Edit tour

Windows Analysis Report
Gn8CvJE07O.dll

Overview

General Information

Sample name:	Gn8CvJE07O.dll renamed because original name is a hash value
Original sample name:	8c3ac09b90b14e6ab2ecce1bb4e475b0.dll
Analysis ID:	1592037
MD5:	8c3ac09b90b14e6ab2ecce1bb4e475b0
SHA1:	02f971a3e49ac0151b51126b0c2e41f556e65c32
SHA256:	da8591758cf7f86fd5bafacb7ce10c2f0b282aa8793227ab0381e13e1273b70f
Tags:	dllexeuser-mentality
Infos:

Detection

Wannacry

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Wannacry ransomware

AI detected suspicious sample

Connects to many different private IPs (likely to spread or exploit)

Connects to many different private IPs via SMB (likely to spread or exploit)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4952 cmdline: loaddll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 1480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5840 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 4144 cmdline: rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6844 cmdline: rundll32.exe C:\Users\user\Desktop\Gn8CvJE07O.dll,PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvr.exe (PID: 5728 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 121CCF162E02BDBEF5B5CD056933F4D3)

rundll32.exe (PID: 5560 cmdline: rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",PlayGame MD5: 889B99C52A60DD49227C5E485A016679)

mssecsvr.exe (PID: 5632 cmdline: C:\WINDOWS\mssecsvr.exe MD5: 121CCF162E02BDBEF5B5CD056933F4D3)

mssecsvr.exe (PID: 6048 cmdline: C:\WINDOWS\mssecsvr.exe -m security MD5: 121CCF162E02BDBEF5B5CD056933F4D3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
WannaCryptor, WannaCry, WannaCrypt		Lazarus Group	http://blog.emsisoft.com/2017/05/12/wcry-ransomware-outbreak/ http://www.independent.co.uk/news/uk/home-news/wannacry-malware-hack-nhs-report-cybercrime-north-korea-uk-ben-wallace-a8022491.html https://baesystemsai.blogspot.de/2017/05/wanacrypt0r-ransomworm.html https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d	https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Gn8CvJE07O.dll	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Gn8CvJE07O.dll	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x45604:$x1: icacls . /grant Everyone:F /T /C /Q 0x353d0:$x3: tasksche.exe 0x455e0:$x3: tasksche.exe 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA 0x45634:$x5: WNcry@2ol7 0x353a8:$x8: C:\%s\qeriuwjhrf 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q 0x3014:$s1: C:\%s\%s 0x12098:$s1: C:\%s\%s 0x1b39c:$s1: C:\%s\%s 0x353bc:$s1: C:\%s\%s 0x45534:$s3: cmd.exe /c "%s" 0x77a88:$s4: msg/m_portuguese.wnry 0x326f0:$s5: \\192.168.56.20\IPC$ 0x1fae5:$s6: \\172.16.99.5\IPC$ 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x5449:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x38b0a:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x387e4:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x383d0:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
Gn8CvJE07O.dll	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\tasksche.exe	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
C:\Windows\tasksche.exe	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
C:\Windows\tasksche.exe	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2112704011.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.2091006153.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.2099567193.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.2070776364.000000000040F000.00000008.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32600:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32628:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf57c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf5a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x32e44:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32e6c:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Process Memory Space: mssecsvr.exe PID: 5728	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 6048	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Process Memory Space: mssecsvr.exe PID: 5632	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.mssecsvr.exe.1d52084.3.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.22788c8.9.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.0.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.0.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.0.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
9.0.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.2.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
9.2.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.2.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.22aa96c.7.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.22aa96c.7.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.0.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.7100a4.1.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.7100a4.1.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.1d84128.2.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xe8fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xe8d8:$x3: tasksche.exe 0xe8b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xe92c:$x5: WNcry@2ol7 0xe8fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xe82c:$s3: cmd.exe /c "%s" 0x1e02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x1adc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x16c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.1d84128.2.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xe8d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xe900:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.2.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.2.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
9.2.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.22788c8.9.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.22788c8.9.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.22788c8.9.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.0.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.0.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.0.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
9.0.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.0.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.0.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvr.exe.7100a4.1.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvr.exe.7100a4.1.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.2.mssecsvr.exe.7100a4.1.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.1d84128.2.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d84128.2.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.1d84128.2.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.22aa96c.7.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.22aa96c.7.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q 0xf4d8:$x3: tasksche.exe 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA 0xf52c:$x5: WNcry@2ol7 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q 0xf42c:$s3: cmd.exe /c "%s" 0x41980:$s4: msg/m_portuguese.wnry 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.22aa96c.7.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.1d61104.4.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d61104.4.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x32520:$x1: icacls . /grant Everyone:F /T /C /Q 0x222ec:$x3: tasksche.exe 0x324fc:$x3: tasksche.exe 0x324d8:$x4: Global\MsWinZonesCacheCounterMutexA 0x32550:$x5: WNcry@2ol7 0x222c4:$x8: C:\%s\qeriuwjhrf 0x32520:$x9: icacls . /grant Everyone:F /T /C /Q 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x32450:$s3: cmd.exe /c "%s" 0x649a4:$s4: msg/m_portuguese.wnry 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$ 0x25a26:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x25700:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x252ec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.1d61104.4.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.1d61104.4.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x324fc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32524:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.2287948.8.raw.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.2287948.8.raw.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x32520:$x1: icacls . /grant Everyone:F /T /C /Q 0x222ec:$x3: tasksche.exe 0x324fc:$x3: tasksche.exe 0x324d8:$x4: Global\MsWinZonesCacheCounterMutexA 0x32550:$x5: WNcry@2ol7 0x222c4:$x8: C:\%s\qeriuwjhrf 0x32520:$x9: icacls . /grant Everyone:F /T /C /Q 0x82b8:$s1: C:\%s\%s 0x222d8:$s1: C:\%s\%s 0x32450:$s3: cmd.exe /c "%s" 0x649a4:$s4: msg/m_portuguese.wnry 0x1f60c:$s5: \\192.168.56.20\IPC$ 0xca01:$s6: \\172.16.99.5\IPC$ 0x25a26:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x25700:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x252ec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.2287948.8.raw.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0xca4c:$s1: __TREEID__PLACEHOLDER__ 0xcae8:$s1: __TREEID__PLACEHOLDER__ 0xd354:$s1: __TREEID__PLACEHOLDER__ 0xe3b9:$s1: __TREEID__PLACEHOLDER__ 0xf420:$s1: __TREEID__PLACEHOLDER__ 0x10488:$s1: __TREEID__PLACEHOLDER__ 0x114f0:$s1: __TREEID__PLACEHOLDER__ 0x12558:$s1: __TREEID__PLACEHOLDER__ 0x135c0:$s1: __TREEID__PLACEHOLDER__ 0x14628:$s1: __TREEID__PLACEHOLDER__ 0x15690:$s1: __TREEID__PLACEHOLDER__ 0x166f8:$s1: __TREEID__PLACEHOLDER__ 0x17760:$s1: __TREEID__PLACEHOLDER__ 0x187c8:$s1: __TREEID__PLACEHOLDER__ 0x19830:$s1: __TREEID__PLACEHOLDER__ 0x1a898:$s1: __TREEID__PLACEHOLDER__ 0x1b900:$s1: __TREEID__PLACEHOLDER__ 0x1bb14:$s1: __TREEID__PLACEHOLDER__ 0x1bb74:$s1: __TREEID__PLACEHOLDER__ 0x1f244:$s1: __TREEID__PLACEHOLDER__ 0x1f2c0:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.2287948.8.raw.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x324fc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x32524:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.2.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.2.mssecsvr.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ...
5.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
5.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
5.0.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
5.0.mssecsvr.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ...
7.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.2.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ...
7.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
7.0.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.0.mssecsvr.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ...
9.0.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
9.0.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
9.0.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.0.mssecsvr.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ...
7.2.mssecsvr.exe.1d52084.3.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d52084.3.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x3136c:$x3: tasksche.exe 0x31344:$x8: C:\%s\qeriuwjhrf 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
7.2.mssecsvr.exe.1d52084.3.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
9.2.mssecsvr.exe.400000.0.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
9.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q 0x3136c:$x3: tasksche.exe 0x4157c:$x3: tasksche.exe 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA 0x415d0:$x5: WNcry@2ol7 0x31344:$x8: C:\%s\qeriuwjhrf 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q 0x17338:$s1: C:\%s\%s 0x31358:$s1: C:\%s\%s 0x414d0:$s3: cmd.exe /c "%s" 0x73a24:$s4: msg/m_portuguese.wnry 0x2e68c:$s5: \\192.168.56.20\IPC$ 0x1ba81:$s6: \\172.16.99.5\IPC$ 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
9.2.mssecsvr.exe.400000.0.unpack	WannaCry_Ransomware_Gen	Detects WannaCry Ransomware	Florian Roth (based on rule by US CERT)	0x1bacc:$s1: __TREEID__PLACEHOLDER__ 0x1bb68:$s1: __TREEID__PLACEHOLDER__ 0x1c3d4:$s1: __TREEID__PLACEHOLDER__ 0x1d439:$s1: __TREEID__PLACEHOLDER__ 0x1e4a0:$s1: __TREEID__PLACEHOLDER__ 0x1f508:$s1: __TREEID__PLACEHOLDER__ 0x20570:$s1: __TREEID__PLACEHOLDER__ 0x215d8:$s1: __TREEID__PLACEHOLDER__ 0x22640:$s1: __TREEID__PLACEHOLDER__ 0x236a8:$s1: __TREEID__PLACEHOLDER__ 0x24710:$s1: __TREEID__PLACEHOLDER__ 0x25778:$s1: __TREEID__PLACEHOLDER__ 0x267e0:$s1: __TREEID__PLACEHOLDER__ 0x27848:$s1: __TREEID__PLACEHOLDER__ 0x288b0:$s1: __TREEID__PLACEHOLDER__ 0x29918:$s1: __TREEID__PLACEHOLDER__ 0x2a980:$s1: __TREEID__PLACEHOLDER__ 0x2ab94:$s1: __TREEID__PLACEHOLDER__ 0x2abf4:$s1: __TREEID__PLACEHOLDER__ 0x2e2c4:$s1: __TREEID__PLACEHOLDER__ 0x2e340:$s1: __TREEID__PLACEHOLDER__
9.2.mssecsvr.exe.400000.0.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
9.2.mssecsvr.exe.400000.0.unpack	Win32_Ransomware_WannaCry	unknown	ReversingLabs	0x340ba:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ... 0x8090:$start_service_3: 83 EC 10 68 04 01 00 00 68 60 F7 70 00 6A 00 FF 15 6C A0 40 00 FF 15 2C A1 40 00 83 38 02 7D 09 E8 6B FE FF FF 83 C4 10 C3 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 10 A0 40 00 8B F8 85 FF 74 32 53 ... 0x9a16:$entrypoint_all: 55 8B EC 6A FF 68 A0 A1 40 00 68 A2 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C0 A0 40 00 59 83 0D 94 F8 70 00 FF 83 0D 98 F8 70 ...
7.2.mssecsvr.exe.1d5d0a4.5.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d5d0a4.5.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x36580:$x1: icacls . /grant Everyone:F /T /C /Q 0x2634c:$x3: tasksche.exe 0x3655c:$x3: tasksche.exe 0x36538:$x4: Global\MsWinZonesCacheCounterMutexA 0x365b0:$x5: WNcry@2ol7 0x26324:$x8: C:\%s\qeriuwjhrf 0x36580:$x9: icacls . /grant Everyone:F /T /C /Q 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x364b0:$s3: cmd.exe /c "%s" 0x68a04:$s4: msg/m_portuguese.wnry 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$ 0x29a86:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x29760:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x2934c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.1d5d0a4.5.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x3655c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x36584:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.2287948.8.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.2287948.8.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2dd20:$x1: icacls . /grant Everyone:F /T /C /Q 0x1daec:$x3: tasksche.exe 0x2dcfc:$x3: tasksche.exe 0x2dcd8:$x4: Global\MsWinZonesCacheCounterMutexA 0x2dd50:$x5: WNcry@2ol7 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x2dd20:$x9: icacls . /grant Everyone:F /T /C /Q 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x2dc50:$s3: cmd.exe /c "%s" 0x601a4:$s4: msg/m_portuguese.wnry 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$ 0x21226:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x20f00:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x20aec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.2287948.8.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x2dcfc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x2dd24:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.1d61104.4.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.1d61104.4.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x2dd20:$x1: icacls . /grant Everyone:F /T /C /Q 0x1daec:$x3: tasksche.exe 0x2dcfc:$x3: tasksche.exe 0x2dcd8:$x4: Global\MsWinZonesCacheCounterMutexA 0x2dd50:$x5: WNcry@2ol7 0x1dac4:$x8: C:\%s\qeriuwjhrf 0x2dd20:$x9: icacls . /grant Everyone:F /T /C /Q 0x76b8:$s1: C:\%s\%s 0x1dad8:$s1: C:\%s\%s 0x2dc50:$s3: cmd.exe /c "%s" 0x601a4:$s4: msg/m_portuguese.wnry 0x1ae0c:$s5: \\192.168.56.20\IPC$ 0xb601:$s6: \\172.16.99.5\IPC$ 0x21226:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x20f00:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x20aec:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.1d61104.4.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x2dcfc:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x2dd24:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
7.2.mssecsvr.exe.22838e8.6.unpack	JoeSecurity_Wannacry	Yara detected Wannacry ransomware	Joe Security
7.2.mssecsvr.exe.22838e8.6.unpack	WannaCry_Ransomware	Detects WannaCry Ransomware	Florian Roth (with the help of binar.ly)	0x36580:$x1: icacls . /grant Everyone:F /T /C /Q 0x2634c:$x3: tasksche.exe 0x3655c:$x3: tasksche.exe 0x36538:$x4: Global\MsWinZonesCacheCounterMutexA 0x365b0:$x5: WNcry@2ol7 0x26324:$x8: C:\%s\qeriuwjhrf 0x36580:$x9: icacls . /grant Everyone:F /T /C /Q 0xc318:$s1: C:\%s\%s 0x26338:$s1: C:\%s\%s 0x364b0:$s3: cmd.exe /c "%s" 0x68a04:$s4: msg/m_portuguese.wnry 0x2366c:$s5: \\192.168.56.20\IPC$ 0x10a61:$s6: \\172.16.99.5\IPC$ 0x29a86:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C 0x29760:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56 0x2934c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
7.2.mssecsvr.exe.22838e8.6.unpack	wanna_cry_ransomware_generic	detects wannacry ransomware on disk and in virtual page	us-cert code analysis team	0x3655c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63 0x36584:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
Click to see the 93 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T17:25:07.281335+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	103.224.212.215	80	TCP
2025-01-15T17:25:08.974759+0100	2803304	3	Unknown Traffic	192.168.2.5	49706	103.224.212.215	80	TCP

ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T17:25:06.342878+0100	2830018	1	A Network Trojan was detected	192.168.2.5	51063	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Gn8CvJE07O.dll

Avira: detected

Antivirus detection for URL or domain

Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f70f	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc03	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f7	Avira URL Cloud: Label: malware
Source: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174ed	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\WINDOWS\qeriuwjhrf (copy)	ReversingLabs: Detection: 93%
Source: C:\Windows\tasksche.exe	ReversingLabs: Detection: 93%

