?,?), ref: 7FE4070A
lstrcpyW.KERNEL32(\BaseNamedObjects\yietVt,?), ref: 7FE40727
lstrcatW.KERNEL32(\BaseNamedObjects\yietVt,\yietVt), ref: 7FE40735
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000076FC,00000000,?,00000002,00000000,00000040), ref: 7FE40765
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FE40780
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE407C3
Process32First.KERNEL32 ref: 7FE407D6
Process32Next.KERNEL32 ref: 7FE407E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE407FF
CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 7FE4083C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE40857
CloseHandle.KERNEL32 ref: 7FE40866

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE40708
\BaseNamedObjects\yietVt, xrefs: 7FE40709, 7FE40726, 7FE40734
csrs, xrefs: 7FE40826

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\yietVt$\BaseNamedObjects\yietVt$csrs
API String ID: 1545766225-3480717028
Opcode ID: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction ID: 36db534829bb5061fb90fc4ac5bc25e96f43eb41dc334ca13729aae84ff50a29
Opcode Fuzzy Hash: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction Fuzzy Hash: F2719B31501209FFEB219F20E849BBE3BAEEF44715F00203CFA0A8E491C7B49B459B59

Function 7FE43372 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FE433DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FE433FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FE43425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FE43432
UnmapViewOfFile.KERNEL32(?), ref: 7FE4344A

Strings

\Device\PhysicalMemory, xrefs: 7FE43372
C:,, xrefs: 7FE433A6

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$\Device\PhysicalMemory
API String ID: 2985292042-1440550476
Opcode ID: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction ID: 37b8a480eff626d8966e0e384e37038eefb87aa263f9e2ec2c6b84ebe477ef9b
Opcode Fuzzy Hash: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction Fuzzy Hash: 5381CB71500208FFEB258F14CC8AEBA37BDEF48704F504518FD1A9B291D6B0AF55ABA4

Function 7FE43397 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FE433DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FE433FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FE43425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FE43432
UnmapViewOfFile.KERNEL32(?), ref: 7FE4344A

Strings

C:,, xrefs: 7FE433A6
ysic, xrefs: 7FE433E2, 7FE433F8

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$ysic
API String ID: 2985292042-2852681185
Opcode ID: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction ID: 23c415a60edbfa44d4f6afccb8dcfb7f71e2dfe861b5eb419fc20837800e6cf9
Opcode Fuzzy Hash: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction Fuzzy Hash: D1118B70140609FBEB248F10DC5AFAB367CEB88704F40451CFA1A9A2D0D7B46F28AA54

Function 7FE424A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\yietVt), ref: 7FE424B4
lstrlenW.KERNEL32(?), ref: 7FE424BB
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FE42510

Strings

\BaseNamedObjects\yietVt, xrefs: 7FE424B2

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\yietVt
API String ID: 2597515329-129974550
Opcode ID: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction ID: 587c32acbca54d9de52ade07bcdb7fa3faa61ab6bcf45fda3aa84f30539435c2
Opcode Fuzzy Hash: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction Fuzzy Hash: 3401A4B07803057AF7305B79CC8BF5A7E68DF81B50F508518F718AE1C4D6B89A0483A9

Function 7FE43BCF Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 7FE43C33
GetProcAddress.KERNEL32(00000000,00000002), ref: 7FE43C66
GetProcAddress.KERNEL32(00000000,7FE43CD3), ref: 7FE43CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE43CF1
GetTickCount.KERNEL32 ref: 7FE43D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE46E32,00000000,00000000,00000000,00000000), ref: 7FE43DF7

Strings

020a00 . . :#997242831 +*, xrefs: 7FE43C32, 7FE43C98, 7FE43CA8, 7FE44113, 7FE44152
ADVAPI32.DLL, xrefs: 7FE43CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3969011833-1880045089
Opcode ID: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction ID: 34791333e5aab885647b90b50ff3a208d0390e59c64b67f01177905806f7ba61
Opcode Fuzzy Hash: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction Fuzzy Hash: BEF1047151A348BEEB229F20DC5ABEA7BACEF41304F00551EFC494E081D6F06F459BA6

Function 7FE43C54 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(7FE43C4C), ref: 7FE43C54
GetProcAddress.KERNEL32(00000000,00000002), ref: 7FE43C66
GetProcAddress.KERNEL32(00000000,7FE43CD3), ref: 7FE43CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE43CF1
GetTickCount.KERNEL32 ref: 7FE43D25

Strings

020a00 . . :#997242831 +*, xrefs: 7FE43CA8, 7FE44113, 7FE44152
ADVAPI32.DLL, xrefs: 7FE43CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2837544101-1880045089
Opcode ID: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction ID: 8c2cc38e7e9a36c1c98af1d38a74e6c05b7cfe9b06f9bb9178c0b9ec4ec16d78
Opcode Fuzzy Hash: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction Fuzzy Hash: 42E1F37151A345BEEB269F30DC5ABEA3BACEF41300F00151EFC498E081D6B06F459BA6

Function 7FE43C82 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(7FE43C77), ref: 7FE43C82
GetSystemDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 7FE43C99

Part of subcall function 7FE43CB1: lstrcat.KERNEL32(020a00 . . :#997242831 +*,7FE43CA4), ref: 7FE43CB2
Part of subcall function 7FE43CB1: GetProcAddress.KERNEL32(00000000,7FE43CD3), ref: 7FE43CDE
Part of subcall function 7FE43CB1: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE43CF1
Part of subcall function 7FE43CB1: GetTickCount.KERNEL32 ref: 7FE43D25
Part of subcall function 7FE43CB1: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE46E32,00000000,00000000,00000000,00000000), ref: 7FE43DF7

Strings

020a00 . . :#997242831 +*, xrefs: 7FE43C98, 7FE43CA8, 7FE44113, 7FE44152
ADVAPI32.DLL, xrefs: 7FE43CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 215653160-1880045089
Opcode ID: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction ID: b4987ca1c97ac9b16166154478c172ac9280aea2705731e29c2cee2fb7922011
Opcode Fuzzy Hash: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction Fuzzy Hash: B4D1E27151A359BEEB269F20DC5ABEA3B6CEF41300F00151EFC4A8E081D6F46F459BA5

Function 7FE43CB1 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(020a00 . . :#997242831 +*,7FE43CA4), ref: 7FE43CB2

Part of subcall function 7FE43CC8: LoadLibraryA.KERNEL32(7FE43CBD), ref: 7FE43CC8
Part of subcall function 7FE43CC8: GetProcAddress.KERNEL32(00000000,7FE43CD3), ref: 7FE43CDE
Part of subcall function 7FE43CC8: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE43CF1
Part of subcall function 7FE43CC8: GetTickCount.KERNEL32 ref: 7FE43D25
Part of subcall function 7FE43CC8: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE46E32,00000000,00000000,00000000,00000000), ref: 7FE43DF7