Multi AV Scanner detection for submitted file

Source: Gn8CvJE07O.dll	Virustotal: Detection: 93%			Perma Link
Source: Gn8CvJE07O.dll	ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Windows\tasksche.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Gn8CvJE07O.dll

Joe Sandbox ML: detected

Exploits

Connects to many different private IPs (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Connects to many different private IPs via SMB (likely to spread or exploit)

Source: global traffic	TCP traffic: 192.168.2.39:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.38:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.42:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.41:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.44:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.43:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.46:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.45:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.48:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.47:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.40:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.28:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.27:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.29:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.31:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.30:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.33:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.32:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.35:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.34:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.37:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.36:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.17:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.16:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.19:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.18:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.20:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.22:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.21:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.24:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.23:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.26:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.25:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.97:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.96:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.11:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.99:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.10:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.98:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.13:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.12:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.15:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.14:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.91:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.90:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.93:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.92:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.95:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.94:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.2:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.1:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.8:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.7:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.9:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.4:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.3:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.6:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.5:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.86:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.104:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.85:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.105:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.88:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.102:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.87:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.103:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.108:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.89:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.109:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.106:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.107:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.80:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.82:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.100:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.81:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.101:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.84:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.83:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.75:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.74:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.77:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.113:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.76:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.114:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.79:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.78:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.71:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.111:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.70:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.112:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.73:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.72:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.110:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.64:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.63:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.66:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.65:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.68:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.67:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.69:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.60:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.62:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.61:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.49:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.53:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.52:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.55:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.54:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.57:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.56:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.59:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.58:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.51:445	Jump to behavior
Source: global traffic	TCP traffic: 192.168.2.50:445	Jump to behavior

Source: Gn8CvJE07O.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2830018 - Severity 1 - ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) : 192.168.2.5:51063 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250116-0325-07ad-ad4a-bba6e83174ed HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250116-0325-0823-9d83-9e2f87dfdc03 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736958307.7566444
Source: global traffic	HTTP traffic detected: GET /?subid1=20250116-0325-093d-a7ca-255010b2f70f HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=0a70b268-8399-43f9-ab15-5dcb859153dc

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49706 -> 103.224.212.215:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 103.224.212.215:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.78
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.78
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.78
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.78
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 62.144.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.119
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.119
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.119
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.119
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 38.200.252.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.58
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.58
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.58
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.58
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 130.171.163.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.71
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.71
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.71
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.71
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.1
Source: unknown	TCP traffic detected without corresponding DNS query: 137.94.76.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250116-0325-07ad-ad4a-bba6e83174ed HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /?subid1=20250116-0325-0823-9d83-9e2f87dfdc03 HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comCache-Control: no-cacheCookie: __tad=1736958307.7566444
Source: global traffic	HTTP traffic detected: GET /?subid1=20250116-0325-093d-a7ca-255010b2f70f HTTP/1.1Cache-Control: no-cacheHost: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comConnection: Keep-AliveCookie: parking_session=0a70b268-8399-43f9-ab15-5dcb859153dc

Source: global traffic	DNS traffic detected: DNS query: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: global traffic	DNS traffic detected: DNS query: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

Source: mssecsvr.exe, 00000005.00000002.2105056862.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000003.2081305191.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174
Source: mssecsvr.exe, 00000007.00000002.2742173066.00000000009BB000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000003.2098213067.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc
Source: mssecsvr.exe, 00000009.00000002.2113055371.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000003.2111867249.0000000000B1F000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2113055371.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f7
Source: Gn8CvJE07O.dll	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
Source: mssecsvr.exe, 00000005.00000002.2105056862.0000000000C1E000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000002.2105056862.0000000000C60000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000002.2105056862.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2742173066.000000000099D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2742173066.0000000000977000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2113055371.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
Source: mssecsvr.exe, 00000009.00000002.2113055371.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/%
Source: mssecsvr.exe, 00000009.00000002.2113055371.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/8
Source: mssecsvr.exe, 00000007.00000002.2741475855.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Spam, unwanted Advertisements and Ransom Demands

Yara detected Wannacry ransomware

Source: Yara match	File source: Gn8CvJE07O.dll, type: SAMPLE
Source: Yara match	File source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.22788c8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d84128.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.22aa96c.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d52084.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d5d0a4.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.2287948.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.1d61104.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.mssecsvr.exe.22838e8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2112704011.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2091006153.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2099567193.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2070776364.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 5728, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvr.exe PID: 5632, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\tasksche.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: Gn8CvJE07O.dll, type: SAMPLE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: Gn8CvJE07O.dll, type: SAMPLE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d52084.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22788c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22aa96c.7.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22aa96c.7.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d84128.2.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d84128.2.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22788c8.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22788c8.9.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d84128.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d84128.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22aa96c.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22aa96c.7.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 7.2.mssecsvr.exe.1d52084.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d52084.3.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
Source: 7.2.mssecsvr.exe.1d5d0a4.5.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d5d0a4.5.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.2287948.8.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.2287948.8.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.1d61104.4.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.1d61104.4.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 7.2.mssecsvr.exe.22838e8.6.unpack, type: UNPACKEDPE	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: 7.2.mssecsvr.exe.22838e8.6.unpack, type: UNPACKEDPE	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: 00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior
Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\tasksche.exe	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\WINDOWS\qeriuwjhrf (copy) 243AA13DFB3D28C50AD1F04BC39216DE15816E6646934F99ED86787B7161F765
Source: Joe Sandbox View	Dropped File: C:\Windows\tasksche.exe 243AA13DFB3D28C50AD1F04BC39216DE15816E6646934F99ED86787B7161F765

Source: tasksche.exe.5.dr

Static PE information: No import functions for PE file found

Source: Gn8CvJE07O.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: Gn8CvJE07O.dll, type: SAMPLE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: Gn8CvJE07O.dll, type: SAMPLE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d52084.3.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22788c8.9.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22aa96c.7.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22aa96c.7.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.7100a4.1.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d84128.2.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d84128.2.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22788c8.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22788c8.9.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.7100a4.1.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d84128.2.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d84128.2.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22aa96c.7.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22aa96c.7.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.1d61104.4.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.2287948.8.raw.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 5.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.0.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 7.2.mssecsvr.exe.1d52084.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d52084.3.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 9.2.mssecsvr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 7.2.mssecsvr.exe.1d5d0a4.5.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d5d0a4.5.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.2287948.8.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.2287948.8.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.1d61104.4.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.1d61104.4.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 7.2.mssecsvr.exe.22838e8.6.unpack, type: UNPACKEDPE	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: 7.2.mssecsvr.exe.22838e8.6.unpack, type: UNPACKEDPE	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: 00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
Source: C:\Windows\tasksche.exe, type: DROPPED	Matched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set

Source: tasksche.exe.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: tasksche.exe.5.dr	Static PE information: Section: .rdata ZLIB complexity 1.0007621951219512
Source: tasksche.exe.5.dr	Static PE information: Section: .data ZLIB complexity 1.001953125
Source: tasksche.exe.5.dr	Static PE information: Section: .rsrc ZLIB complexity 1.0007408405172413

Source: Gn8CvJE07O.dll, tasksche.exe.5.dr

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: classification engine

Classification label: mal100.rans.expl.evad.winDLL@18/2@2/100

Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		5_2_00407C40
Source: C:\Windows\mssecsvr.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		7_2_00407C40

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle,

5_2_00407CE0

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\mssecsvr.exe	Code function: 5_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		5_2_00408090
Source: C:\Windows\mssecsvr.exe	Code function: 7_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,		7_2_00408090

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1480:120:WilError_03

Source: Gn8CvJE07O.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Gn8CvJE07O.dll,PlayGame

Source: Gn8CvJE07O.dll	Virustotal: Detection: 93%
Source: Gn8CvJE07O.dll	ReversingLabs: Detection: 92%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Gn8CvJE07O.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: unknown	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe -m security
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\Gn8CvJE07O.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvr.exe C:\WINDOWS\mssecsvr.exe	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: msvcp60.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Gn8CvJE07O.dll

Static file information: File size 5267459 > 1048576

Source: Gn8CvJE07O.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source: tasksche.exe.5.dr

Static PE information: section name: .text entropy: 7.661200759124495

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\rundll32.exe

Executable created and started: C:\WINDOWS\mssecsvr.exe

Jump to behavior

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvr.exe	File created: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvr.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvr.exe

Code function: 5_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

5_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\mssecsvr.exe

Thread delayed: delay time: 86400000

Jump to behavior

Source: C:\Windows\mssecsvr.exe	Dropped PE file which has not been started: C:\WINDOWS\qeriuwjhrf (copy)			Jump to dropped file
Source: C:\Windows\mssecsvr.exe	Dropped PE file which has not been started: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvr.exe TID: 6484	Thread sleep count: 93 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6484	Thread sleep time: -186000s >= -30000s	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5428	Thread sleep count: 127 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 5428	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Windows\mssecsvr.exe TID: 6484	Thread sleep time: -86400000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000			Jump to behavior
Source: C:\Windows\mssecsvr.exe	Thread delayed: delay time: 86400000			Jump to behavior

Source: mssecsvr.exe, 00000005.00000002.2105056862.0000000000C47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx9
Source: mssecsvr.exe, 00000005.00000002.2105056862.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}v
Source: mssecsvr.exe, 00000009.00000002.2113055371.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: mssecsvr.exe, 00000005.00000002.2105056862.0000000000C7C000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2742173066.0000000000977000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000002.2742173066.00000000009BB000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2113055371.0000000000B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mssecsvr.exe, 00000009.00000002.2113055371.0000000000B10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWSz

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Service Execution	4 Windows Service	4 Windows Service	12 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Gn8CvJE07O.dll	93%	Virustotal		Browse
Gn8CvJE07O.dll	92%	ReversingLabs	Win32.Ransomware.WannaCry
Gn8CvJE07O.dll	100%	Avira	TR/AD.DPulsarShellcode.gohtr
Gn8CvJE07O.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\WINDOWS\qeriuwjhrf (copy)	93%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	93%	ReversingLabs	Win32.Ransomware.WannaCry

Source	Detection	Scanner	Label
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f70f	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc03	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f7	100%	Avira URL Cloud	malware
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174ed	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
77026.bodis.com	199.59.243.228	true	false	high
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	103.224.212.215	true	false	high
ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f70f	false	Avira URL Cloud: malware	unknown
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174ed	false	Avira URL Cloud: malware	unknown
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc03	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174	mssecsvr.exe, 00000005.00000002.2105056862.0000000000C6D000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000005.00000003.2081305191.0000000000C86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.comJ	mssecsvr.exe, 00000007.00000002.2741475855.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/8	mssecsvr.exe, 00000009.00000002.2113055371.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	Gn8CvJE07O.dll	false		high
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f7	mssecsvr.exe, 00000009.00000002.2113055371.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000003.2111867249.0000000000B1F000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000009.00000002.2113055371.0000000000AB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc	mssecsvr.exe, 00000007.00000002.2742173066.00000000009BB000.00000004.00000020.00020000.00000000.sdmp, mssecsvr.exe, 00000007.00000003.2098213067.00000000009CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/%	mssecsvr.exe, 00000009.00000002.2113055371.0000000000AEF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
222.71.154.1	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
38.200.252.119	unknown	United States	9009	M247GB	false
18.169.197.90	unknown	United States	3	MIT-GATEWAYSUS	false
167.103.158.41	unknown	Australia	27026	NETWORKMARYLANDUS	false
142.52.100.160	unknown	Canada	852	ASN852CA	false
142.55.51.1	unknown	Canada	5664	SHERIDAN-NETCA	false
138.192.221.107	unknown	United States	21727	HAMLINE-EDUUS	false
97.96.228.22	unknown	United States	33363	BHN-33363US	false
149.18.183.251	unknown	United States	174	COGENT-174US	false
193.174.140.1	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
136.248.250.1	unknown	United States	10255	SINISTERUS	false
184.229.205.1	unknown	United States	10507	SPCSUS	false
184.229.205.2	unknown	United States	10507	SPCSUS	false
96.217.134.2	unknown	United States	7922	COMCAST-7922US	false
96.217.134.1	unknown	United States	7922	COMCAST-7922US	false
222.71.154.196	unknown	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
184.229.205.229	unknown	United States	10507	SPCSUS	false
97.96.228.1	unknown	United States	33363	BHN-33363US	false
142.52.100.1	unknown	Canada	852	ASN852CA	false
149.18.183.2	unknown	United States	174	COGENT-174US	false
149.18.183.1	unknown	United States	174	COGENT-174US	false
157.200.4.162	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
136.248.250.219	unknown	United States	10255	SINISTERUS	false

Private

IP
192.168.2.148
192.168.2.149
192.168.2.146
192.168.2.147
192.168.2.140
192.168.2.141
192.168.2.144
192.168.2.145
192.168.2.142
192.168.2.143
192.168.2.159
192.168.2.157
192.168.2.158
192.168.2.151
192.168.2.152
192.168.2.150
192.168.2.155
192.168.2.156
192.168.2.153
192.168.2.154
192.168.2.126
192.168.2.247
192.168.2.127
192.168.2.248
192.168.2.124
192.168.2.245
192.168.2.125
192.168.2.246
192.168.2.128
192.168.2.249
192.168.2.129
192.168.2.240
192.168.2.122
192.168.2.243
192.168.2.123
192.168.2.244
192.168.2.120
192.168.2.241
192.168.2.121
192.168.2.242
192.168.2.97
192.168.2.137
192.168.2.96
192.168.2.138
192.168.2.99
192.168.2.135
192.168.2.98
192.168.2.136
192.168.2.139
192.168.2.250
192.168.2.130
192.168.2.251
192.168.2.91
192.168.2.90
192.168.2.93
192.168.2.133
192.168.2.254
192.168.2.92
192.168.2.134
192.168.2.95
192.168.2.131
192.168.2.252
192.168.2.94
192.168.2.132
192.168.2.253
192.168.2.104
192.168.2.225
192.168.2.105
192.168.2.226
192.168.2.102
192.168.2.223
192.168.2.103
192.168.2.224
192.168.2.108
192.168.2.229
192.168.2.109
192.168.2.106

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592037
Start date and time:	2025-01-15 17:24:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Gn8CvJE07O.dll renamed because original name is a hash value
Original Sample Name:	8c3ac09b90b14e6ab2ecce1bb4e475b0.dll
Detection:	MAL
Classification:	mal100.rans.expl.evad.winDLL@18/2@2/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 2.17.190.73, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:25:08	API Interceptor	1x Sleep call for process: loaddll32.exe modified
11:25:42	API Interceptor	112x Sleep call for process: mssecsvr.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
77026.bodis.com	zTrDsX9gXl.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	mLm1d1GV4R.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	V01vdyUACe.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	NLWfV87ouS.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	hVgcaX2SV8.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	GUtEaDsc9X.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	D3W41IdtQA.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	F1G5BkUV74.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	04Ct9PoJrL.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
	sLlAsC4I5r.dll	Get hash	malicious	Wannacry	Browse	199.59.243.228
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	zTrDsX9gXl.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	mLm1d1GV4R.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	V01vdyUACe.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	NLWfV87ouS.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	hVgcaX2SV8.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	GUtEaDsc9X.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	D3W41IdtQA.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	F1G5BkUV74.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	04Ct9PoJrL.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215
	sLlAsC4I5r.dll	Get hash	malicious	Wannacry	Browse	103.224.212.215