Strings

020a00 . . :#997242831 +*, xrefs: 7FE43CB1, 7FE44113, 7FE44152
ADVAPI32.DLL, xrefs: 7FE43CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2038497427-1880045089
Opcode ID: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction ID: 3f95d80088da1bf58606829bf204db78a9750a4786f28291fd468e16f09491fc
Opcode Fuzzy Hash: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction Fuzzy Hash: 36D1D27151A359BEDB269F20DC5ABEA3B6CEF41300F00151EFC498E081D6F46F459BA9

Function 7FE43CC8 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(7FE43CBD), ref: 7FE43CC8

Part of subcall function 7FE43CDD: GetProcAddress.KERNEL32(00000000,7FE43CD3), ref: 7FE43CDE
Part of subcall function 7FE43CDD: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE43CF1
Part of subcall function 7FE43CDD: GetTickCount.KERNEL32 ref: 7FE43D25
Part of subcall function 7FE43CDD: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE46E32,00000000,00000000,00000000,00000000), ref: 7FE43DF7

Strings

020a00 . . :#997242831 +*, xrefs: 7FE44113, 7FE44152
ADVAPI32.DLL, xrefs: 7FE43CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3734769084-1880045089
Opcode ID: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction ID: 6cd6cc149720acb04f8105a5586c406a145f82a753b0e056002a9cfea268715d
Opcode Fuzzy Hash: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction Fuzzy Hash: 10C1D47151A345BEDB269F20DC5ABEA7BACEF41300F00151EFC4A8E081D6F46F459BA9

Function 7FE43F21 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
networkthreadlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(7FE43F15), ref: 7FE43F21
WSAStartup.WS2_32(00000101), ref: 7FE43F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE43F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE43F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE43F91
lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FE43FE2
gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FE43FF1
socket.WS2_32(00000002,00000001,00000000), ref: 7FE44022
connect.WS2_32(6F6C6902,7FE43A9B,00000010), ref: 7FE4403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE44086
wsprintfA.USER32 ref: 7FE44104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 7FE44132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,7FE46E32,00000099,6F6C6902,6F6C6902,7FE43AE4,00000014,00000000), ref: 7FE4413B
RtlExitUserThread.NTDLL(00000000), ref: 7FE4425B

Strings

020a00 . . :#997242831 +*, xrefs: 7FE44113, 7FE44152
ilo.brenz.pl, xrefs: 7FE43FE1, 7FE43FF0
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT$ilo.brenz.pl
API String ID: 3947895852-2481640231
Opcode ID: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction ID: 45765451f9d2aa79ebfd81ee21483d3f93162ac6486d4d1eaf848b4972219331
Opcode Fuzzy Hash: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction Fuzzy Hash: 0A81D271609349FEEB229F30D819BEA7BADEF41304F001609FC5A5E191D6F0AB45CB69

Function 7FE43CDD Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371
networklibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,7FE43CD3), ref: 7FE43CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FE43CF1
GetTickCount.KERNEL32 ref: 7FE43D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FE46E32,00000000,00000000,00000000,00000000), ref: 7FE43DF7
CreateThread.KERNEL32(00000000,00000000,7FE43623,00000000,00000000), ref: 7FE43ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 7FE43EDB
WSAStartup.WS2_32(00000101), ref: 7FE43F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE43F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE43F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE43F91
socket.WS2_32(00000002,00000001,00000000), ref: 7FE44022
connect.WS2_32(6F6C6902,7FE43A9B,00000010), ref: 7FE4403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE44086
wsprintfA.USER32 ref: 7FE44104
SetEvent.KERNEL32(00000644,?,00000000), ref: 7FE4421F
Sleep.KERNEL32(00007530,?,00000000), ref: 7FE44230
ResetEvent.KERNEL32(00000644,?,00000000), ref: 7FE44243

Strings

020a00 . . :#997242831 +*, xrefs: 7FE44113, 7FE44152
ADVAPI32.DLL, xrefs: 7FE43CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 927156256-1880045089
Opcode ID: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction ID: d3cb77e7930f2a5d85bb5d088d7c40499dddb3f7c04a354fa9ba254fa8722360
Opcode Fuzzy Hash: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction Fuzzy Hash: FFD1E47151A358BEDB269F20DC5ABEA3BACEF41300F00151EFC498E081D6F46F459BA5

Function 7FE43E5E Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,7FE43E52), ref: 7FE43E5F
GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 7FE43E74
wsprintfA.USER32 ref: 7FE43E89
CreateThread.KERNEL32(00000000,00000000,7FE43623,00000000,00000000), ref: 7FE43ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 7FE43EDB
WSAStartup.WS2_32(00000101), ref: 7FE43F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE43F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE43F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE43F91

Part of subcall function 7FE43397: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FE433DC
Part of subcall function 7FE43397: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FE433FB
Part of subcall function 7FE43397: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FE43425
Part of subcall function 7FE43397: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FE43432
Part of subcall function 7FE43397: UnmapViewOfFile.KERNEL32(?), ref: 7FE4344A

Strings

020a00 . . :#997242831 +*, xrefs: 7FE43E71, 7FE43E86, 7FE44113, 7FE44152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
C:,, xrefs: 7FE43E88
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
String ID: 020a00 . . :#997242831 +*$C:,$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3630706530-3937138646
Opcode ID: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction ID: b496e5684aadc1015c349d78354231b133038d9e79336126b4f1a11543d7919a
Opcode Fuzzy Hash: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction Fuzzy Hash: 8D91B17150A349BEEB219F30DC5ABEA7B6CEF41304F00561AF8595F081D6F06F458BAA

Function 7FE43E47 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262
networklibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(7FE43E3B), ref: 7FE43E47

Part of subcall function 7FE43E5E: GetProcAddress.KERNEL32(00000000,7FE43E52), ref: 7FE43E5F
Part of subcall function 7FE43E5E: GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 7FE43E74
Part of subcall function 7FE43E5E: wsprintfA.USER32 ref: 7FE43E89
Part of subcall function 7FE43E5E: CreateThread.KERNEL32(00000000,00000000,7FE43623,00000000,00000000), ref: 7FE43ED2
Part of subcall function 7FE43E5E: CloseHandle.KERNEL32(?,8CAEFD3D), ref: 7FE43EDB
Part of subcall function 7FE43E5E: WSAStartup.WS2_32(00000101), ref: 7FE43F60

CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE43F7B
CloseHandle.KERNEL32(?,00000000), ref: 7FE43F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE43F91
socket.WS2_32(00000002,00000001,00000000), ref: 7FE44022
connect.WS2_32(6F6C6902,7FE43A9B,00000010), ref: 7FE4403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE44086
wsprintfA.USER32 ref: 7FE44104

Strings

020a00 . . :#997242831 +*, xrefs: 7FE44113, 7FE44152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FE43E9E
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2507355515-4156410515
Opcode ID: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction ID: 1282cdb7a57d0ece0525ed28aa667079966fefc0cfcbbf953286eca4285c7354
Opcode Fuzzy Hash: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction Fuzzy Hash: B991E77151A345BEDB229F30DC5ABEA7B6CEF41304F00551EF85A4E081D6F06B458BAA

Function 7FE44103 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 7FE44022
connect.WS2_32(6F6C6902,7FE43A9B,00000010), ref: 7FE4403C
wsprintfA.USER32 ref: 7FE44104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 7FE44132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,7FE46E32,00000099,6F6C6902,6F6C6902,7FE43AE4,00000014,00000000), ref: 7FE4413B
Sleep.KERNEL32(00000064,?,?,?,Function_000037AB,6F6C6902,?,?,00000023,7FE46E32,00000099,6F6C6902,6F6C6902,7FE43AE4,00000014,00000000), ref: 7FE441D4
GetTickCount.KERNEL32 ref: 7FE441DD
closesocket.WS2_32(6F6C6902), ref: 7FE44201
SetEvent.KERNEL32(00000644,?,00000000), ref: 7FE4421F
Sleep.KERNEL32(00007530,?,00000000), ref: 7FE44230
ResetEvent.KERNEL32(00000644,?,00000000), ref: 7FE44243

Strings

020a00 . . :#997242831 +*, xrefs: 7FE44103, 7FE44113, 7FE44152
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT
API String ID: 2506426657-2210051122
Opcode ID: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction ID: 06ed279b157b96b9d3e989f266a78d68f540145da5e5aa18ea02552df2915a95
Opcode Fuzzy Hash: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction Fuzzy Hash: F461E371609349BAEB269F34D819BEE7BADEF41304F00150DFC5A5E181D6F0AB44CB99

Function 7FE43EF2 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(7FE43EE6), ref: 7FE43EF2

Part of subcall function 7FE43F21: LoadLibraryA.KERNEL32(7FE43F15), ref: 7FE43F21
Part of subcall function 7FE43F21: WSAStartup.WS2_32(00000101), ref: 7FE43F60
Part of subcall function 7FE43F21: CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 7FE43F7B
Part of subcall function 7FE43F21: CloseHandle.KERNEL32(?,00000000), ref: 7FE43F84
Part of subcall function 7FE43F21: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FE43F91
Part of subcall function 7FE43F21: socket.WS2_32(00000002,00000001,00000000), ref: 7FE44022
Part of subcall function 7FE43F21: connect.WS2_32(6F6C6902,7FE43A9B,00000010), ref: 7FE4403C
Part of subcall function 7FE43F21: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FE44086

Strings

020a00 . . :#997242831 +*, xrefs: 7FE44113, 7FE44152
\DEVICE\AFD\ENDPOINT, xrefs: 7FE44151

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT
API String ID: 3793714048-2210051122
Opcode ID: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction ID: b2522aa503f7a816f7a31dedb7dd5c21d040cf262544476420dae91e985dd7cf
Opcode Fuzzy Hash: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction Fuzzy Hash: 6D61D57150A345BEEB215F34DC1ABEA7BACEF41314F001619F8595F081D6F06B458BAA

Function 7FE43820 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(7FE474C0), ref: 7FE43831
Sleep.KERNEL32(0000EA60), ref: 7FE438A3
InternetGetConnectedState.WININET(?,00000000), ref: 7FE438BC
gethostbyname.WS2_32(0D278061), ref: 7FE438FE
socket.WS2_32(00000002,00000001,00000000), ref: 7FE43913
ioctlsocket.WS2_32(?,8004667E), ref: 7FE4392C
connect.WS2_32(?,?,00000010), ref: 7FE43945
Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FE43953
closesocket.WS2_32 ref: 7FE439B2

Strings

toexkd.com, xrefs: 7FE43883

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
String ID: toexkd.com
API String ID: 159131500-233167519
Opcode ID: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction ID: f945e06239b55d7f4b4a8428cefa29c9362f4d4b515cc77c946582e731e720d7
Opcode Fuzzy Hash: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction Fuzzy Hash: 7541D131605349BEEB215E20AC4DBEABB6EFF89754F00501DF95ADE0C0D6F59B40A628

Function 7FE407A6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 7FE41444: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FE41454
Part of subcall function 7FE41444: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FE41464

CloseHandle.KERNEL32(?), ref: 7FE405AD
FreeLibrary.KERNEL32(75070000,?,7FE40795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE407B2
CloseHandle.KERNEL32(?,?,7FE40795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE407B9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE407C3
Process32First.KERNEL32 ref: 7FE407D6
Process32Next.KERNEL32 ref: 7FE407E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE407FF
CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 7FE4083C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 7FE40857
CloseHandle.KERNEL32 ref: 7FE40866

Strings

csrs, xrefs: 7FE40826

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 3908997113-2321902090
Opcode ID: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction ID: b5172aac4e6e61db880b5a56548a9fb8e8607609d5ab63128151cd81f22da427
Opcode Fuzzy Hash: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction Fuzzy Hash: F5118231106304FBEB212F21DD49BBF3A6DEF44751F00102DFA4A9A091DBB49B0196AA

Function 7FE42762 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 7FE42786

Part of subcall function 7FE427A1: GetTempFileNameA.KERNEL32(?,7FE4279D,00000000,?), ref: 7FE427A2
Part of subcall function 7FE427A1: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FE4279D,00000000,?), ref: 7FE427BD
Part of subcall function 7FE427A1: InternetReadFile.WININET(?,?,00000104), ref: 7FE427D7
Part of subcall function 7FE427A1: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FE4279D,00000000,?), ref: 7FE427ED
Part of subcall function 7FE427A1: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FE4279D,00000000,?), ref: 7FE427F9
Part of subcall function 7FE427A1: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FE4279D), ref: 7FE4281D
Part of subcall function 7FE427A1: InternetCloseHandle.WININET(?), ref: 7FE4282D

InternetCloseHandle.WININET(00000000), ref: 7FE42834

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
String ID:
API String ID: 1995088466-0
Opcode ID: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction ID: c7209044cc28c9bac3961458f608d1462eb56ad0fef50d8b4581cc80125cbe19
Opcode Fuzzy Hash: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction Fuzzy Hash: AE21D2B1146306BFE7211B20DC8DFFF7A6CEF95B00F004119FA0989081D7B1AA4186BA

Function 7FE427A1 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,7FE4279D,00000000,?), ref: 7FE427A2
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FE4279D,00000000,?), ref: 7FE427BD
InternetReadFile.WININET(?,?,00000104), ref: 7FE427D7
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FE4279D,00000000,?), ref: 7FE427ED
CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FE4279D,00000000,?), ref: 7FE427F9
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FE4279D), ref: 7FE4281D
InternetCloseHandle.WININET(?), ref: 7FE4282D
InternetCloseHandle.WININET(00000000), ref: 7FE42834