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	bot.x86.elf	Get hash	malicious	Unknown	Browse	19.84.162.253
	bot.spc.elf	Get hash	malicious	Unknown	Browse	18.171.53.121
	bot.sh4.elf	Get hash	malicious	Unknown	Browse	19.23.38.27
	bot.arm7.elf	Get hash	malicious	Mirai	Browse	18.40.14.7
	bot.ppc.elf	Get hash	malicious	Unknown	Browse	18.118.14.174
	https://www.databreachtoday.com/showOnDemand.php?webinarID=6054&rf=OD_REQUEST;	Get hash	malicious	Unknown	Browse	18.66.123.144
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	18.125.162.51
	http://tweetfeed.live	Get hash	malicious	Unknown	Browse	18.173.205.19
	xd.x86.elf	Get hash	malicious	Mirai	Browse	19.121.31.251
	xd.spc.elf	Get hash	malicious	Mirai	Browse	19.88.242.164
CHINANET-SH-APChinaTelecomGroupCN	2lX8Z3eydC.dll	Get hash	malicious	Wannacry	Browse	167.139.11.44
	bot.x86.elf	Get hash	malicious	Unknown	Browse	101.87.175.147
	bot.spc.elf	Get hash	malicious	Unknown	Browse	202.101.35.137
	bot.m68k.elf	Get hash	malicious	Unknown	Browse	180.152.101.163
	bot.arm.elf	Get hash	malicious	Unknown	Browse	114.87.176.14
	i686.elf	Get hash	malicious	Mirai	Browse	45.124.125.139
	sh4.elf	Get hash	malicious	Mirai	Browse	116.192.8.62
	arm4.elf	Get hash	malicious	Mirai	Browse	45.124.125.117
	mpsl.elf	Get hash	malicious	Mirai	Browse	222.69.32.67
	178.215.238.129-x86-2025-01-15T04_59_51.elf	Get hash	malicious	Mirai	Browse	116.233.80.35
M247GB	bot.m68k.elf	Get hash	malicious	Unknown	Browse	38.202.251.226
	xd.mpsl.elf	Get hash	malicious	Mirai	Browse	172.86.99.140
	mCgW5qofxC.dll	Get hash	malicious	Wannacry	Browse	38.202.131.61
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	185.244.212.106
	80P.exe	Get hash	malicious	I2PRAT	Browse	193.148.16.211
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	Space.i686.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.arm.elf	Get hash	malicious	Mirai	Browse	212.81.47.243
	Space.sh4.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
NETWORKMARYLANDUS	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	167.102.102.180
	xd.ppc.elf	Get hash	malicious	Mirai	Browse	167.103.97.127
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	167.103.1.29
	na.elf	Get hash	malicious	Mirai, Okiru	Browse	167.102.178.208
	na.elf	Get hash	malicious	Unknown	Browse	167.103.233.229
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	167.102.133.99
	mfQABKHhh1.elf	Get hash	malicious	Mirai	Browse	167.103.6.202
	93x9cBa5ox.elf	Get hash	malicious	Mirai, Moobot	Browse	167.102.102.190
	EE9yU8bN9i.elf	Get hash	malicious	Unknown	Browse	167.103.145.233
	http://maryland.gov/	Get hash	malicious	Unknown	Browse	167.102.44.40

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\WINDOWS\qeriuwjhrf (copy)	o11cUvWfBt.dll	Get hash	malicious	Wannacry	Browse
C:\Windows\tasksche.exe	o11cUvWfBt.dll	Get hash	malicious	Wannacry	Browse

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.993423742312612
Encrypted:	true
SSDEEP:	49152:vEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:8PoBhz1aRxcSUDk36SAEdhvm
MD5:	1718AB24CBC39F6119C5E9C04578CE33
SHA1:	CE88507C49E55667A43C5F5FD40CA62D78BE71E1
SHA-256:	243AA13DFB3D28C50AD1F04BC39216DE15816E6646934F99ED86787B7161F765
SHA-512:	7EBBB2B526AE1EDB7A3ECBF65F47955CD88881829CBCCF40C5DB1A0B9FC99823DFA9384188A47FD5CA3B60EB62BE4108E99D53DE6433EE1D8CF52CE2A6FF0EAB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 93%
Joe Sandbox View:	Filename: o11cUvWfBt.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Download File

Process:	C:\Windows\mssecsvr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2061938
Entropy (8bit):	7.993423742312612
Encrypted:	true
SSDEEP:	49152:vEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvm:8PoBhz1aRxcSUDk36SAEdhvm
MD5:	1718AB24CBC39F6119C5E9C04578CE33
SHA1:	CE88507C49E55667A43C5F5FD40CA62D78BE71E1
SHA-256:	243AA13DFB3D28C50AD1F04BC39216DE15816E6646934F99ED86787B7161F765
SHA-512:	7EBBB2B526AE1EDB7A3ECBF65F47955CD88881829CBCCF40C5DB1A0B9FC99823DFA9384188A47FD5CA3B60EB62BE4108E99D53DE6433EE1D8CF52CE2A6FF0EAB
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\tasksche.exe, Author: Joe Security Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 93%
Joe Sandbox View:	Filename: o11cUvWfBt.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&K.WG%.WG%.WG%.^?..LG%.^?...G%.^?..BG%.WG$.G%.^?..0G%.^?..VG%.^?..VG%.^?..VG%.RichWG%.................PE..L......U..........................................@..........................`......................................p...3............ ..(9..............................................................@............................................text.............................. ..`.rdata...P.......R..................@..@.data...(...........................@....rsrc...(9... ...:..................@..@........................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.327258624597166
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Gn8CvJE07O.dll
File size:	5'267'459 bytes
MD5:	8c3ac09b90b14e6ab2ecce1bb4e475b0
SHA1:	02f971a3e49ac0151b51126b0c2e41f556e65c32
SHA256:	da8591758cf7f86fd5bafacb7ce10c2f0b282aa8793227ab0381e13e1273b70f
SHA512:	2c6da241525acb04262e24b8e8930f7292b7a3c926896d9f05d9b17ac272ec5d671f4e1fee16e48f0084837c405bad53aa68f03cde860b58e67269f00eeb1fc3
SSDEEP:	49152:RnxEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:1yPoBhz1aRxcSUDk36SAEdhv
TLSH:	BB363369717CD2FCD105297444ABCA63A3B37C6A16FE6A0F8F4089661D03B59FB90B43
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F262CF584ABh
cmp dword ptr [10003140h], 00000000h
jmp 00007F262CF584C8h
cmp esi, 01h
je 00007F262CF584A7h
cmp esi, 02h
jne 00007F262CF584C4h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F262CF584ABh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F262CF584AEh
push edi
push esi
push ebx
call 00007F262CF583BAh
test eax, eax
jne 00007F262CF584A6h
xor eax, eax
jmp 00007F262CF584F0h
push edi
push esi
push ebx
call 00007F262CF5826Ch
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F262CF584AEh
test eax, eax
jne 00007F262CF584D9h
push edi
push eax
push ebx
call 00007F262CF58396h
test esi, esi
je 00007F262CF584A7h
cmp esi, 03h
jne 00007F262CF584C8h
push edi
push esi
push ebx
call 00007F262CF58385h
test eax, eax
jne 00007F262CF584A5h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F262CF584B3h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F262CF584AAh
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	8de9a2cb31e4c74bd008b871d14bfafc	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	3dd394f95ab218593f2bc8eb65184db4	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	9b27c3f254416f775f5a51102ef8fb84	False	0.016845703125	Matlab v4 mat-file (little endian) C:\%s\%s, numeric, rows 0, columns 0	0.085726967663312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	73051abe1744c090ecb1850e01a3b45b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	620f0b67a91f7f74151bc5be745b7110	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
W	0x4060	0x500000	data	English	United States	0.880279541015625