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
String ID:
API String ID: 3452404049-0
Opcode ID: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction ID: 967edc6c3228d8dc80771701bd1f44234d191827375817d138cb09e09eb8a148
Opcode Fuzzy Hash: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction Fuzzy Hash: 611161B1142606BFEB250B20DC4DFFF7A7DEF85B11F004518FA068D081D7B46A5086B9

Function 7FE410C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(039CFF54), ref: 7FE41137
GetProcAddress.KERNEL32(00000000,7FE411D0), ref: 7FE41142

Strings

.DLL, xrefs: 7FE4112D

Memory Dump Source

Source File: 00000010.00000002.2370403769.000000007FE40000.00000040.80000000.00040000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7fe40000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction ID: f43a311243e44b3550b7c25c1157359c57101c0d9cf16b19304a3b9cc7bbc5cd
Opcode Fuzzy Hash: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction Fuzzy Hash: 1B010834100205AADF578F28E845AFE37B9EB05266F10211EF41A8B645C6789B40CF95

Analysis Process: mssecsvc.exePID: 6572, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	345
Total number of Limit Nodes:	1

Executed Functions

Function 00BF042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 287
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00BF04BE
GetVersion.KERNEL32 ref: 00BF0500
VirtualAlloc.KERNEL32(00000000,000076FC,08001000,00000040), ref: 00BF0528
CloseHandle.KERNELBASE(?), ref: 00BF05AD

Strings

\BaseNamedObjects\yietVt, xrefs: 00BF0709, 00BF0726, 00BF0734
\BaseNamedObjects\yietVt, xrefs: 00BF0708
csrs, xrefs: 00BF0826

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$AllocCloseModuleVersionVirtual
String ID: \BaseNamedObjects\yietVt$\BaseNamedObjects\yietVt$csrs
API String ID: 3017432202-3480717028
Opcode ID: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction ID: 01aba0653bd74cec3c1ab731f1e5c0cd6d8e5d1c941fc67e4f52de5c6d6898bd
Opcode Fuzzy Hash: 9e52509f19518ea33461c38642fb0176f60e4b6bf5e6ae2128eb7483cd3a28e5
Instruction Fuzzy Hash: 1FB18C71525249FFEB21AF20C849BAA3BE8EF45311F004069EE099F1A2D7F09F49DB55

Function 00BF05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 192
stringnativeprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 00BF05AD
GetModuleHandleA.KERNEL32(00BF05EC), ref: 00BF05F2
lstrcpyW.KERNEL32(\BaseNamedObjects\yietVt,\BaseNamedObjects\yietVt,?,?,?,?), ref: 00BF070A
lstrcpyW.KERNEL32(\BaseNamedObjects\yietVt,?), ref: 00BF0727
lstrcatW.KERNEL32(\BaseNamedObjects\yietVt,\yietVt), ref: 00BF0735
NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000076FC,00000000,?,00000002,00000000,00000040), ref: 00BF0765
NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00BF0780
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF07C3
Process32First.KERNEL32 ref: 00BF07D6
Process32Next.KERNEL32 ref: 00BF07E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF07FF
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 00BF083C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF0857
CloseHandle.KERNEL32 ref: 00BF0866

Strings

\BaseNamedObjects\yietVt, xrefs: 00BF0709, 00BF0726, 00BF0734
\BaseNamedObjects\yietVt, xrefs: 00BF0708
csrs, xrefs: 00BF0826

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
String ID: \BaseNamedObjects\yietVt$\BaseNamedObjects\yietVt$csrs
API String ID: 1545766225-3480717028
Opcode ID: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction ID: b8e6cd7ea591cdcb5a82f6fcdedd6c1d5b6b0192a329e17bea99af0cb352b994
Opcode Fuzzy Hash: 3efdda5cb34b8549ff192c0c77a2c1be46cedb893c6e90d2a818372e31aeead3
Instruction Fuzzy Hash: 4B718C31511209FFEB216F10C889ABE3BADEF54711F0400A9FE099F1A2D7B19F499B59

Function 00BF1169 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 326
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00BF115C,00BF0790,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF1169

Part of subcall function 00BF1190: GetProcAddress.KERNEL32(00000000,00BF117A), ref: 00BF1191

Strings

\yietVt, xrefs: 00BF11C0

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: \yietVt
API String ID: 2574300362-631217602
Opcode ID: ddceb8ed017c91943d9a448d444f19c06bcc501119d2ca4c973b0aca51092c02
Instruction ID: 96ca634e04085753114363e3212aa535bfd8ffe8b2dd1fadfeef5214c47701ce
Opcode Fuzzy Hash: ddceb8ed017c91943d9a448d444f19c06bcc501119d2ca4c973b0aca51092c02
Instruction Fuzzy Hash: 44A18A6591829BEBCB22DA7D88894F9BFE1EB333647484DD9D240DF443D222990FC790

Function 00BF2529 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtOpenSection.NTDLL(?,0000000E), ref: 00BF2558

Strings

\BaseNamedObjects\yietVt, xrefs: 00BF2545

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: OpenSection
String ID: \BaseNamedObjects\yietVt
API String ID: 1950954290-129974550
Opcode ID: c6b8e9e32f6dcba079ef7aea98ec054ed3ce8beadf41c2fd00718ee6712a4e74
Instruction ID: b3aacc91b347d59d7f115e11f4200a74d00a3252589c1a9605fbc5584bb4d301
Opcode Fuzzy Hash: c6b8e9e32f6dcba079ef7aea98ec054ed3ce8beadf41c2fd00718ee6712a4e74
Instruction Fuzzy Hash: C2E0D8F17401063EFB185719CC07FF7218DDB80601F048508F914DA080E5F4DF1182B8

Function 00BF256E Relevance: 3.1, APIs: 2, Instructions: 66
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF2529: NtOpenSection.NTDLL(?,0000000E), ref: 00BF2558

NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B6FC,00000000,?,00000002,00100000,00000040), ref: 00BF259E
CloseHandle.KERNELBASE(00000000,0000B6FC,00000000,?,00000002,00100000,00000040,00000000,0000B6FC,00000000,?,00BF080F), ref: 00BF25A6

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Section$CloseHandleOpenView
String ID:
API String ID: 2731707328-0
Opcode ID: 021b1acb1bf40c706123403cc397f8585b61a767fc7f0a33a1c3ace3a91a31f2
Instruction ID: 3f44de2789c11ec390aba75d2343c1db3a76a473d6fbba080d8c7414b2dd25c5
Opcode Fuzzy Hash: 021b1acb1bf40c706123403cc397f8585b61a767fc7f0a33a1c3ace3a91a31f2
Instruction Fuzzy Hash: 5C21307030050ABADB24DF25CC66BB973A9EF50740F000198FB198F2D4DBB1AF598B54

Function 00BF141C Relevance: 3.0, APIs: 2, Instructions: 38
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?,00000001,00000000,00000000,00000002), ref: 00BF1454
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000,?,00000001,00000000,00000000,00000002), ref: 00BF1464