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T17:25:06.342878+0100	2830018	ETPRO MALWARE Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup)	1	192.168.2.5	51063	1.1.1.1	53	UDP
2025-01-15T17:25:07.281335+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	103.224.212.215	80	TCP
2025-01-15T17:25:08.974759+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49706	103.224.212.215	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 17:25:01.248265982 CET	49674	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:01.248538971 CET	49675	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:01.388860941 CET	49673	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:06.658312082 CET	49704	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:06.663285971 CET	80	49704	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:06.663392067 CET	49704	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:06.663515091 CET	49704	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:06.668385029 CET	80	49704	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:07.280993938 CET	80	49704	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:07.281167030 CET	80	49704	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:07.281335115 CET	49704	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:07.281336069 CET	49704	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:07.287476063 CET	49704	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:07.293076038 CET	80	49704	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:07.622910976 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:07.627806902 CET	80	49705	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:07.627890110 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:07.628016949 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:07.632844925 CET	80	49705	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:08.092154026 CET	80	49705	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:08.092201948 CET	80	49705	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:08.092283964 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.092283964 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.098498106 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.098536968 CET	49705	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.348319054 CET	49706	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:08.353976011 CET	80	49706	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:08.354072094 CET	49706	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:08.354192019 CET	49706	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:08.359452963 CET	80	49706	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:08.974560976 CET	80	49706	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:08.974626064 CET	80	49706	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:08.974759102 CET	49706	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:08.974759102 CET	49706	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:08.978240967 CET	49706	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:08.982441902 CET	49707	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.983052015 CET	80	49706	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:08.987412930 CET	80	49707	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:08.987521887 CET	49707	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.987662077 CET	49707	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:08.992554903 CET	80	49707	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:09.218055010 CET	49708	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:09.223426104 CET	80	49708	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:09.223541975 CET	49708	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:09.223841906 CET	49708	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:09.228708029 CET	80	49708	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:09.453062057 CET	80	49707	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:09.453125000 CET	80	49707	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:09.453340054 CET	49707	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:09.460108042 CET	49707	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:09.460108042 CET	49707	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:09.494812965 CET	49709	445	192.168.2.5	62.144.252.78
Jan 15, 2025 17:25:09.499840975 CET	445	49709	62.144.252.78	192.168.2.5
Jan 15, 2025 17:25:09.499962091 CET	49709	445	192.168.2.5	62.144.252.78
Jan 15, 2025 17:25:09.499999046 CET	49709	445	192.168.2.5	62.144.252.78
Jan 15, 2025 17:25:09.500334978 CET	49710	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.505131006 CET	445	49709	62.144.252.78	192.168.2.5
Jan 15, 2025 17:25:09.505201101 CET	49709	445	192.168.2.5	62.144.252.78
Jan 15, 2025 17:25:09.505459070 CET	445	49710	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:09.505743027 CET	49710	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.505784988 CET	49710	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.508984089 CET	49711	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.511507988 CET	445	49710	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:09.511660099 CET	445	49710	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:09.511734962 CET	49710	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.514761925 CET	445	49711	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:09.515361071 CET	49711	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.515403986 CET	49711	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:09.521040916 CET	445	49711	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:09.864445925 CET	80	49708	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:09.864669085 CET	49708	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:09.866724014 CET	49708	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:09.867794991 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:09.872684956 CET	80	49720	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:09.872764111 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:09.872867107 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:09.877677917 CET	80	49720	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:09.887528896 CET	80	49708	103.224.212.215	192.168.2.5
Jan 15, 2025 17:25:09.887737036 CET	49708	80	192.168.2.5	103.224.212.215
Jan 15, 2025 17:25:10.342937946 CET	80	49720	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:10.342984915 CET	80	49720	199.59.243.228	192.168.2.5
Jan 15, 2025 17:25:10.343028069 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:10.343066931 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:10.349958897 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:10.350007057 CET	49720	80	192.168.2.5	199.59.243.228
Jan 15, 2025 17:25:10.857572079 CET	49675	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:10.857695103 CET	49674	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:10.998194933 CET	49673	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:11.499468088 CET	49735	445	192.168.2.5	38.200.252.119
Jan 15, 2025 17:25:11.504738092 CET	445	49735	38.200.252.119	192.168.2.5
Jan 15, 2025 17:25:11.507730007 CET	49735	445	192.168.2.5	38.200.252.119
Jan 15, 2025 17:25:11.507740974 CET	49735	445	192.168.2.5	38.200.252.119
Jan 15, 2025 17:25:11.508150101 CET	49736	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.513067961 CET	445	49736	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:11.513173103 CET	445	49735	38.200.252.119	192.168.2.5
Jan 15, 2025 17:25:11.513241053 CET	49735	445	192.168.2.5	38.200.252.119
Jan 15, 2025 17:25:11.513343096 CET	49736	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.513343096 CET	49736	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.514427900 CET	49737	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.518318892 CET	445	49736	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:11.519282103 CET	445	49737	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:11.519354105 CET	49736	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.519375086 CET	49737	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.519417048 CET	49737	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:11.524234056 CET	445	49737	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:12.807115078 CET	443	49703	23.1.237.91	192.168.2.5
Jan 15, 2025 17:25:12.807322979 CET	49703	443	192.168.2.5	23.1.237.91
Jan 15, 2025 17:25:13.515423059 CET	49760	445	192.168.2.5	130.171.163.58
Jan 15, 2025 17:25:13.520628929 CET	445	49760	130.171.163.58	192.168.2.5
Jan 15, 2025 17:25:13.520719051 CET	49760	445	192.168.2.5	130.171.163.58
Jan 15, 2025 17:25:13.520761013 CET	49760	445	192.168.2.5	130.171.163.58
Jan 15, 2025 17:25:13.521017075 CET	49761	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.525829077 CET	445	49760	130.171.163.58	192.168.2.5
Jan 15, 2025 17:25:13.525928974 CET	445	49761	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:13.526000977 CET	49760	445	192.168.2.5	130.171.163.58
Jan 15, 2025 17:25:13.526038885 CET	49761	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.526125908 CET	49761	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.527206898 CET	49762	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.531131029 CET	445	49761	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:13.531193972 CET	49761	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.532253981 CET	445	49762	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:13.532335043 CET	49762	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.532380104 CET	49762	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:13.537180901 CET	445	49762	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:15.531944036 CET	49785	445	192.168.2.5	137.94.76.71
Jan 15, 2025 17:25:15.537210941 CET	445	49785	137.94.76.71	192.168.2.5
Jan 15, 2025 17:25:15.537286043 CET	49785	445	192.168.2.5	137.94.76.71
Jan 15, 2025 17:25:15.537339926 CET	49785	445	192.168.2.5	137.94.76.71
Jan 15, 2025 17:25:15.537543058 CET	49786	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.542423010 CET	445	49786	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:15.542562962 CET	49786	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.542601109 CET	49786	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.542659044 CET	445	49785	137.94.76.71	192.168.2.5
Jan 15, 2025 17:25:15.542715073 CET	49785	445	192.168.2.5	137.94.76.71
Jan 15, 2025 17:25:15.544028044 CET	49787	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.547569036 CET	445	49786	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:15.547719955 CET	445	49786	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:15.547774076 CET	49786	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.548850060 CET	445	49787	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:15.548911095 CET	49787	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.548949003 CET	49787	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:15.553991079 CET	445	49787	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:17.546506882 CET	49806	445	192.168.2.5	149.18.183.251
Jan 15, 2025 17:25:17.551399946 CET	445	49806	149.18.183.251	192.168.2.5
Jan 15, 2025 17:25:17.551503897 CET	49806	445	192.168.2.5	149.18.183.251
Jan 15, 2025 17:25:17.551532984 CET	49806	445	192.168.2.5	149.18.183.251
Jan 15, 2025 17:25:17.551706076 CET	49807	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.556529999 CET	445	49807	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:17.556601048 CET	49807	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.556662083 CET	445	49806	149.18.183.251	192.168.2.5
Jan 15, 2025 17:25:17.556667089 CET	49807	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.556720018 CET	49806	445	192.168.2.5	149.18.183.251
Jan 15, 2025 17:25:17.557641983 CET	49808	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.561644077 CET	445	49807	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:17.561816931 CET	49807	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.562540054 CET	445	49808	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:17.562623024 CET	49808	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.562731028 CET	49808	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:17.567537069 CET	445	49808	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:19.561610937 CET	49831	445	192.168.2.5	171.68.51.19
Jan 15, 2025 17:25:19.566489935 CET	445	49831	171.68.51.19	192.168.2.5
Jan 15, 2025 17:25:19.566611052 CET	49831	445	192.168.2.5	171.68.51.19
Jan 15, 2025 17:25:19.566679955 CET	49831	445	192.168.2.5	171.68.51.19
Jan 15, 2025 17:25:19.566850901 CET	49832	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.571701050 CET	445	49831	171.68.51.19	192.168.2.5
Jan 15, 2025 17:25:19.571732044 CET	445	49832	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:19.571787119 CET	49831	445	192.168.2.5	171.68.51.19
Jan 15, 2025 17:25:19.571840048 CET	49832	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.571929932 CET	49832	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.573076963 CET	49833	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.577300072 CET	445	49832	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:19.577378035 CET	49832	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.577871084 CET	445	49833	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:19.577976942 CET	49833	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.578130007 CET	49833	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:19.582969904 CET	445	49833	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:21.577261925 CET	49862	445	192.168.2.5	16.176.209.58
Jan 15, 2025 17:25:21.582226992 CET	445	49862	16.176.209.58	192.168.2.5
Jan 15, 2025 17:25:21.582429886 CET	49862	445	192.168.2.5	16.176.209.58
Jan 15, 2025 17:25:21.582429886 CET	49862	445	192.168.2.5	16.176.209.58
Jan 15, 2025 17:25:21.582571030 CET	49864	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.587407112 CET	445	49864	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:21.587460995 CET	445	49862	16.176.209.58	192.168.2.5
Jan 15, 2025 17:25:21.587486029 CET	49864	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.587511063 CET	49864	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.587651014 CET	49862	445	192.168.2.5	16.176.209.58
Jan 15, 2025 17:25:21.588063002 CET	49865	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.592629910 CET	445	49864	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:21.592695951 CET	49864	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.592940092 CET	445	49865	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:21.593126059 CET	49865	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.593126059 CET	49865	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:21.598067045 CET	445	49865	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:23.593106031 CET	49898	445	192.168.2.5	96.217.134.16
Jan 15, 2025 17:25:23.598001003 CET	445	49898	96.217.134.16	192.168.2.5
Jan 15, 2025 17:25:23.598090887 CET	49898	445	192.168.2.5	96.217.134.16
Jan 15, 2025 17:25:23.598233938 CET	49898	445	192.168.2.5	96.217.134.16
Jan 15, 2025 17:25:23.598371029 CET	49899	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.603127956 CET	445	49898	96.217.134.16	192.168.2.5
Jan 15, 2025 17:25:23.603221893 CET	49898	445	192.168.2.5	96.217.134.16
Jan 15, 2025 17:25:23.603240013 CET	445	49899	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:23.603318930 CET	49899	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.603332043 CET	49899	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.603619099 CET	49900	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.608474016 CET	445	49900	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:23.608584881 CET	49900	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.608584881 CET	49900	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.609004974 CET	445	49899	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:23.609070063 CET	49899	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:23.613454103 CET	445	49900	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:25.608061075 CET	49939	445	192.168.2.5	184.229.205.229
Jan 15, 2025 17:25:25.612921000 CET	445	49939	184.229.205.229	192.168.2.5
Jan 15, 2025 17:25:25.613996029 CET	49939	445	192.168.2.5	184.229.205.229
Jan 15, 2025 17:25:25.614192963 CET	49939	445	192.168.2.5	184.229.205.229
Jan 15, 2025 17:25:25.614348888 CET	49940	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.619183064 CET	445	49939	184.229.205.229	192.168.2.5
Jan 15, 2025 17:25:25.619214058 CET	445	49940	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:25.619308949 CET	49939	445	192.168.2.5	184.229.205.229
Jan 15, 2025 17:25:25.619513035 CET	49940	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.619513035 CET	49940	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.619858027 CET	49941	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.624468088 CET	445	49940	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:25.624756098 CET	445	49941	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:25.624829054 CET	49940	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.625195026 CET	49941	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.625195980 CET	49941	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:25.630060911 CET	445	49941	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:27.623694897 CET	49975	445	192.168.2.5	18.169.197.90
Jan 15, 2025 17:25:27.628516912 CET	445	49975	18.169.197.90	192.168.2.5
Jan 15, 2025 17:25:27.628607988 CET	49975	445	192.168.2.5	18.169.197.90
Jan 15, 2025 17:25:27.628690004 CET	49975	445	192.168.2.5	18.169.197.90
Jan 15, 2025 17:25:27.628818035 CET	49976	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.633652925 CET	445	49976	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:27.633666992 CET	445	49975	18.169.197.90	192.168.2.5
Jan 15, 2025 17:25:27.633722067 CET	49976	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.633749962 CET	49975	445	192.168.2.5	18.169.197.90
Jan 15, 2025 17:25:27.633821011 CET	49976	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.634053946 CET	49977	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.638885021 CET	445	49977	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:27.639074087 CET	445	49976	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:27.639174938 CET	49977	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.639174938 CET	49977	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.641876936 CET	49976	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:27.643965960 CET	445	49977	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:29.639405012 CET	50010	445	192.168.2.5	193.174.140.137
Jan 15, 2025 17:25:29.644304037 CET	445	50010	193.174.140.137	192.168.2.5
Jan 15, 2025 17:25:29.645796061 CET	50010	445	192.168.2.5	193.174.140.137
Jan 15, 2025 17:25:29.645881891 CET	50010	445	192.168.2.5	193.174.140.137
Jan 15, 2025 17:25:29.646034956 CET	50011	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.650816917 CET	445	50011	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:29.650878906 CET	50011	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.650926113 CET	50011	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.650981903 CET	445	50010	193.174.140.137	192.168.2.5
Jan 15, 2025 17:25:29.651209116 CET	50012	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.651227951 CET	50010	445	192.168.2.5	193.174.140.137
Jan 15, 2025 17:25:29.655989885 CET	445	50011	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:29.656054020 CET	445	50012	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:29.656119108 CET	50011	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.656162977 CET	50012	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.656205893 CET	50012	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:29.660964012 CET	445	50012	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:30.896584034 CET	445	49711	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:30.896661043 CET	49711	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:30.896761894 CET	49711	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:30.896919966 CET	49711	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:30.901566982 CET	445	49711	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:30.901710987 CET	445	49711	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:31.655102968 CET	50045	445	192.168.2.5	36.153.240.171
Jan 15, 2025 17:25:31.660022020 CET	445	50045	36.153.240.171	192.168.2.5
Jan 15, 2025 17:25:31.660221100 CET	50045	445	192.168.2.5	36.153.240.171
Jan 15, 2025 17:25:31.660221100 CET	50045	445	192.168.2.5	36.153.240.171
Jan 15, 2025 17:25:31.660561085 CET	50046	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.665257931 CET	445	50045	36.153.240.171	192.168.2.5
Jan 15, 2025 17:25:31.665304899 CET	445	50046	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:31.665352106 CET	50045	445	192.168.2.5	36.153.240.171
Jan 15, 2025 17:25:31.665649891 CET	50046	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.665649891 CET	50046	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.665868044 CET	50047	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.670676947 CET	445	50046	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:31.670701027 CET	445	50047	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:31.670762062 CET	50046	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.670804977 CET	50047	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.673702955 CET	50047	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:31.678452015 CET	445	50047	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:32.897999048 CET	445	49737	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:32.898197889 CET	49737	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:32.898197889 CET	49737	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:32.898401022 CET	49737	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:32.903065920 CET	445	49737	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:32.903139114 CET	445	49737	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:33.670656919 CET	50080	445	192.168.2.5	142.52.100.160
Jan 15, 2025 17:25:33.675621033 CET	445	50080	142.52.100.160	192.168.2.5
Jan 15, 2025 17:25:33.675720930 CET	50080	445	192.168.2.5	142.52.100.160
Jan 15, 2025 17:25:33.675806999 CET	50080	445	192.168.2.5	142.52.100.160
Jan 15, 2025 17:25:33.676014900 CET	50081	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.681070089 CET	445	50081	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:33.681082964 CET	445	50080	142.52.100.160	192.168.2.5
Jan 15, 2025 17:25:33.681150913 CET	50080	445	192.168.2.5	142.52.100.160
Jan 15, 2025 17:25:33.681173086 CET	50081	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.681245089 CET	50081	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.681658983 CET	50082	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.686142921 CET	445	50081	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:33.686217070 CET	50081	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.686741114 CET	445	50082	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:33.686815977 CET	50082	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.686839104 CET	50082	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:33.691735029 CET	445	50082	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:33.904794931 CET	50088	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:33.909828901 CET	445	50088	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:33.909915924 CET	50088	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:33.909964085 CET	50088	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:33.914989948 CET	445	50088	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:34.944904089 CET	445	49762	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:34.945116997 CET	49762	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:34.945116997 CET	49762	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:34.945116997 CET	49762	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:34.950140953 CET	445	49762	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:34.950150013 CET	445	49762	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:35.686323881 CET	50102	445	192.168.2.5	136.248.250.219
Jan 15, 2025 17:25:35.691198111 CET	445	50102	136.248.250.219	192.168.2.5
Jan 15, 2025 17:25:35.691262007 CET	50102	445	192.168.2.5	136.248.250.219
Jan 15, 2025 17:25:35.691351891 CET	50102	445	192.168.2.5	136.248.250.219
Jan 15, 2025 17:25:35.691551924 CET	50103	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.696255922 CET	445	50102	136.248.250.219	192.168.2.5
Jan 15, 2025 17:25:35.696319103 CET	50102	445	192.168.2.5	136.248.250.219
Jan 15, 2025 17:25:35.696381092 CET	445	50103	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:35.696451902 CET	50103	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.696491003 CET	50103	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.696747065 CET	50104	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.701394081 CET	445	50103	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:35.701447964 CET	50103	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.701529980 CET	445	50104	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:35.701592922 CET	50104	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.701627016 CET	50104	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:35.706410885 CET	445	50104	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:35.904892921 CET	50105	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:35.910531998 CET	445	50105	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:35.910617113 CET	50105	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:35.910665989 CET	50105	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:35.916079998 CET	445	50105	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:36.927802086 CET	445	49787	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:36.927958012 CET	49787	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:36.927958012 CET	49787	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:36.927988052 CET	49787	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:36.932782888 CET	445	49787	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:36.932791948 CET	445	49787	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:37.701873064 CET	50117	445	192.168.2.5	187.253.170.44
Jan 15, 2025 17:25:37.706866980 CET	445	50117	187.253.170.44	192.168.2.5
Jan 15, 2025 17:25:37.706947088 CET	50117	445	192.168.2.5	187.253.170.44
Jan 15, 2025 17:25:37.706984997 CET	50117	445	192.168.2.5	187.253.170.44
Jan 15, 2025 17:25:37.707098961 CET	50118	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.711941957 CET	445	50118	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:37.711957932 CET	445	50117	187.253.170.44	192.168.2.5
Jan 15, 2025 17:25:37.712016106 CET	50117	445	192.168.2.5	187.253.170.44
Jan 15, 2025 17:25:37.712085962 CET	50118	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.712085962 CET	50118	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.712253094 CET	50119	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.717030048 CET	445	50119	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:37.717037916 CET	445	50118	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:37.717092991 CET	50119	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.717103004 CET	50118	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.717134953 CET	50119	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:37.721906900 CET	445	50119	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:37.951603889 CET	50124	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:37.956480026 CET	445	50124	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:37.956562042 CET	50124	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:37.956603050 CET	50124	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:37.961359024 CET	445	50124	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:38.960728884 CET	445	49808	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:38.960995913 CET	49808	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:38.961070061 CET	49808	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:38.961146116 CET	49808	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:38.965783119 CET	445	49808	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:38.965863943 CET	445	49808	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:39.717591047 CET	50135	445	192.168.2.5	218.101.231.161
Jan 15, 2025 17:25:39.722486019 CET	445	50135	218.101.231.161	192.168.2.5
Jan 15, 2025 17:25:39.722619057 CET	50135	445	192.168.2.5	218.101.231.161
Jan 15, 2025 17:25:39.722664118 CET	50135	445	192.168.2.5	218.101.231.161
Jan 15, 2025 17:25:39.722738981 CET	50136	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.727477074 CET	445	50135	218.101.231.161	192.168.2.5
Jan 15, 2025 17:25:39.727616072 CET	445	50136	218.101.231.1	192.168.2.5
Jan 15, 2025 17:25:39.727689028 CET	50136	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.727689028 CET	50136	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.727713108 CET	445	50135	218.101.231.161	192.168.2.5
Jan 15, 2025 17:25:39.727793932 CET	50135	445	192.168.2.5	218.101.231.161
Jan 15, 2025 17:25:39.727907896 CET	50137	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.732693911 CET	445	50136	218.101.231.1	192.168.2.5
Jan 15, 2025 17:25:39.732703924 CET	445	50137	218.101.231.1	192.168.2.5
Jan 15, 2025 17:25:39.732748032 CET	50136	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.732764006 CET	50137	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.732764006 CET	50137	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:25:39.737560987 CET	445	50137	218.101.231.1	192.168.2.5
Jan 15, 2025 17:25:39.935982943 CET	50139	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:39.940818071 CET	445	50139	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:39.940892935 CET	50139	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:39.941054106 CET	50139	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:25:39.945887089 CET	445	50139	137.94.76.1	192.168.2.5
Jan 15, 2025 17:25:40.946423054 CET	445	49833	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:40.946542025 CET	49833	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:40.946760893 CET	49833	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:40.947020054 CET	49833	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:40.951692104 CET	445	49833	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:40.951771975 CET	445	49833	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:41.733191013 CET	50150	445	192.168.2.5	116.10.21.233
Jan 15, 2025 17:25:41.738024950 CET	445	50150	116.10.21.233	192.168.2.5
Jan 15, 2025 17:25:41.738109112 CET	50150	445	192.168.2.5	116.10.21.233
Jan 15, 2025 17:25:41.738179922 CET	50150	445	192.168.2.5	116.10.21.233
Jan 15, 2025 17:25:41.738332987 CET	50151	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.743140936 CET	445	50150	116.10.21.233	192.168.2.5
Jan 15, 2025 17:25:41.743155003 CET	445	50151	116.10.21.1	192.168.2.5
Jan 15, 2025 17:25:41.743202925 CET	50150	445	192.168.2.5	116.10.21.233
Jan 15, 2025 17:25:41.743251085 CET	50151	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.743285894 CET	50151	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.743591070 CET	50152	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.748367071 CET	445	50152	116.10.21.1	192.168.2.5
Jan 15, 2025 17:25:41.748450994 CET	50152	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.748450994 CET	50152	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.748673916 CET	445	50151	116.10.21.1	192.168.2.5
Jan 15, 2025 17:25:41.748737097 CET	50151	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:25:41.753264904 CET	445	50152	116.10.21.1	192.168.2.5
Jan 15, 2025 17:25:41.967392921 CET	50156	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:41.972367048 CET	445	50156	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:41.972596884 CET	50156	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:41.972596884 CET	50156	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:25:41.977418900 CET	445	50156	149.18.183.1	192.168.2.5
Jan 15, 2025 17:25:42.974783897 CET	445	49865	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:42.974951982 CET	49865	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:42.975044966 CET	49865	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:42.975044966 CET	49865	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:42.979856014 CET	445	49865	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:42.979866028 CET	445	49865	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:43.748822927 CET	50168	445	192.168.2.5	89.148.186.21
Jan 15, 2025 17:25:43.754973888 CET	445	50168	89.148.186.21	192.168.2.5
Jan 15, 2025 17:25:43.758344889 CET	50168	445	192.168.2.5	89.148.186.21
Jan 15, 2025 17:25:43.760968924 CET	50168	445	192.168.2.5	89.148.186.21
Jan 15, 2025 17:25:43.761001110 CET	50169	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.767098904 CET	445	50169	89.148.186.1	192.168.2.5
Jan 15, 2025 17:25:43.767129898 CET	445	50168	89.148.186.21	192.168.2.5
Jan 15, 2025 17:25:43.767230988 CET	50168	445	192.168.2.5	89.148.186.21
Jan 15, 2025 17:25:43.767246008 CET	50169	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.767271042 CET	50169	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.767537117 CET	50170	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.773675919 CET	445	50170	89.148.186.1	192.168.2.5
Jan 15, 2025 17:25:43.773793936 CET	50170	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.773834944 CET	50170	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.775567055 CET	445	50169	89.148.186.1	192.168.2.5
Jan 15, 2025 17:25:43.778055906 CET	50169	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:25:43.779870033 CET	445	50170	89.148.186.1	192.168.2.5
Jan 15, 2025 17:25:43.951916933 CET	50172	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:43.961131096 CET	445	50172	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:43.962189913 CET	50172	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:43.962307930 CET	50172	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:25:43.967422962 CET	445	50172	171.68.51.1	192.168.2.5
Jan 15, 2025 17:25:44.976511002 CET	445	49900	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:44.976593018 CET	49900	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:44.976632118 CET	49900	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:44.976687908 CET	49900	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:44.982266903 CET	445	49900	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:44.982403040 CET	445	49900	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:45.623693943 CET	50183	445	192.168.2.5	148.208.193.183
Jan 15, 2025 17:25:45.628566027 CET	445	50183	148.208.193.183	192.168.2.5
Jan 15, 2025 17:25:45.628662109 CET	50183	445	192.168.2.5	148.208.193.183
Jan 15, 2025 17:25:45.628662109 CET	50183	445	192.168.2.5	148.208.193.183
Jan 15, 2025 17:25:45.628876925 CET	50184	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.633697987 CET	445	50183	148.208.193.183	192.168.2.5
Jan 15, 2025 17:25:45.633709908 CET	445	50184	148.208.193.1	192.168.2.5
Jan 15, 2025 17:25:45.633770943 CET	50183	445	192.168.2.5	148.208.193.183
Jan 15, 2025 17:25:45.633816957 CET	50184	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.633882046 CET	50184	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.634265900 CET	50185	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.638740063 CET	445	50184	148.208.193.1	192.168.2.5
Jan 15, 2025 17:25:45.638804913 CET	50184	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.639091969 CET	445	50185	148.208.193.1	192.168.2.5
Jan 15, 2025 17:25:45.639336109 CET	50185	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.639355898 CET	50185	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:25:45.644097090 CET	445	50185	148.208.193.1	192.168.2.5
Jan 15, 2025 17:25:45.982870102 CET	50189	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:45.987801075 CET	445	50189	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:45.988033056 CET	50189	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:45.988058090 CET	50189	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:25:45.992882967 CET	445	50189	16.176.209.1	192.168.2.5
Jan 15, 2025 17:25:47.006402016 CET	445	49941	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:47.006503105 CET	49941	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:47.006567001 CET	49941	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:47.006597042 CET	49941	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:47.011382103 CET	445	49941	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:47.011394978 CET	445	49941	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:47.374002934 CET	50198	445	192.168.2.5	222.71.154.196
Jan 15, 2025 17:25:47.378793955 CET	445	50198	222.71.154.196	192.168.2.5
Jan 15, 2025 17:25:47.378876925 CET	50198	445	192.168.2.5	222.71.154.196
Jan 15, 2025 17:25:47.378901005 CET	50198	445	192.168.2.5	222.71.154.196
Jan 15, 2025 17:25:47.379019976 CET	50199	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.383799076 CET	445	50199	222.71.154.1	192.168.2.5
Jan 15, 2025 17:25:47.383848906 CET	445	50198	222.71.154.196	192.168.2.5
Jan 15, 2025 17:25:47.383863926 CET	50199	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.383903980 CET	50199	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.383914948 CET	50198	445	192.168.2.5	222.71.154.196
Jan 15, 2025 17:25:47.384274006 CET	50200	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.389027119 CET	445	50199	222.71.154.1	192.168.2.5
Jan 15, 2025 17:25:47.389044046 CET	445	50200	222.71.154.1	192.168.2.5
Jan 15, 2025 17:25:47.389128923 CET	50199	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.389169931 CET	50200	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.389209032 CET	50200	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:25:47.393982887 CET	445	50200	222.71.154.1	192.168.2.5
Jan 15, 2025 17:25:47.983051062 CET	50204	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:47.987848043 CET	445	50204	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:47.987977982 CET	50204	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:47.987993956 CET	50204	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:25:47.992767096 CET	445	50204	96.217.134.1	192.168.2.5
Jan 15, 2025 17:25:49.006659031 CET	445	49977	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:49.007299900 CET	49977	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:49.023694992 CET	49977	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:49.023695946 CET	49977	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:49.028652906 CET	445	49977	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:49.028667927 CET	445	49977	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:49.071336031 CET	50212	445	192.168.2.5	138.192.221.107
Jan 15, 2025 17:25:49.076307058 CET	445	50212	138.192.221.107	192.168.2.5
Jan 15, 2025 17:25:49.076375961 CET	50212	445	192.168.2.5	138.192.221.107
Jan 15, 2025 17:25:49.076435089 CET	50212	445	192.168.2.5	138.192.221.107
Jan 15, 2025 17:25:49.077959061 CET	50214	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.082165003 CET	445	50212	138.192.221.107	192.168.2.5
Jan 15, 2025 17:25:49.082221985 CET	50212	445	192.168.2.5	138.192.221.107
Jan 15, 2025 17:25:49.082835913 CET	445	50214	138.192.221.1	192.168.2.5
Jan 15, 2025 17:25:49.085876942 CET	50214	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.088716030 CET	50214	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.088968039 CET	50215	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.094295979 CET	445	50214	138.192.221.1	192.168.2.5
Jan 15, 2025 17:25:49.094454050 CET	50214	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.095017910 CET	445	50215	138.192.221.1	192.168.2.5
Jan 15, 2025 17:25:49.095451117 CET	50215	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.097110987 CET	50215	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:25:49.102313995 CET	445	50215	138.192.221.1	192.168.2.5
Jan 15, 2025 17:25:50.014094114 CET	50222	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:50.018903017 CET	445	50222	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:50.018976927 CET	50222	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:50.018992901 CET	50222	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:25:50.024287939 CET	445	50222	184.229.205.1	192.168.2.5
Jan 15, 2025 17:25:50.594038010 CET	50226	445	192.168.2.5	201.138.103.114
Jan 15, 2025 17:25:50.598866940 CET	445	50226	201.138.103.114	192.168.2.5
Jan 15, 2025 17:25:50.598958969 CET	50226	445	192.168.2.5	201.138.103.114
Jan 15, 2025 17:25:50.599056959 CET	50226	445	192.168.2.5	201.138.103.114
Jan 15, 2025 17:25:50.599183083 CET	50227	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.604005098 CET	445	50227	201.138.103.1	192.168.2.5
Jan 15, 2025 17:25:50.604018927 CET	445	50226	201.138.103.114	192.168.2.5
Jan 15, 2025 17:25:50.604125977 CET	50226	445	192.168.2.5	201.138.103.114
Jan 15, 2025 17:25:50.604221106 CET	50227	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.604221106 CET	50227	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.604687929 CET	50228	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.609575987 CET	445	50227	201.138.103.1	192.168.2.5
Jan 15, 2025 17:25:50.609648943 CET	50227	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.609744072 CET	445	50228	201.138.103.1	192.168.2.5
Jan 15, 2025 17:25:50.609819889 CET	50228	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.609864950 CET	50228	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:25:50.614819050 CET	445	50228	201.138.103.1	192.168.2.5
Jan 15, 2025 17:25:51.022450924 CET	445	50012	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:51.022641897 CET	50012	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:51.022641897 CET	50012	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:51.022641897 CET	50012	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:51.027566910 CET	445	50012	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:51.027580023 CET	445	50012	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:52.014333963 CET	50238	445	192.168.2.5	182.169.130.153
Jan 15, 2025 17:25:52.021110058 CET	445	50238	182.169.130.153	192.168.2.5
Jan 15, 2025 17:25:52.021188974 CET	50238	445	192.168.2.5	182.169.130.153
Jan 15, 2025 17:25:52.021255016 CET	50238	445	192.168.2.5	182.169.130.153
Jan 15, 2025 17:25:52.021409988 CET	50239	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.027798891 CET	445	50239	182.169.130.1	192.168.2.5
Jan 15, 2025 17:25:52.027848005 CET	445	50238	182.169.130.153	192.168.2.5
Jan 15, 2025 17:25:52.027877092 CET	50239	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.027895927 CET	50238	445	192.168.2.5	182.169.130.153
Jan 15, 2025 17:25:52.027955055 CET	50239	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.028251886 CET	50240	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.029723883 CET	50241	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:52.032846928 CET	445	50239	182.169.130.1	192.168.2.5
Jan 15, 2025 17:25:52.032898903 CET	50239	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.033246040 CET	445	50240	182.169.130.1	192.168.2.5
Jan 15, 2025 17:25:52.033310890 CET	50240	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.033360958 CET	50240	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:25:52.034578085 CET	445	50241	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:52.034657001 CET	50241	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:52.034703016 CET	50241	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:25:52.038093090 CET	445	50240	182.169.130.1	192.168.2.5
Jan 15, 2025 17:25:52.039705038 CET	445	50241	18.169.197.1	192.168.2.5
Jan 15, 2025 17:25:53.037484884 CET	445	50047	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:53.037944078 CET	50047	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:53.038033962 CET	50047	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:53.038034916 CET	50047	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:53.042857885 CET	445	50047	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:53.042870998 CET	445	50047	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:53.342732906 CET	50251	445	192.168.2.5	150.224.199.101
Jan 15, 2025 17:25:53.347628117 CET	445	50251	150.224.199.101	192.168.2.5
Jan 15, 2025 17:25:53.349802971 CET	50251	445	192.168.2.5	150.224.199.101
Jan 15, 2025 17:25:53.349865913 CET	50251	445	192.168.2.5	150.224.199.101
Jan 15, 2025 17:25:53.350033998 CET	50252	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.354835987 CET	445	50251	150.224.199.101	192.168.2.5
Jan 15, 2025 17:25:53.354851961 CET	445	50252	150.224.199.1	192.168.2.5
Jan 15, 2025 17:25:53.354917049 CET	50251	445	192.168.2.5	150.224.199.101
Jan 15, 2025 17:25:53.354945898 CET	50252	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.355025053 CET	50252	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.355252028 CET	50253	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.360053062 CET	445	50252	150.224.199.1	192.168.2.5
Jan 15, 2025 17:25:53.360065937 CET	445	50253	150.224.199.1	192.168.2.5
Jan 15, 2025 17:25:53.360131025 CET	50252	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.360146046 CET	50253	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.360601902 CET	50253	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:25:53.365360022 CET	445	50253	150.224.199.1	192.168.2.5
Jan 15, 2025 17:25:54.029738903 CET	50258	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:54.034589052 CET	445	50258	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:54.034660101 CET	50258	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:54.034688950 CET	50258	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:25:54.039458990 CET	445	50258	193.174.140.1	192.168.2.5
Jan 15, 2025 17:25:54.576705933 CET	50264	445	192.168.2.5	157.200.4.162
Jan 15, 2025 17:25:54.581553936 CET	445	50264	157.200.4.162	192.168.2.5
Jan 15, 2025 17:25:54.581721067 CET	50264	445	192.168.2.5	157.200.4.162
Jan 15, 2025 17:25:54.581762075 CET	50264	445	192.168.2.5	157.200.4.162
Jan 15, 2025 17:25:54.581899881 CET	50265	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.586772919 CET	445	50265	157.200.4.1	192.168.2.5
Jan 15, 2025 17:25:54.586786985 CET	445	50264	157.200.4.162	192.168.2.5
Jan 15, 2025 17:25:54.586854935 CET	50264	445	192.168.2.5	157.200.4.162
Jan 15, 2025 17:25:54.586941957 CET	50265	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.586941957 CET	50265	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.587209940 CET	50266	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.592001915 CET	445	50266	157.200.4.1	192.168.2.5
Jan 15, 2025 17:25:54.592015028 CET	445	50265	157.200.4.1	192.168.2.5
Jan 15, 2025 17:25:54.592072964 CET	50265	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.592120886 CET	50266	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.592120886 CET	50266	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:25:54.596873999 CET	445	50266	157.200.4.1	192.168.2.5
Jan 15, 2025 17:25:55.119749069 CET	445	50082	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:55.119868994 CET	50082	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:55.119949102 CET	50082	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:55.119949102 CET	50082	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:55.124902964 CET	445	50082	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:55.124917984 CET	445	50082	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:55.302791119 CET	445	50088	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:55.302968025 CET	50088	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:55.302968025 CET	50088	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:55.303040028 CET	50088	445	192.168.2.5	62.144.252.1
Jan 15, 2025 17:25:55.308187962 CET	445	50088	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:55.308202028 CET	445	50088	62.144.252.1	192.168.2.5
Jan 15, 2025 17:25:55.357939005 CET	50272	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.362720966 CET	445	50272	62.144.252.2	192.168.2.5
Jan 15, 2025 17:25:55.362809896 CET	50272	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.362822056 CET	50272	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.363095045 CET	50273	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.367832899 CET	445	50272	62.144.252.2	192.168.2.5
Jan 15, 2025 17:25:55.367887974 CET	50272	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.367923021 CET	445	50273	62.144.252.2	192.168.2.5
Jan 15, 2025 17:25:55.367995977 CET	50273	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.368035078 CET	50273	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:25:55.372802973 CET	445	50273	62.144.252.2	192.168.2.5
Jan 15, 2025 17:25:55.733521938 CET	50276	445	192.168.2.5	48.182.203.93
Jan 15, 2025 17:25:55.738440037 CET	445	50276	48.182.203.93	192.168.2.5
Jan 15, 2025 17:25:55.738516092 CET	50276	445	192.168.2.5	48.182.203.93
Jan 15, 2025 17:25:55.738553047 CET	50276	445	192.168.2.5	48.182.203.93
Jan 15, 2025 17:25:55.738657951 CET	50277	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.743424892 CET	445	50277	48.182.203.1	192.168.2.5
Jan 15, 2025 17:25:55.743489981 CET	50277	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.743508101 CET	50277	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.743535042 CET	445	50276	48.182.203.93	192.168.2.5
Jan 15, 2025 17:25:55.743633032 CET	445	50276	48.182.203.93	192.168.2.5
Jan 15, 2025 17:25:55.743685007 CET	50276	445	192.168.2.5	48.182.203.93
Jan 15, 2025 17:25:55.743776083 CET	50278	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.748572111 CET	445	50277	48.182.203.1	192.168.2.5
Jan 15, 2025 17:25:55.748591900 CET	445	50278	48.182.203.1	192.168.2.5
Jan 15, 2025 17:25:55.748629093 CET	50277	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.748686075 CET	50278	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.748686075 CET	50278	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:25:55.753530025 CET	445	50278	48.182.203.1	192.168.2.5
Jan 15, 2025 17:25:56.045299053 CET	50281	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:56.050127029 CET	445	50281	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:56.050209045 CET	50281	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:56.050239086 CET	50281	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:25:56.054985046 CET	445	50281	36.153.240.1	192.168.2.5
Jan 15, 2025 17:25:56.811430931 CET	50286	445	192.168.2.5	47.184.229.206
Jan 15, 2025 17:25:56.816293955 CET	445	50286	47.184.229.206	192.168.2.5
Jan 15, 2025 17:25:56.816478968 CET	50286	445	192.168.2.5	47.184.229.206
Jan 15, 2025 17:25:56.819048882 CET	50286	445	192.168.2.5	47.184.229.206
Jan 15, 2025 17:25:56.819355965 CET	50287	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.823925018 CET	445	50286	47.184.229.206	192.168.2.5
Jan 15, 2025 17:25:56.823992968 CET	50286	445	192.168.2.5	47.184.229.206
Jan 15, 2025 17:25:56.824218988 CET	445	50287	47.184.229.1	192.168.2.5
Jan 15, 2025 17:25:56.824286938 CET	50287	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.824328899 CET	50287	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.824568033 CET	50288	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.829266071 CET	445	50287	47.184.229.1	192.168.2.5
Jan 15, 2025 17:25:56.829334021 CET	445	50288	47.184.229.1	192.168.2.5
Jan 15, 2025 17:25:56.829340935 CET	50287	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.829521894 CET	50288	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.829521894 CET	50288	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:25:56.834290028 CET	445	50288	47.184.229.1	192.168.2.5
Jan 15, 2025 17:25:57.053941011 CET	445	50104	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:57.054018974 CET	50104	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:57.054075003 CET	50104	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:57.054116964 CET	50104	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:25:57.058903933 CET	445	50104	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:57.058917999 CET	445	50104	136.248.250.1	192.168.2.5
Jan 15, 2025 17:25:57.275903940 CET	445	50105	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:57.276034117 CET	50105	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:57.276114941 CET	50105	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:57.276206017 CET	50105	445	192.168.2.5	38.200.252.1
Jan 15, 2025 17:25:57.280875921 CET	445	50105	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:57.280940056 CET	445	50105	38.200.252.1	192.168.2.5
Jan 15, 2025 17:25:57.342364073 CET	50293	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.347208977 CET	445	50293	38.200.252.2	192.168.2.5
Jan 15, 2025 17:25:57.347393990 CET	50293	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.347393990 CET	50293	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.347728014 CET	50294	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.352494955 CET	445	50293	38.200.252.2	192.168.2.5
Jan 15, 2025 17:25:57.352519035 CET	445	50294	38.200.252.2	192.168.2.5
Jan 15, 2025 17:25:57.352582932 CET	50293	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.352612972 CET	50294	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.352648020 CET	50294	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:25:57.357388020 CET	445	50294	38.200.252.2	192.168.2.5
Jan 15, 2025 17:25:57.827466965 CET	50298	445	192.168.2.5	102.226.199.83
Jan 15, 2025 17:25:57.832418919 CET	445	50298	102.226.199.83	192.168.2.5
Jan 15, 2025 17:25:57.836074114 CET	50298	445	192.168.2.5	102.226.199.83
Jan 15, 2025 17:25:57.839245081 CET	50298	445	192.168.2.5	102.226.199.83
Jan 15, 2025 17:25:57.839556932 CET	50299	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.844343901 CET	445	50298	102.226.199.83	192.168.2.5
Jan 15, 2025 17:25:57.844419003 CET	445	50299	102.226.199.1	192.168.2.5
Jan 15, 2025 17:25:57.844568014 CET	50298	445	192.168.2.5	102.226.199.83
Jan 15, 2025 17:25:57.844609022 CET	50299	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.844674110 CET	50299	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.845065117 CET	50300	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.849596024 CET	445	50299	102.226.199.1	192.168.2.5
Jan 15, 2025 17:25:57.849684954 CET	50299	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.849859953 CET	445	50300	102.226.199.1	192.168.2.5
Jan 15, 2025 17:25:57.849922895 CET	50300	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.849960089 CET	50300	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:25:57.854680061 CET	445	50300	102.226.199.1	192.168.2.5
Jan 15, 2025 17:25:58.123564959 CET	50303	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:58.128479004 CET	445	50303	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:58.131809950 CET	50303	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:58.131855965 CET	50303	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:25:58.136616945 CET	445	50303	142.52.100.1	192.168.2.5
Jan 15, 2025 17:25:58.764504910 CET	50308	445	192.168.2.5	223.186.217.83
Jan 15, 2025 17:25:58.769434929 CET	445	50308	223.186.217.83	192.168.2.5
Jan 15, 2025 17:25:58.769524097 CET	50308	445	192.168.2.5	223.186.217.83
Jan 15, 2025 17:25:58.769566059 CET	50308	445	192.168.2.5	223.186.217.83
Jan 15, 2025 17:25:58.769901991 CET	50309	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.774454117 CET	445	50308	223.186.217.83	192.168.2.5
Jan 15, 2025 17:25:58.774523020 CET	50308	445	192.168.2.5	223.186.217.83
Jan 15, 2025 17:25:58.774725914 CET	445	50309	223.186.217.1	192.168.2.5
Jan 15, 2025 17:25:58.774811029 CET	50309	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.774904013 CET	50309	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.775171995 CET	50310	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.779980898 CET	445	50310	223.186.217.1	192.168.2.5
Jan 15, 2025 17:25:58.780042887 CET	50310	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.780102015 CET	50310	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.780319929 CET	445	50309	223.186.217.1	192.168.2.5