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 7157bc59c0e3de482e8bd6b2610b223013a43f583be5db88b94377e31208a128
Instruction ID: 01f7e7575b44af39e84b9ee94f66a89c6d22cfdb503e39dbcfd023e7ab42d64d
Opcode Fuzzy Hash: 7157bc59c0e3de482e8bd6b2610b223013a43f583be5db88b94377e31208a128
Instruction Fuzzy Hash: 9FF08236542520BBD6206F56CC8EED77E28EF533A0F144956F4484E156C2A28BA5D3E4

Function 00BF2471 Relevance: 3.0, APIs: 2, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00BF2495
NtWriteVirtualMemory.NTDLL ref: 00BF249E

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$ProtectWrite
String ID:
API String ID: 151266762-0
Opcode ID: 17dce67c487cc0ef90ba526871884689c6391e914ce978ece8a073020b9af88e
Instruction ID: bec36d184e0d76b253c82774af185ce515cf0d17d059aebebe1b98a4915fad90
Opcode Fuzzy Hash: 17dce67c487cc0ef90ba526871884689c6391e914ce978ece8a073020b9af88e
Instruction Fuzzy Hash: 7AE0ECA06502007FF5185B159C5BF7B391DDB41A45F410108FA0A98184F9A15E14467A

Function 00BF1444 Relevance: 3.0, APIs: 2, Instructions: 22
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32(00000000,?,?,00000001,00000000,00000000,00000002), ref: 00BF1454
NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000,?,00000001,00000000,00000000,00000002), ref: 00BF1464

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 98fd101a259c938ae854db39385a2a060802fe35a78288dc9bd6859ea4aae5d1
Instruction ID: 0db5ea05f469a6ff49ad20a45e501a6d4802517c6c4e4fc049ea7a79551dc49b
Opcode Fuzzy Hash: 98fd101a259c938ae854db39385a2a060802fe35a78288dc9bd6859ea4aae5d1
Instruction Fuzzy Hash: 06D05E31603030BBD6302E0A8C0EED73D1DEF537B0F004400F80C8A191C1A28EA1C6F5

Function 00A7302F Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2980597130.0000000000A73000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.2979611009.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2979662708.0000000000401000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2979723193.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2979783876.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2979783876.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2979906966.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2979957411.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2980011475.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000011.00000002.2980161347.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_mssecsvc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4656093ae1c7bbb04d21488f95fe7bddf1a9615c02ec3ad5a29a1aa1a73d1730
Instruction ID: 423065dfefecc7dea162951949b78e36b3c1b093d43354c81d1a365680741e01
Opcode Fuzzy Hash: 4656093ae1c7bbb04d21488f95fe7bddf1a9615c02ec3ad5a29a1aa1a73d1730
Instruction Fuzzy Hash: 28118C737042519BEB119E2CCD81EAE7762EFC4324F10C31AA5085F182CA3296439681

Function 00BF07A6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62
processthreadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1444: LookupPrivilegeValueA.ADVAPI32(00000000,?,?,00000001,00000000,00000000,00000002), ref: 00BF1454
Part of subcall function 00BF1444: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000,?,00000001,00000000,00000000,00000002), ref: 00BF1464

CloseHandle.KERNELBASE(?), ref: 00BF05AD
FreeLibrary.KERNEL32(75070000,?,00BF0795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF07B2
CloseHandle.KERNELBASE(?,?,00BF0795,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF07B9
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,000076FC,00000000,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF07C3
Process32First.KERNEL32 ref: 00BF07D6
Process32Next.KERNEL32 ref: 00BF07E7
OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF07FF
CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BCA,00000002,00000000), ref: 00BF083C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000076FC), ref: 00BF0857
CloseHandle.KERNEL32 ref: 00BF0866

Strings

csrs, xrefs: 00BF0826

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
String ID: csrs
API String ID: 3908997113-2321902090
Opcode ID: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction ID: 2d766dc662f3e415031afddd8625f08544b2be62c1c586dc76c9fc47a744db59
Opcode Fuzzy Hash: d0fb684184325cf97b1a179c9ca4efc16d1a2b2f3f24e28a7afb2982f5ecefec
Instruction Fuzzy Hash: 08119831115208FBEB253F21CD49BBF3AADEF50751F00105DFA499B062DBB09F05965A

Function 00BF05BA Relevance: 1.3, APIs: 1, Instructions: 7
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000000A,00BF0856,?,00000000,00000000,-00003BCA,00000002,00000000,?,00000000), ref: 00BF05C1

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cbe9f769ebb1c608110980d8cf827f438a34bc7706bd5e9152dadd0aa2487085
Instruction ID: bd8a4a21cf57d4045ddb282fd7b8a05e7e59f81700d8a898af258ee242bbd7b8
Opcode Fuzzy Hash: cbe9f769ebb1c608110980d8cf827f438a34bc7706bd5e9152dadd0aa2487085
Instruction Fuzzy Hash: CCB0122825030CD5DA142960448FB241654BF10B11FE000D4F7060E0D107E006041909

Non-executed Functions

Function 00BF3372 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BF33DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BF33FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BF3425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BF3432
UnmapViewOfFile.KERNEL32(?), ref: 00BF344A

Strings

C:,, xrefs: 00BF33A6
\Device\PhysicalMemory, xrefs: 00BF3372

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$\Device\PhysicalMemory
API String ID: 2985292042-1440550476
Opcode ID: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction ID: 3d872a564602d755c77484a67914685165c2b322e46a9d5f3d3ee75d514b7063
Opcode Fuzzy Hash: 88666e3b46497b17619ef40150271629320bc9c847141e1187092b1263c5d190
Instruction Fuzzy Hash: 3F81AC71500208FFEB249F14CC8AEBA37ACEF44B15F504558FE199B291D7B0AF598BA4

Function 00BF3397 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BF33DC
NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BF33FB
MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BF3425
CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BF3432
UnmapViewOfFile.KERNEL32(?), ref: 00BF344A

Strings

C:,, xrefs: 00BF33A6
ysic, xrefs: 00BF33E2, 00BF33F8

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
String ID: C:,$ysic
API String ID: 2985292042-2852681185
Opcode ID: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction ID: 423460ec10922d9c87e12e2a761f71176cf22ed65986e8c032f042d512e8d309
Opcode Fuzzy Hash: e633d6c5ab51ed86d86d53715f6dc8a24a37967d393fbf738cca962c486e9fab
Instruction Fuzzy Hash: C2116D70140609FBEB249F10CC5AFAB36ACEF88B04F544558FB199B290D7B46F288664

Function 00BF24A8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,\BaseNamedObjects\yietVt), ref: 00BF24B4
lstrlenW.KERNEL32(?), ref: 00BF24BB
NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00BF2510