Jan 15, 2025 17:25:58.780373096 CET	50309	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:25:58.784827948 CET	445	50310	223.186.217.1	192.168.2.5
Jan 15, 2025 17:25:59.068842888 CET	445	50119	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:59.068932056 CET	50119	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:59.068973064 CET	50119	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:59.069008112 CET	50119	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:25:59.073823929 CET	445	50119	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:59.073833942 CET	445	50119	187.253.170.1	192.168.2.5
Jan 15, 2025 17:25:59.338984013 CET	445	50124	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:59.339076996 CET	50124	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:59.339169979 CET	50124	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:59.339273930 CET	50124	445	192.168.2.5	130.171.163.1
Jan 15, 2025 17:25:59.343900919 CET	445	50124	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:59.344273090 CET	445	50124	130.171.163.1	192.168.2.5
Jan 15, 2025 17:25:59.404963970 CET	50316	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.409914970 CET	445	50316	130.171.163.2	192.168.2.5
Jan 15, 2025 17:25:59.410013914 CET	50316	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.410053968 CET	50316	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.410378933 CET	50317	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.415512085 CET	445	50317	130.171.163.2	192.168.2.5
Jan 15, 2025 17:25:59.415524006 CET	445	50316	130.171.163.2	192.168.2.5
Jan 15, 2025 17:25:59.415534019 CET	445	50316	130.171.163.2	192.168.2.5
Jan 15, 2025 17:25:59.415584087 CET	50317	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.415611982 CET	50316	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.415692091 CET	50317	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:25:59.421508074 CET	445	50317	130.171.163.2	192.168.2.5
Jan 15, 2025 17:25:59.639591932 CET	50319	445	192.168.2.5	97.96.228.22
Jan 15, 2025 17:25:59.644481897 CET	445	50319	97.96.228.22	192.168.2.5
Jan 15, 2025 17:25:59.644694090 CET	50319	445	192.168.2.5	97.96.228.22
Jan 15, 2025 17:25:59.644694090 CET	50319	445	192.168.2.5	97.96.228.22
Jan 15, 2025 17:25:59.644879103 CET	50320	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.649744034 CET	445	50320	97.96.228.1	192.168.2.5
Jan 15, 2025 17:25:59.649754047 CET	445	50319	97.96.228.22	192.168.2.5
Jan 15, 2025 17:25:59.649847031 CET	50319	445	192.168.2.5	97.96.228.22
Jan 15, 2025 17:25:59.649847031 CET	50320	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.649941921 CET	50320	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.650305033 CET	50321	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.654871941 CET	445	50320	97.96.228.1	192.168.2.5
Jan 15, 2025 17:25:59.654942989 CET	50320	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.655128956 CET	445	50321	97.96.228.1	192.168.2.5
Jan 15, 2025 17:25:59.655201912 CET	50321	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.655216932 CET	50321	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:25:59.659965038 CET	445	50321	97.96.228.1	192.168.2.5
Jan 15, 2025 17:26:00.060949087 CET	50325	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:26:00.065788031 CET	445	50325	136.248.250.1	192.168.2.5
Jan 15, 2025 17:26:00.065871000 CET	50325	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:26:00.065908909 CET	50325	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:26:00.070769072 CET	445	50325	136.248.250.1	192.168.2.5
Jan 15, 2025 17:26:00.474900007 CET	50329	445	192.168.2.5	167.103.158.41
Jan 15, 2025 17:26:00.479674101 CET	445	50329	167.103.158.41	192.168.2.5
Jan 15, 2025 17:26:00.479757071 CET	50329	445	192.168.2.5	167.103.158.41
Jan 15, 2025 17:26:00.479851007 CET	50329	445	192.168.2.5	167.103.158.41
Jan 15, 2025 17:26:00.484015942 CET	50330	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.484699011 CET	445	50329	167.103.158.41	192.168.2.5
Jan 15, 2025 17:26:00.484757900 CET	50329	445	192.168.2.5	167.103.158.41
Jan 15, 2025 17:26:00.488903046 CET	445	50330	167.103.158.1	192.168.2.5
Jan 15, 2025 17:26:00.488974094 CET	50330	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.492630005 CET	50330	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.492912054 CET	50331	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.497699976 CET	445	50331	167.103.158.1	192.168.2.5
Jan 15, 2025 17:26:00.497745037 CET	445	50330	167.103.158.1	192.168.2.5
Jan 15, 2025 17:26:00.497780085 CET	50331	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.497797012 CET	50331	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.497822046 CET	50330	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:00.502563953 CET	445	50331	167.103.158.1	192.168.2.5
Jan 15, 2025 17:26:01.101093054 CET	445	50137	218.101.231.1	192.168.2.5
Jan 15, 2025 17:26:01.101161957 CET	50137	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:01.101186037 CET	50137	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:01.101234913 CET	50137	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:01.106036901 CET	445	50137	218.101.231.1	192.168.2.5
Jan 15, 2025 17:26:01.106072903 CET	445	50137	218.101.231.1	192.168.2.5
Jan 15, 2025 17:26:01.233398914 CET	50336	445	192.168.2.5	142.55.51.246
Jan 15, 2025 17:26:01.238543987 CET	445	50336	142.55.51.246	192.168.2.5
Jan 15, 2025 17:26:01.238615036 CET	50336	445	192.168.2.5	142.55.51.246
Jan 15, 2025 17:26:01.238641977 CET	50336	445	192.168.2.5	142.55.51.246
Jan 15, 2025 17:26:01.238769054 CET	50337	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.243519068 CET	445	50336	142.55.51.246	192.168.2.5
Jan 15, 2025 17:26:01.243647099 CET	445	50337	142.55.51.1	192.168.2.5
Jan 15, 2025 17:26:01.243715048 CET	50337	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.243766069 CET	445	50336	142.55.51.246	192.168.2.5
Jan 15, 2025 17:26:01.243820906 CET	50337	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.243823051 CET	50336	445	192.168.2.5	142.55.51.246
Jan 15, 2025 17:26:01.244055033 CET	50338	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.248933077 CET	445	50338	142.55.51.1	192.168.2.5
Jan 15, 2025 17:26:01.249011040 CET	50338	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.249053955 CET	50338	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.249504089 CET	445	50337	142.55.51.1	192.168.2.5
Jan 15, 2025 17:26:01.249654055 CET	50337	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:01.253950119 CET	445	50338	142.55.51.1	192.168.2.5
Jan 15, 2025 17:26:01.303253889 CET	445	50139	137.94.76.1	192.168.2.5
Jan 15, 2025 17:26:01.303349972 CET	50139	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:26:01.303405046 CET	50139	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:26:01.303457022 CET	50139	445	192.168.2.5	137.94.76.1
Jan 15, 2025 17:26:01.308229923 CET	445	50139	137.94.76.1	192.168.2.5
Jan 15, 2025 17:26:01.308280945 CET	445	50139	137.94.76.1	192.168.2.5
Jan 15, 2025 17:26:01.358007908 CET	50340	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.362963915 CET	445	50340	137.94.76.2	192.168.2.5
Jan 15, 2025 17:26:01.363065004 CET	50340	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.363065004 CET	50340	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.363337994 CET	50341	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.368264914 CET	445	50341	137.94.76.2	192.168.2.5
Jan 15, 2025 17:26:01.368295908 CET	445	50340	137.94.76.2	192.168.2.5
Jan 15, 2025 17:26:01.368340969 CET	50341	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.368360043 CET	50340	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.368402958 CET	50341	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:01.373192072 CET	445	50341	137.94.76.2	192.168.2.5
Jan 15, 2025 17:26:02.076668978 CET	50347	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:26:02.081496000 CET	445	50347	187.253.170.1	192.168.2.5
Jan 15, 2025 17:26:02.081566095 CET	50347	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:26:02.081588030 CET	50347	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:26:02.086375952 CET	445	50347	187.253.170.1	192.168.2.5
Jan 15, 2025 17:26:03.152555943 CET	445	50152	116.10.21.1	192.168.2.5
Jan 15, 2025 17:26:03.152637005 CET	50152	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:03.154584885 CET	50152	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:03.154630899 CET	50152	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:03.159410954 CET	445	50152	116.10.21.1	192.168.2.5
Jan 15, 2025 17:26:03.159424067 CET	445	50152	116.10.21.1	192.168.2.5
Jan 15, 2025 17:26:03.334682941 CET	445	50156	149.18.183.1	192.168.2.5
Jan 15, 2025 17:26:03.338263988 CET	50156	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:26:03.354008913 CET	50156	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:26:03.354089022 CET	50156	445	192.168.2.5	149.18.183.1
Jan 15, 2025 17:26:03.358921051 CET	445	50156	149.18.183.1	192.168.2.5
Jan 15, 2025 17:26:03.358952045 CET	445	50156	149.18.183.1	192.168.2.5
Jan 15, 2025 17:26:03.430201054 CET	50360	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.435120106 CET	445	50360	149.18.183.2	192.168.2.5
Jan 15, 2025 17:26:03.435995102 CET	50360	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.436093092 CET	50360	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.439569950 CET	50362	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.441157103 CET	445	50360	149.18.183.2	192.168.2.5
Jan 15, 2025 17:26:03.441262960 CET	50360	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.444394112 CET	445	50362	149.18.183.2	192.168.2.5
Jan 15, 2025 17:26:03.444500923 CET	50362	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.444529057 CET	50362	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:03.449419022 CET	445	50362	149.18.183.2	192.168.2.5
Jan 15, 2025 17:26:04.107978106 CET	50367	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:04.112828970 CET	445	50367	218.101.231.1	192.168.2.5
Jan 15, 2025 17:26:04.112910986 CET	50367	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:04.112934113 CET	50367	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:04.117702007 CET	445	50367	218.101.231.1	192.168.2.5
Jan 15, 2025 17:26:05.166414022 CET	445	50170	89.148.186.1	192.168.2.5
Jan 15, 2025 17:26:05.166488886 CET	50170	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:05.166548014 CET	50170	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:05.166599989 CET	50170	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:05.171318054 CET	445	50170	89.148.186.1	192.168.2.5
Jan 15, 2025 17:26:05.171334982 CET	445	50170	89.148.186.1	192.168.2.5
Jan 15, 2025 17:26:05.334569931 CET	445	50172	171.68.51.1	192.168.2.5
Jan 15, 2025 17:26:05.334856033 CET	50172	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:26:05.334856033 CET	50172	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:26:05.334891081 CET	50172	445	192.168.2.5	171.68.51.1
Jan 15, 2025 17:26:05.339706898 CET	445	50172	171.68.51.1	192.168.2.5
Jan 15, 2025 17:26:05.339715004 CET	445	50172	171.68.51.1	192.168.2.5
Jan 15, 2025 17:26:05.419467926 CET	50375	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.424330950 CET	445	50375	171.68.51.2	192.168.2.5
Jan 15, 2025 17:26:05.425961018 CET	50375	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.426033974 CET	50375	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.426286936 CET	50377	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.431025982 CET	445	50375	171.68.51.2	192.168.2.5
Jan 15, 2025 17:26:05.431097031 CET	445	50377	171.68.51.2	192.168.2.5
Jan 15, 2025 17:26:05.431164026 CET	50375	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.431176901 CET	50377	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.431221962 CET	50377	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:05.436005116 CET	445	50377	171.68.51.2	192.168.2.5
Jan 15, 2025 17:26:06.170350075 CET	50384	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:06.175326109 CET	445	50384	116.10.21.1	192.168.2.5
Jan 15, 2025 17:26:06.175404072 CET	50384	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:06.175431013 CET	50384	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:06.180161953 CET	445	50384	116.10.21.1	192.168.2.5
Jan 15, 2025 17:26:07.010853052 CET	445	50185	148.208.193.1	192.168.2.5
Jan 15, 2025 17:26:07.014149904 CET	50185	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:07.014235020 CET	50185	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:07.014298916 CET	50185	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:07.019026041 CET	445	50185	148.208.193.1	192.168.2.5
Jan 15, 2025 17:26:07.019052029 CET	445	50185	148.208.193.1	192.168.2.5
Jan 15, 2025 17:26:07.371414900 CET	445	50189	16.176.209.1	192.168.2.5
Jan 15, 2025 17:26:07.371490955 CET	50189	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:26:07.371524096 CET	50189	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:26:07.371550083 CET	50189	445	192.168.2.5	16.176.209.1
Jan 15, 2025 17:26:07.376346111 CET	445	50189	16.176.209.1	192.168.2.5
Jan 15, 2025 17:26:07.376380920 CET	445	50189	16.176.209.1	192.168.2.5
Jan 15, 2025 17:26:07.435934067 CET	50398	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.440874100 CET	445	50398	16.176.209.2	192.168.2.5
Jan 15, 2025 17:26:07.440943956 CET	50398	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.440968037 CET	50398	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.441205978 CET	50399	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.446075916 CET	445	50399	16.176.209.2	192.168.2.5
Jan 15, 2025 17:26:07.446171999 CET	50399	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.446171999 CET	50399	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.447108030 CET	445	50398	16.176.209.2	192.168.2.5
Jan 15, 2025 17:26:07.447163105 CET	50398	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:07.451034069 CET	445	50399	16.176.209.2	192.168.2.5
Jan 15, 2025 17:26:08.174349070 CET	50409	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:08.179500103 CET	445	50409	89.148.186.1	192.168.2.5
Jan 15, 2025 17:26:08.179591894 CET	50409	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:08.179605007 CET	50409	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:08.184536934 CET	445	50409	89.148.186.1	192.168.2.5
Jan 15, 2025 17:26:08.757358074 CET	445	50200	222.71.154.1	192.168.2.5
Jan 15, 2025 17:26:08.757447958 CET	50200	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:08.757510900 CET	50200	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:08.757538080 CET	50200	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:08.762527943 CET	445	50200	222.71.154.1	192.168.2.5
Jan 15, 2025 17:26:08.762541056 CET	445	50200	222.71.154.1	192.168.2.5
Jan 15, 2025 17:26:09.350322962 CET	445	50204	96.217.134.1	192.168.2.5
Jan 15, 2025 17:26:09.350534916 CET	50204	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:26:09.350534916 CET	50204	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:26:09.350534916 CET	50204	445	192.168.2.5	96.217.134.1
Jan 15, 2025 17:26:09.355639935 CET	445	50204	96.217.134.1	192.168.2.5
Jan 15, 2025 17:26:09.355669022 CET	445	50204	96.217.134.1	192.168.2.5
Jan 15, 2025 17:26:09.404798985 CET	50431	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.410016060 CET	445	50431	96.217.134.2	192.168.2.5
Jan 15, 2025 17:26:09.410119057 CET	50431	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.410420895 CET	50431	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.410438061 CET	50433	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.415338039 CET	445	50431	96.217.134.2	192.168.2.5
Jan 15, 2025 17:26:09.415405989 CET	50431	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.415525913 CET	445	50433	96.217.134.2	192.168.2.5
Jan 15, 2025 17:26:09.415616035 CET	50433	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.415616035 CET	50433	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:09.420583010 CET	445	50433	96.217.134.2	192.168.2.5
Jan 15, 2025 17:26:10.029736996 CET	50446	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:10.034981012 CET	445	50446	148.208.193.1	192.168.2.5
Jan 15, 2025 17:26:10.035177946 CET	50446	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:10.035233974 CET	50446	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:10.040186882 CET	445	50446	148.208.193.1	192.168.2.5
Jan 15, 2025 17:26:10.477480888 CET	445	50215	138.192.221.1	192.168.2.5
Jan 15, 2025 17:26:10.477638960 CET	50215	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:26:10.477740049 CET	50215	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:26:10.477741003 CET	50215	445	192.168.2.5	138.192.221.1
Jan 15, 2025 17:26:10.482702971 CET	445	50215	138.192.221.1	192.168.2.5
Jan 15, 2025 17:26:10.482734919 CET	445	50215	138.192.221.1	192.168.2.5
Jan 15, 2025 17:26:11.381761074 CET	445	50222	184.229.205.1	192.168.2.5
Jan 15, 2025 17:26:11.381882906 CET	50222	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:26:11.383358002 CET	50222	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:26:11.383402109 CET	50222	445	192.168.2.5	184.229.205.1
Jan 15, 2025 17:26:11.388257027 CET	445	50222	184.229.205.1	192.168.2.5
Jan 15, 2025 17:26:11.388269901 CET	445	50222	184.229.205.1	192.168.2.5
Jan 15, 2025 17:26:11.438275099 CET	50487	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.443574905 CET	445	50487	184.229.205.2	192.168.2.5
Jan 15, 2025 17:26:11.443763971 CET	50487	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.444184065 CET	50487	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.444197893 CET	50488	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.449237108 CET	445	50488	184.229.205.2	192.168.2.5
Jan 15, 2025 17:26:11.449345112 CET	50488	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.449611902 CET	50488	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.449779987 CET	445	50487	184.229.205.2	192.168.2.5
Jan 15, 2025 17:26:11.449851990 CET	50487	445	192.168.2.5	184.229.205.2
Jan 15, 2025 17:26:11.454731941 CET	445	50488	184.229.205.2	192.168.2.5
Jan 15, 2025 17:26:11.765078068 CET	50501	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:11.770318985 CET	445	50501	222.71.154.1	192.168.2.5
Jan 15, 2025 17:26:11.770461082 CET	50501	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:11.770461082 CET	50501	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:11.775510073 CET	445	50501	222.71.154.1	192.168.2.5
Jan 15, 2025 17:26:12.009162903 CET	445	50228	201.138.103.1	192.168.2.5
Jan 15, 2025 17:26:12.009247065 CET	50228	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:26:12.009325027 CET	50228	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:26:12.009377956 CET	50228	445	192.168.2.5	201.138.103.1
Jan 15, 2025 17:26:12.014189959 CET	445	50228	201.138.103.1	192.168.2.5
Jan 15, 2025 17:26:12.014199018 CET	445	50228	201.138.103.1	192.168.2.5
Jan 15, 2025 17:26:13.399223089 CET	445	50241	18.169.197.1	192.168.2.5
Jan 15, 2025 17:26:13.399306059 CET	50241	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:26:13.448465109 CET	445	50240	182.169.130.1	192.168.2.5
Jan 15, 2025 17:26:13.450916052 CET	50240	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:26:14.286420107 CET	50273	445	192.168.2.5	62.144.252.2
Jan 15, 2025 17:26:14.286505938 CET	50362	445	192.168.2.5	149.18.183.2
Jan 15, 2025 17:26:14.286540031 CET	50341	445	192.168.2.5	137.94.76.2
Jan 15, 2025 17:26:14.286547899 CET	50317	445	192.168.2.5	130.171.163.2
Jan 15, 2025 17:26:14.286596060 CET	50377	445	192.168.2.5	171.68.51.2
Jan 15, 2025 17:26:14.286673069 CET	50241	445	192.168.2.5	18.169.197.1
Jan 15, 2025 17:26:14.286699057 CET	50253	445	192.168.2.5	150.224.199.1
Jan 15, 2025 17:26:14.286750078 CET	50258	445	192.168.2.5	193.174.140.1
Jan 15, 2025 17:26:14.286756039 CET	50240	445	192.168.2.5	182.169.130.1
Jan 15, 2025 17:26:14.286782026 CET	50266	445	192.168.2.5	157.200.4.1
Jan 15, 2025 17:26:14.286812067 CET	50278	445	192.168.2.5	48.182.203.1
Jan 15, 2025 17:26:14.286839008 CET	50281	445	192.168.2.5	36.153.240.1
Jan 15, 2025 17:26:14.286854982 CET	50288	445	192.168.2.5	47.184.229.1
Jan 15, 2025 17:26:14.286876917 CET	50294	445	192.168.2.5	38.200.252.2
Jan 15, 2025 17:26:14.286902905 CET	50300	445	192.168.2.5	102.226.199.1
Jan 15, 2025 17:26:14.286927938 CET	50303	445	192.168.2.5	142.52.100.1
Jan 15, 2025 17:26:14.286959887 CET	50310	445	192.168.2.5	223.186.217.1
Jan 15, 2025 17:26:14.286992073 CET	50321	445	192.168.2.5	97.96.228.1
Jan 15, 2025 17:26:14.286997080 CET	50325	445	192.168.2.5	136.248.250.1
Jan 15, 2025 17:26:14.287024021 CET	50331	445	192.168.2.5	167.103.158.1
Jan 15, 2025 17:26:14.287054062 CET	50338	445	192.168.2.5	142.55.51.1
Jan 15, 2025 17:26:14.287071943 CET	50347	445	192.168.2.5	187.253.170.1
Jan 15, 2025 17:26:14.287105083 CET	50367	445	192.168.2.5	218.101.231.1
Jan 15, 2025 17:26:14.287131071 CET	50384	445	192.168.2.5	116.10.21.1
Jan 15, 2025 17:26:14.287144899 CET	50409	445	192.168.2.5	89.148.186.1
Jan 15, 2025 17:26:14.287184000 CET	50399	445	192.168.2.5	16.176.209.2
Jan 15, 2025 17:26:14.287216902 CET	50433	445	192.168.2.5	96.217.134.2
Jan 15, 2025 17:26:14.287260056 CET	50446	445	192.168.2.5	148.208.193.1
Jan 15, 2025 17:26:14.287338972 CET	50501	445	192.168.2.5	222.71.154.1
Jan 15, 2025 17:26:14.287379980 CET	50488	445	192.168.2.5	184.229.205.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 17:25:06.342878103 CET	51063	53	192.168.2.5	1.1.1.1
Jan 15, 2025 17:25:06.651994944 CET	53	51063	1.1.1.1	192.168.2.5
Jan 15, 2025 17:25:07.291615963 CET	50231	53	192.168.2.5	1.1.1.1
Jan 15, 2025 17:25:07.622163057 CET	53	50231	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 17:25:06.342878103 CET	192.168.2.5	1.1.1.1	0x3705	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:25:07.291615963 CET	192.168.2.5	1.1.1.1	0xb582	Standard query (0)	ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 17:25:06.651994944 CET	1.1.1.1	192.168.2.5	0x3705	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com		103.224.212.215	A (IP address)	IN (0x0001)	false
Jan 15, 2025 17:25:07.622163057 CET	1.1.1.1	192.168.2.5	0xb582	No error (0)	ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com	77026.bodis.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 17:25:07.622163057 CET	1.1.1.1	192.168.2.5	0xb582	No error (0)	77026.bodis.com		199.59.243.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	103.224.212.215	80	5728	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:25:06.663515091 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 15, 2025 17:25:07.280993938 CET	365	IN	HTTP/1.1 302 Found date: Wed, 15 Jan 2025 16:25:07 GMT server: Apache set-cookie: __tad=1736958307.7566444; expires=Sat, 13-Jan-2035 16:25:07 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-07ad-ad4a-bba6e83174ed content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	199.59.243.228	80	5728	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:25:07.628016949 CET	169	OUT	GET /?subid1=20250116-0325-07ad-ad4a-bba6e83174ed HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Jan 15, 2025 17:25:08.092154026 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 15 Jan 2025 16:25:07 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: 0a70b268-8399-43f9-ab15-5dcb859153dc cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yL/TuFBFF1U2/HN9OOdcmblqvGsvFexwZ0JMuc2utmcv0DmhjZxhGWlJRBwD4UZ1YS4ACBOTRc6IdHLpgIZ2/Q== set-cookie: parking_session=0a70b268-8399-43f9-ab15-5dcb859153dc; expires=Wed, 15 Jan 2025 16:40:08 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 79 4c 2f 54 75 46 42 46 46 31 55 32 2f 48 4e 39 4f 4f 64 63 6d 62 6c 71 76 47 73 76 46 65 78 77 5a 30 4a 4d 75 63 32 75 74 6d 63 76 30 44 6d 68 6a 5a 78 68 47 57 6c 4a 52 42 77 44 34 55 5a 31 59 53 34 41 43 42 4f 54 52 63 36 49 64 48 4c 70 67 49 5a 32 2f 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yL/TuFBFF1U2/HN9OOdcmblqvGsvFexwZ0JMuc2utmcv0DmhjZxhGWlJRBwD4UZ1YS4ACBOTRc6IdHLpgIZ2/Q==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Jan 15, 2025 17:25:08.092201948 CET	696	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGE3MGIyNjgtODM5OS00M2Y5LWFiMTUtNWRjYjg1OTE1M2RjIiwicGFnZV90aW1lIjoxNzM2OTU4MzA4LCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	103.224.212.215	80	6048	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:25:08.354192019 CET	100	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache
Jan 15, 2025 17:25:08.974560976 CET	365	IN	HTTP/1.1 302 Found date: Wed, 15 Jan 2025 16:25:08 GMT server: Apache set-cookie: __tad=1736958308.3030782; expires=Sat, 13-Jan-2035 16:25:08 GMT; Max-Age=315360000 location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-0823-9d83-9e2f87dfdc03 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	199.59.243.228	80	6048	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:25:08.987662077 CET	169	OUT	GET /?subid1=20250116-0325-0823-9d83-9e2f87dfdc03 HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive
Jan 15, 2025 17:25:09.453062057 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 15 Jan 2025 16:25:08 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: 8f2d3fd9-14ce-4b26-a299-a43cb09761a4 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_YxlWqvge9kl18XZXbNC17r0dURqrE+XZhNu6OKWlSBht/06aCaiz3156KiCzBIT7LKcTN5AZlTavzsmvIJzEmg== set-cookie: parking_session=8f2d3fd9-14ce-4b26-a299-a43cb09761a4; expires=Wed, 15 Jan 2025 16:40:09 GMT; path=/ Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 59 78 6c 57 71 76 67 65 39 6b 6c 31 38 58 5a 58 62 4e 43 31 37 72 30 64 55 52 71 72 45 2b 58 5a 68 4e 75 36 4f 4b 57 6c 53 42 68 74 2f 30 36 61 43 61 69 7a 33 31 35 36 4b 69 43 7a 42 49 54 37 4c 4b 63 54 4e 35 41 5a 6c 54 61 76 7a 73 6d 76 49 4a 7a 45 6d 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_YxlWqvge9kl18XZXbNC17r0dURqrE+XZhNu6OKWlSBht/06aCaiz3156KiCzBIT7LKcTN5AZlTavzsmvIJzEmg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
Jan 15, 2025 17:25:09.453125000 CET	696	IN	Data Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOGYyZDNmZDktMTRjZS00YjI2LWEyOTktYTQzY2IwOTc2MWE0IiwicGFnZV90aW1lIjoxNzM2OTU4MzA5LCJwYWdlX3VybCI6I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	103.224.212.215	80	5632	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:25:09.223841906 CET	134	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Cache-Control: no-cache Cookie: __tad=1736958307.7566444
Jan 15, 2025 17:25:09.864445925 CET	269	IN	HTTP/1.1 302 Found date: Wed, 15 Jan 2025 16:25:09 GMT server: Apache location: http://ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/?subid1=20250116-0325-093d-a7ca-255010b2f70f content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49720	199.59.243.228	80	5632	C:\Windows\mssecsvr.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 17:25:09.872867107 CET	231	OUT	GET /?subid1=20250116-0325-093d-a7ca-255010b2f70f HTTP/1.1 Cache-Control: no-cache Host: ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com Connection: Keep-Alive Cookie: parking_session=0a70b268-8399-43f9-ab15-5dcb859153dc
Jan 15, 2025 17:25:10.342937946 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 15 Jan 2025 16:25:10 GMT content-type: text/html; charset=utf-8 content-length: 1262 x-request-id: e0530c6a-a164-440d-9a97-235252d1bd8b cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vUiqm8D1vKWLl138oImBP/Ij3xcnwUIJLcuECcximUXz9tpQxbFMck+14+mEhHxIMakYqoSlyzuY2xSrpgPLuQ== set-cookie: parking_session=0a70b268-8399-43f9-ab15-5dcb859153dc; expires=Wed, 15 Jan 2025 16:40:10 GMT Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 76 55 69 71 6d 38 44 31 76 4b 57 4c 6c 31 33 38 6f 49 6d 42 50 2f 49 6a 33 78 63 6e 77 55 49 4a 4c 63 75 45 43 63 78 69 6d 55 58 7a 39 74 70 51 78 62 46 4d 63 6b 2b 31 34 2b 6d 45 68 48 78 49 4d 61 6b 59 71 6f 53 6c 79 7a 75 59 32 78 53 72 70 67 50 4c 75 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_vUiqm8D1vKWLl138oImBP/Ij3xcnwUIJLcuECcximUXz9tpQxbFMck+14+mEhHxIMakYqoSlyzuY2xSrpgPLuQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="preconnect
Jan 15, 2025 17:25:10.342984915 CET	688	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65 74 22 20 73 74 79 6c 65 Data Ascii: " href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMGE3MGIyNjgtODM5OS00M2Y5LWFiMTUtNWRjYjg1OTE1M2RjIiwicGFnZV90aW1lIjoxNzM2OTU4MzEwLCJwYWdlX3VybCI6Imh0dHA6L