Strings

\BaseNamedObjects\yietVt, xrefs: 00BF24B2

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateSectionlstrcpylstrlen
String ID: \BaseNamedObjects\yietVt
API String ID: 2597515329-129974550
Opcode ID: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction ID: 4e480e46cc5d295efe0c4aa0f28b49e3d6d8f6e015631aa8c9961a07f8bcf732
Opcode Fuzzy Hash: 623229618a505599dd33b9e661a9492f940f1de7310a73129c9794aaeac70742
Instruction Fuzzy Hash: CE01A4B07803057AF7305B79CC8FF5A7A68DF81B50F508558F718AE1C4DAB89A0483A9

Function 00BF3BCF Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 00BF3C33
GetProcAddress.KERNEL32(00000000,00000002), ref: 00BF3C66
GetProcAddress.KERNEL32(00000000,00BF3CD3), ref: 00BF3CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BF3CF1
GetTickCount.KERNEL32 ref: 00BF3D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BF6E32,00000000,00000000,00000000,00000000), ref: 00BF3DF7

Strings

020a00 . . :#997242831 +*, xrefs: 00BF3C32, 00BF3C98, 00BF3CA8, 00BF4113, 00BF4152
ADVAPI32.DLL, xrefs: 00BF3CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3969011833-1880045089
Opcode ID: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction ID: 538afad1baf5ec263dcb1454f5ab3005b07dad66d1e2dc2f7ca960758472897b
Opcode Fuzzy Hash: 641fa007076ed996f10b61fe47295b7606b1f940137153faec4deecef9317252
Instruction Fuzzy Hash: 99F1167151924CBEDB25AF24CC5ABFA7BECEF01700F00459AEA495F082D6F05F4986A6

Function 00BF3C54 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00BF3C4C), ref: 00BF3C54
GetProcAddress.KERNEL32(00000000,00000002), ref: 00BF3C66
GetProcAddress.KERNEL32(00000000,00BF3CD3), ref: 00BF3CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BF3CF1
GetTickCount.KERNEL32 ref: 00BF3D25

Strings

020a00 . . :#997242831 +*, xrefs: 00BF3CA8, 00BF4113, 00BF4152
ADVAPI32.DLL, xrefs: 00BF3CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressProc$CountHandleLibraryLoadModuleTick
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2837544101-1880045089
Opcode ID: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction ID: 47a94a2c8182a239b2a61f30024b3022499d00d70b52de942a64ea090f82d4fd
Opcode Fuzzy Hash: 2f4aa13993f0f468c7ca012f01f3d1d79fdb6f63357e5a53078e4f22ecad62f5
Instruction Fuzzy Hash: 2BE1277151924DBEEB25AF34CC5ABFA7BECEF01700F00059AE9499F082D6F05F4986A5

Function 00BF3C82 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00BF3C77), ref: 00BF3C82
GetSystemDirectoryA.KERNEL32(020a00 . . :#997242831 +*,00000104), ref: 00BF3C99

Part of subcall function 00BF3CB1: lstrcat.KERNEL32(020a00 . . :#997242831 +*,00BF3CA4), ref: 00BF3CB2
Part of subcall function 00BF3CB1: GetProcAddress.KERNEL32(00000000,00BF3CD3), ref: 00BF3CDE
Part of subcall function 00BF3CB1: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BF3CF1
Part of subcall function 00BF3CB1: GetTickCount.KERNEL32 ref: 00BF3D25
Part of subcall function 00BF3CB1: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BF6E32,00000000,00000000,00000000,00000000), ref: 00BF3DF7

Strings

020a00 . . :#997242831 +*, xrefs: 00BF3C98, 00BF3CA8, 00BF4113, 00BF4152
ADVAPI32.DLL, xrefs: 00BF3CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 215653160-1880045089
Opcode ID: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction ID: ce839d2fdc0fa26246e138f1a1e18a7241b45c43ad3a9b417805bfea8d153ebf
Opcode Fuzzy Hash: cff6bdfd01fc09df8e5715957179302f7cc569bb164cb7895778d7b2181f048e
Instruction Fuzzy Hash: 2BD1047151524DBEEB25AF34CC5ABFA3BECEF01700F000599EA499F082D6F45F498AA5

Function 00BF3CB1 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32(020a00 . . :#997242831 +*,00BF3CA4), ref: 00BF3CB2

Part of subcall function 00BF3CC8: LoadLibraryA.KERNEL32(00BF3CBD), ref: 00BF3CC8
Part of subcall function 00BF3CC8: GetProcAddress.KERNEL32(00000000,00BF3CD3), ref: 00BF3CDE
Part of subcall function 00BF3CC8: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BF3CF1
Part of subcall function 00BF3CC8: GetTickCount.KERNEL32 ref: 00BF3D25
Part of subcall function 00BF3CC8: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BF6E32,00000000,00000000,00000000,00000000), ref: 00BF3DF7

Strings

020a00 . . :#997242831 +*, xrefs: 00BF3CB1, 00BF4113, 00BF4152
ADVAPI32.DLL, xrefs: 00BF3CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2038497427-1880045089
Opcode ID: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction ID: e476fb480c94bd445115ed9e5722aed1926d376dc6b95a2016b05cd260c42cc1
Opcode Fuzzy Hash: fe784a5d30081a8608250ab493a61ba96e24a697c9d128d37ca0d94169597329
Instruction Fuzzy Hash: 0DD1037151524DBEEB25AF34CC5ABFA3BECEF01700F000599EA499F082D6F45F498AA5

Function 00BF3CC8 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BF3CBD), ref: 00BF3CC8

Part of subcall function 00BF3CDD: GetProcAddress.KERNEL32(00000000,00BF3CD3), ref: 00BF3CDE
Part of subcall function 00BF3CDD: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BF3CF1
Part of subcall function 00BF3CDD: GetTickCount.KERNEL32 ref: 00BF3D25
Part of subcall function 00BF3CDD: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BF6E32,00000000,00000000,00000000,00000000), ref: 00BF3DF7

Strings

020a00 . . :#997242831 +*, xrefs: 00BF4113, 00BF4152
ADVAPI32.DLL, xrefs: 00BF3CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCountInformationProcTickVolume
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3734769084-1880045089
Opcode ID: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction ID: e99ab563f9408cb2e22bfd9e04a32ca76112121d46dfe1e90c9d7425d10858cc
Opcode Fuzzy Hash: 2fed5560ce7e534775cf0c761ab666ca4e2e35c67c29b2e67a8a697d2de1a857
Instruction Fuzzy Hash: 80C1F37151524DBEEB25AF34CC5ABFA7BECEF01700F000599EA499F082D6F05F498AA5

Function 00BF3F21 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205networkthreadlibraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BF3F15), ref: 00BF3F21
WSAStartup.WS2_32(00000101), ref: 00BF3F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00BF3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00BF3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BF3F91
lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00BF3FE2
gethostbyname.WS2_32(ilo.brenz.pl), ref: 00BF3FF1
socket.WS2_32(00000002,00000001,00000000), ref: 00BF4022
connect.WS2_32(6F6C6902,00BF3A9B,00000010), ref: 00BF403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 00BF4086
wsprintfA.USER32 ref: 00BF4104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 00BF4132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,00BF6E32,00000099,6F6C6902,6F6C6902,00BF3AE4,00000014,00000000), ref: 00BF413B
RtlExitUserThread.NTDLL(00000000), ref: 00BF425B

Strings

020a00 . . :#997242831 +*, xrefs: 00BF4113, 00BF4152
ilo.brenz.pl, xrefs: 00BF3FE1, 00BF3FF0
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT$ilo.brenz.pl
API String ID: 3947895852-2481640231
Opcode ID: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction ID: d61a6da81932d9317f458582f87ff8d4107751efd3920310c46f4d2b42b5c9a4
Opcode Fuzzy Hash: 819da190264878c6b5ce7bf1f9587eecce4c5cbbef942841dd0e8de03adaa998
Instruction Fuzzy Hash: 0181DF71505249BEEB359F24C85ABEA7BECEF41300F040598F9595F091C7F09F498769

Function 00BF3CDD Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371networklibrarythreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00BF3CD3), ref: 00BF3CDE
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BF3CF1
GetTickCount.KERNEL32 ref: 00BF3D25
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BF6E32,00000000,00000000,00000000,00000000), ref: 00BF3DF7
CreateThread.KERNEL32(00000000,00000000,00BF3623,00000000,00000000), ref: 00BF3ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 00BF3EDB
WSAStartup.WS2_32(00000101), ref: 00BF3F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00BF3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00BF3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BF3F91
socket.WS2_32(00000002,00000001,00000000), ref: 00BF4022
connect.WS2_32(6F6C6902,00BF3A9B,00000010), ref: 00BF403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 00BF4086
wsprintfA.USER32 ref: 00BF4104
SetEvent.KERNEL32(00000644,?,00000000), ref: 00BF421F
Sleep.KERNEL32(00007530,?,00000000), ref: 00BF4230
ResetEvent.KERNEL32(00000644,?,00000000), ref: 00BF4243

Strings

020a00 . . :#997242831 +*, xrefs: 00BF4113, 00BF4152
ADVAPI32.DLL, xrefs: 00BF3CF0
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 927156256-1880045089
Opcode ID: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction ID: a2fefe356ae5a491ee84b11b6bcbb4e1c5255509c078a7fe0a0c801841385755
Opcode Fuzzy Hash: 7e61413b3314eb8696fa62f42cb2393cbd1ba069372bff40fe0d2448cd1eb18c
Instruction Fuzzy Hash: 31D1F37151524CBEEB25AF24CC5ABFA3BECEF01700F00059AEA499F082D6F45F4986A5

Function 00BF3E5E Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00BF3E52), ref: 00BF3E5F
GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 00BF3E74
wsprintfA.USER32 ref: 00BF3E89
CreateThread.KERNEL32(00000000,00000000,00BF3623,00000000,00000000), ref: 00BF3ED2
CloseHandle.KERNEL32(?,8CAEFD3D), ref: 00BF3EDB
WSAStartup.WS2_32(00000101), ref: 00BF3F60
CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00BF3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00BF3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BF3F91

Part of subcall function 00BF3397: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BF33DC
Part of subcall function 00BF3397: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BF33FB
Part of subcall function 00BF3397: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BF3425
Part of subcall function 00BF3397: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BF3432
Part of subcall function 00BF3397: UnmapViewOfFile.KERNEL32(?), ref: 00BF344A

Strings

020a00 . . :#997242831 +*, xrefs: 00BF3E71, 00BF3E86, 00BF4113, 00BF4152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151
C:,, xrefs: 00BF3E88

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
String ID: 020a00 . . :#997242831 +*$C:,$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 3630706530-3937138646
Opcode ID: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction ID: 73ca9ca211a9ed23522483ff933cb438bab18fc277aa441dde89ca93d7937a64
Opcode Fuzzy Hash: bcc0a6a729d69826ff998b7f1a17d0c31890b2b6bc4dbb3ed85b4e754293eac6
Instruction Fuzzy Hash: 9B91C171505249BEDB25AF24CC5ABFB7BACEF41300F004659F9495F081D6F06F498BA5

Function 00BF3E47 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262networklibrarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BF3E3B), ref: 00BF3E47

Part of subcall function 00BF3E5E: GetProcAddress.KERNEL32(00000000,00BF3E52), ref: 00BF3E5F
Part of subcall function 00BF3E5E: GetModuleFileNameA.KERNEL32(00000000,020a00 . . :#997242831 +*,000000C8), ref: 00BF3E74
Part of subcall function 00BF3E5E: wsprintfA.USER32 ref: 00BF3E89
Part of subcall function 00BF3E5E: CreateThread.KERNEL32(00000000,00000000,00BF3623,00000000,00000000), ref: 00BF3ED2
Part of subcall function 00BF3E5E: CloseHandle.KERNEL32(?,8CAEFD3D), ref: 00BF3EDB
Part of subcall function 00BF3E5E: WSAStartup.WS2_32(00000101), ref: 00BF3F60

CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00BF3F7B
CloseHandle.KERNEL32(?,00000000), ref: 00BF3F84
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BF3F91
socket.WS2_32(00000002,00000001,00000000), ref: 00BF4022
connect.WS2_32(6F6C6902,00BF3A9B,00000010), ref: 00BF403C
GetVersionExA.KERNEL32(?,?,00000000), ref: 00BF4086
wsprintfA.USER32 ref: 00BF4104

Strings

020a00 . . :#997242831 +*, xrefs: 00BF4113, 00BF4152
SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BF3E9E
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
API String ID: 2507355515-4156410515
Opcode ID: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction ID: 2a8453572c4227a9b01c205ef04eec0dd8c6937664b6fddae06b8d72be373fc7
Opcode Fuzzy Hash: 240653d7d38c95bf206f9e7da4c77085d18b642f4d9280700e54a33fda58d2dc
Instruction Fuzzy Hash: 0091E171119249BEDB21AF24CC5ABFA7BECEF41300F004599E9495F082D6F09F4987A6

Function 00BF4103 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 00BF4022
connect.WS2_32(6F6C6902,00BF3A9B,00000010), ref: 00BF403C
wsprintfA.USER32 ref: 00BF4104
CreateThread.KERNEL32(?,?,Function_000037AB,6F6C6902), ref: 00BF4132
CloseHandle.KERNEL32(?,?,Function_000037AB,6F6C6902,?,?,00000023,00BF6E32,00000099,6F6C6902,6F6C6902,00BF3AE4,00000014,00000000), ref: 00BF413B
Sleep.KERNEL32(00000064,?,?,?,Function_000037AB,6F6C6902,?,?,00000023,00BF6E32,00000099,6F6C6902,6F6C6902,00BF3AE4,00000014,00000000), ref: 00BF41D4
GetTickCount.KERNEL32 ref: 00BF41DD
closesocket.WS2_32(6F6C6902), ref: 00BF4201
SetEvent.KERNEL32(00000644,?,00000000), ref: 00BF421F
Sleep.KERNEL32(00007530,?,00000000), ref: 00BF4230
ResetEvent.KERNEL32(00000644,?,00000000), ref: 00BF4243