Target ID:	0
Start time:	11:25:05
Start date:	15/01/2025
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll"
Imagebase:	0xce0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:25:05
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:25:05
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:25:05
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\Gn8CvJE07O.dll,PlayGame
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:25:05
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",#1
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:25:05
Start date:	15/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	121CCF162E02BDBEF5B5CD056933F4D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.2070776364.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000000.2070885182.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:25:07
Start date:	15/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe -m security
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	121CCF162E02BDBEF5B5CD056933F4D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.2091006153.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.2742720446.0000000001D61000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.2091118201.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.2742964021.0000000002287000.00000004.00000020.00020000.00000000.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:25:08
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\Gn8CvJE07O.dll",PlayGame
Imagebase:	0xf20000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:25:08
Start date:	15/01/2025
Path:	C:\Windows\mssecsvr.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvr.exe
Imagebase:	0x400000
File size:	2'281'472 bytes
MD5 hash:	121CCF162E02BDBEF5B5CD056933F4D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.2112704011.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.2099567193.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000002.2112821535.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000000.2099679615.0000000000710000.00000002.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	71.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	63.2%
Total number of Nodes:	38
Total number of Limit Nodes:	9

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F380EF0,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000004,00000000), ref: 00407E43
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00407E61
CloseHandle.KERNELBASE(00000000), ref: 00407E68
CreateProcessA.KERNELBASE ref: 00407EE8
CloseHandle.KERNEL32(00000000), ref: 00407EF7
CloseHandle.KERNEL32(08000000), ref: 00407F02