Strings

020a00 . . :#997242831 +*, xrefs: 00BF4103, 00BF4113, 00BF4152
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT
API String ID: 2506426657-2210051122
Opcode ID: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction ID: 97788bfc05301819092a070cc7af7b9377c1a4f01de13c09e7c600eb76d8afc9
Opcode Fuzzy Hash: 08f61cf80bf70871499e3b87280a87aff5d7df4c23187df421c79e908f4d7756
Instruction Fuzzy Hash: C361E17110424DBAEB25AF28C85ABAE7FECEF51700F040584EA595F091C3F09F498769

Function 00BF3EF2 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00BF3EE6), ref: 00BF3EF2

Part of subcall function 00BF3F21: LoadLibraryA.KERNEL32(00BF3F15), ref: 00BF3F21
Part of subcall function 00BF3F21: WSAStartup.WS2_32(00000101), ref: 00BF3F60
Part of subcall function 00BF3F21: CreateThread.KERNEL32(00000000,00000000,Function_0000381A,00000000,00000000), ref: 00BF3F7B
Part of subcall function 00BF3F21: CloseHandle.KERNEL32(?,00000000), ref: 00BF3F84
Part of subcall function 00BF3F21: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BF3F91
Part of subcall function 00BF3F21: socket.WS2_32(00000002,00000001,00000000), ref: 00BF4022
Part of subcall function 00BF3F21: connect.WS2_32(6F6C6902,00BF3A9B,00000010), ref: 00BF403C
Part of subcall function 00BF3F21: GetVersionExA.KERNEL32(?,?,00000000), ref: 00BF4086

Strings

020a00 . . :#997242831 +*, xrefs: 00BF4113, 00BF4152
\DEVICE\AFD\ENDPOINT, xrefs: 00BF4151

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
String ID: 020a00 . . :#997242831 +*$\DEVICE\AFD\ENDPOINT
API String ID: 3793714048-2210051122
Opcode ID: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction ID: 0f6e6e3da0028535b384cf30d640769790cc12282cff64087ae8b1528b1b861b
Opcode Fuzzy Hash: 814f2ea0463a0fac8cefa47818189bece0fb35e12e5e25b42336b536121c8728
Instruction Fuzzy Hash: 9E61D371115249BEDB25AF34CC5ABEA7BECEF41300F000699EA595F081D7F05F4987A6

Function 00BF3820 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(00BF74C0), ref: 00BF3831
Sleep.KERNEL32(0000EA60), ref: 00BF38A3
InternetGetConnectedState.WININET(?,00000000), ref: 00BF38BC
gethostbyname.WS2_32(0D278061), ref: 00BF38FE
socket.WS2_32(00000002,00000001,00000000), ref: 00BF3913
ioctlsocket.WS2_32(?,8004667E), ref: 00BF392C
connect.WS2_32(?,?,00000010), ref: 00BF3945
Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00BF3953
closesocket.WS2_32 ref: 00BF39B2

Strings

toexkd.com, xrefs: 00BF3883

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
String ID: toexkd.com
API String ID: 159131500-233167519
Opcode ID: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction ID: a11fc3a5196bce99ab472a5f8dc9bf4d5cf5ad92a3a1ce070f96f124dd506f33
Opcode Fuzzy Hash: 8ccde648c3dd195465448be3fbb53ae26695fc3dcfe3de3b173b270b1aee00e3
Instruction Fuzzy Hash: 7041BF7170524DBAEB315F248C59BAABADEEF85B10F144059FA099F0C1D6F98F488724

Function 00BF2762 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 00BF2786

Part of subcall function 00BF27A1: GetTempFileNameA.KERNEL32(?,00BF279D,00000000,?), ref: 00BF27A2
Part of subcall function 00BF27A1: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00BF279D,00000000,?), ref: 00BF27BD
Part of subcall function 00BF27A1: InternetReadFile.WININET(?,?,00000104), ref: 00BF27D7
Part of subcall function 00BF27A1: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00BF279D,00000000,?), ref: 00BF27ED
Part of subcall function 00BF27A1: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00BF279D,00000000,?), ref: 00BF27F9
Part of subcall function 00BF27A1: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00BF279D), ref: 00BF281D
Part of subcall function 00BF27A1: InternetCloseHandle.WININET(?), ref: 00BF282D

InternetCloseHandle.WININET(00000000), ref: 00BF2834

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
String ID:
API String ID: 1995088466-0
Opcode ID: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction ID: 72e5ba4776290d14940941242e5d4dbaa3b77113737c73df1a838bba5eb6396c
Opcode Fuzzy Hash: 7bc4d0a379e192ec2e33a7f784194f8796b18de7c6074aa6a9c7008997176855
Instruction Fuzzy Hash: 4321D5B114630ABFE7211B20CC8EFFB7A6CEF91B00F004119FA088A091D7B15E5586B6

Function 00BF27A1 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNEL32(?,00BF279D,00000000,?), ref: 00BF27A2
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00BF279D,00000000,?), ref: 00BF27BD
InternetReadFile.WININET(?,?,00000104), ref: 00BF27D7
WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00BF279D,00000000,?), ref: 00BF27ED
CloseHandle.KERNEL32(?,00000104,?,00000000,?,00BF279D,00000000,?), ref: 00BF27F9
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00BF279D), ref: 00BF281D
InternetCloseHandle.WININET(?), ref: 00BF282D
InternetCloseHandle.WININET(00000000), ref: 00BF2834

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
String ID:
API String ID: 3452404049-0
Opcode ID: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction ID: 2600759022edfe5139b28dd00a6417e89b1a8a88911a86fb3dbd40f2b912284d
Opcode Fuzzy Hash: a6daa6137c14de444b7c473bdfe877fc090218d21c0b2d650c6d63247ae0bff6
Instruction Fuzzy Hash: 891161B1141606BBEB251B20CC4DFFF7A6CEF85B11F004518FA0589081D7B45E5096B5

Function 00BF10C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(039CFF54), ref: 00BF1137
GetProcAddress.KERNEL32(00000000,00BF11D0), ref: 00BF1142

Strings

.DLL, xrefs: 00BF112D

Memory Dump Source

Source File: 00000011.00000002.2980950963.0000000000BF0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf0000_mssecsvc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: .DLL
API String ID: 1646373207-899428287
Opcode ID: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction ID: bbf412762f95239cca59b23abfd6a3459b6f3cf0c855253a61396c571e679f71
Opcode Fuzzy Hash: 6d74e3db0ed8297824388177b8ff2c6877fe2d32ccf2c50d01fd0a933dc10288
Instruction Fuzzy Hash: DD01963010020EFADB64DE2CC989AFA37E8EF05342F104D94DB1A9B455CA709F88DB95

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 542CxvZnI5.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Windows Analysis Report
542CxvZnI5.dll