Strings

CloseHandle, xrefs: 00407D29
WriteFile, xrefs: 00407D1C
tasksche.exe, xrefs: 00407DEA
D, xrefs: 00407ED3
CreateProcessA, xrefs: 00407D07
C:\%s\qeriuwjhrf, xrefs: 00407E12
kernel32.dll, xrefs: 00407CEA
WINDOWS, xrefs: 00407DF2, 00407E0D
/i, xrefs: 00407E8D
CreateFileA, xrefs: 00407D0F
C:\%s\%s, xrefs: 00407DFB

Memory Dump Source

Source File: 00000005.00000002.2103895971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2103861781.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103918904.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104027463.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressHandleProcResource$CloseFile$Createsprintf$FindLoadLockModuleMoveProcessSizeofWrite
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4281112323-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.KERNELBASE ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000005.00000002.2103895971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2103861781.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103918904.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104027463.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000005.00000002.2103895971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2103861781.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103918904.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104027463.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F380EF0,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

%s -m security, xrefs: 00407C50
mssecsvc2.1, xrefs: 00407C95
Microsoft Security Center (2.1) Service, xrefs: 00407C90

Memory Dump Source

Source File: 00000005.00000002.2103895971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2103861781.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103918904.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104027463.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F380EF0,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000005.00000002.2103895971.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2103861781.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103918904.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2103940751.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104027463.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2104232680.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Analysis Process: mssecsvr.exePID: 6048, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	34.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	36
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
__p___argc.MSVCRT ref: 004080A5
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,00000000,?,004081B2), ref: 004080C3
OpenServiceA.ADVAPI32(00000000,mssecsvc2.1,000F01FF,6F380EF0,00000000,?,004081B2), ref: 004080DC
CloseServiceHandle.ADVAPI32(00000000,?,?,?,004081B2), ref: 004080FA
CloseServiceHandle.ADVAPI32(00000000,?,004081B2), ref: 004080FD
StartServiceCtrlDispatcherA.ADVAPI32(?,?,?), ref: 00408126

Strings

mssecsvc2.1, xrefs: 004080D6, 00408105

Memory Dump Source

Source File: 00000007.00000002.2741527207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2741511086.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741546097.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741656736.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741672295.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpen$CtrlDispatcherFileManagerModuleNameStart__p___argc
String ID: mssecsvc2.1
API String ID: 4274534310-2839763450
Opcode ID: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction ID: 0eddf8d8cc97b5ba853ece0b0f9ce4fe0dc31dc3004373c78c05f92e851b2f94
Opcode Fuzzy Hash: 14f2d0f9cf239aa653f070f930b60ae04978eb0b591616557438e437b3700a6a
Instruction Fuzzy Hash: 4A014775640315BBE3117F149E4AF6F3AA4EF80B19F404429F544762D2DFB888188AAF

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040817B
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84000000,00000000), ref: 00408194
InternetCloseHandle.WININET(00000000), ref: 004081A7
InternetCloseHandle.WININET(00000000), ref: 004081AB

Part of subcall function 00408090: GetModuleFileNameA.KERNEL32(00000000,0070F760,00000104,?,004081B2), ref: 0040809F
Part of subcall function 00408090: __p___argc.MSVCRT ref: 004080A5

Strings

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, xrefs: 0040814A

Memory Dump Source

Source File: 00000007.00000002.2741527207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2741511086.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741546097.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741656736.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741672295.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileModuleName__p___argc
String ID: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com
API String ID: 774561529-2614457033
Opcode ID: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction ID: 3b8a91e0baa4f3639afdb349cfc438007093f0a6557163af6b5eb03d237fc32a
Opcode Fuzzy Hash: 0bbc0dabe610ff42f1f9ad6e85cc21407dd9b1b68127969cd029bea3a518856a
Instruction Fuzzy Hash: B3018671548310AEE310DF748D01B6B7BE9EF85710F01082EF984F72C0EAB59804876B

Non-executed Functions

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 00407C56
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00407C68
CreateServiceA.ADVAPI32(00000000,mssecsvc2.1,Microsoft Security Center (2.1) Service,000F01FF,00000010,00000002,00000001,?,00000000,00000000,00000000,00000000,00000000,6F380EF0,00000000), ref: 00407C9B
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00407CB2
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CB9
CloseServiceHandle.ADVAPI32(00000000), ref: 00407CBC

Strings

mssecsvc2.1, xrefs: 00407C95
%s -m security, xrefs: 00407C50
Microsoft Security Center (2.1) Service, xrefs: 00407C90

Memory Dump Source

Source File: 00000007.00000002.2741527207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2741511086.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741546097.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741656736.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741672295.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$CreateManagerOpenStartsprintf
String ID: %s -m security$Microsoft Security Center (2.1) Service$mssecsvc2.1
API String ID: 3340711343-2450984573
Opcode ID: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction ID: 2288e5cc66680fabefb91112cf05624c6df81315eb9d87428618c258e2ee617f
Opcode Fuzzy Hash: c3592d809756ac94f014d34e1e4fa0c14de5620095203194e3f9233ad68c92ee
Instruction Fuzzy Hash: AD01D1717C43043BF2305B149D8BFEB3658AB84F01F500025FB44B92D0DAF9A81491AF

Function 00407CE0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 175
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,6F380EF0,?,00000000), ref: 00407CEF
GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00407D0D
GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 00407D1A
GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00407D27
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00407D34
FindResourceA.KERNEL32(00000000,00000727,0043137C), ref: 00407D74
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407D86
LockResource.KERNEL32(00000000,?,00000000), ref: 00407D95
SizeofResource.KERNEL32(00000000,00000000,?,00000000), ref: 00407DA9
sprintf.MSVCRT ref: 00407E01
sprintf.MSVCRT ref: 00407E18
MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00407E2C

Strings

WINDOWS, xrefs: 00407DF2, 00407E0D
kernel32.dll, xrefs: 00407CEA
CloseHandle, xrefs: 00407D29
C:\%s\%s, xrefs: 00407DFB
WriteFile, xrefs: 00407D1C
CreateFileA, xrefs: 00407D0F
tasksche.exe, xrefs: 00407DEA
/i, xrefs: 00407E8D
C:\%s\qeriuwjhrf, xrefs: 00407E12
D, xrefs: 00407ED3
CreateProcessA, xrefs: 00407D07

Memory Dump Source

Source File: 00000007.00000002.2741527207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2741511086.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741546097.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741656736.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741672295.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: AddressProcResource$sprintf$FileFindHandleLoadLockModuleMoveSizeof
String ID: /i$C:\%s\%s$C:\%s\qeriuwjhrf$CloseHandle$CreateFileA$CreateProcessA$D$WINDOWS$WriteFile$kernel32.dll$tasksche.exe
API String ID: 4072214828-1507730452
Opcode ID: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction ID: 13a48b3e7e70fc1f7524b3ea2ca00aec236584d0bbebcf852995d03268f4a9c8
Opcode Fuzzy Hash: fb819ea0bbfac7cba45177718834bfaea6ecb5a57a4692884010a03d6946efb9
Instruction Fuzzy Hash: B15197715043496FE7109F74DC84AAB7B98EB88354F14493EF651A32E0DA7898088BAA

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00409A43
__p__fmode.MSVCRT ref: 00409A58
__p__commode.MSVCRT ref: 00409A66
__setusermatherr.MSVCRT ref: 00409A92
_initterm.MSVCRT ref: 00409AA8
__getmainargs.MSVCRT ref: 00409ACB
_initterm.MSVCRT ref: 00409ADB
GetStartupInfoA.KERNEL32(?), ref: 00409B1A
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00409B3E
exit.MSVCRT ref: 00409B4E
_XcptFilter.MSVCRT ref: 00409B60

Memory Dump Source

Source File: 00000007.00000002.2741527207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2741511086.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741546097.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741561453.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741600486.000000000042E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741656736.000000000042F000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741672295.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2741838524.0000000000710000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_mssecsvr.jbxd

Yara matches

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction ID: f220c78e044b43db95b39954543cb8470338bddc8e57b6bf74c51ec52977e19a
Opcode Fuzzy Hash: e3007c8091b935f0f6e9b16d849c1c27a397ab206965397834d54df9927598b6
Instruction Fuzzy Hash: AF415E71800348EFDB24DFA4ED45AAA7BB8FB09720F20413BE451A72D2D7786841CB59

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Gn8CvJE07O.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\WINDOWS\qeriuwjhrf (copy)

C:\Windows\tasksche.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Windows Analysis Report
Gn8CvJE07O.dll

Function 00407CE0 Relevance: 50.9, APIs: 18, Strings: 11, Instructions: 175
libraryloaderfileCOMMON

Function 00409A16 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON

Function 00407C40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 54
serviceCOMMON

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Function 00408090 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49
serviceCOMMON

Function 00408140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45
networkCOMMON