Windows Analysis Report
FjYNZSPNkt

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93CF0	4_2_00B93CF0
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B928C8	4_2_00B928C8
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93CC2	4_2_00B93CC2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93C3D	4_2_00B93C3D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93D36	4_2_00B93D36
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93D1F	4_2_00B93D1F
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93D4B	4_2_00B93D4B
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3CF0	4_2_7FEA3CF0
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA28C8	4_2_7FEA28C8
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3CC2	4_2_7FEA3CC2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA4C9E	4_2_7FEA4C9E
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3D4B	4_2_7FEA3D4B
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3C3D	4_2_7FEA3C3D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3D36	4_2_7FEA3D36
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3D1F	4_2_7FEA3D1F
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83CF0	11_2_00A83CF0
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A828C8	11_2_00A828C8
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83CC2	11_2_00A83CC2
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83C3D	11_2_00A83C3D
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83D36	11_2_00A83D36
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83D1F	11_2_00A83D1F
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83D4B	11_2_00A83D4B
Source: C:\Windows\tasksche.exe	Code function: 29_2_00406C40	29_2_00406C40
Source: C:\Windows\tasksche.exe	Code function: 29_2_00402A76	29_2_00402A76
Source: C:\Windows\tasksche.exe	Code function: 29_2_00402E7E	29_2_00402E7E
Source: C:\Windows\tasksche.exe	Code function: 29_2_0040350F	29_2_0040350F
Source: C:\Windows\tasksche.exe	Code function: 29_2_00404C19	29_2_00404C19
Source: C:\Windows\tasksche.exe	Code function: 29_2_0040541F	29_2_0040541F
Source: C:\Windows\tasksche.exe	Code function: 29_2_00403797	29_2_00403797
Source: C:\Windows\tasksche.exe	Code function: 29_2_004043B7	29_2_004043B7
Source: C:\Windows\tasksche.exe	Code function: 29_2_004031BC	29_2_004031BC

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B905F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,	4_2_00B905F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B9042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,	4_2_00B9042D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B9252F NtOpenSection,	4_2_00B9252F
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B92574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	4_2_00B92574
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B92477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	4_2_00B92477
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B9144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_00B9144A
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B924AE lstrcpyW,lstrlenW,NtCreateSection,	4_2_00B924AE
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B933E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_00B933E0
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B91422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_00B91422
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B93405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_00B93405
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA33E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_7FEA33E0
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	4_2_7FEA05F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,	4_2_7FEA24AE
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	4_2_7FEA2477
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	4_2_7FEA2574
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_7FEA144A
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA252F NtOpenSection,	4_2_7FEA252F
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	4_2_7FEA042D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	4_2_7FEA1422
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA3405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	4_2_7FEA3405
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A805F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,	11_2_00A805F2
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A8252F NtOpenSection,	11_2_00A8252F
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A82574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,	11_2_00A82574
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A82477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,	11_2_00A82477
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A8144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,	11_2_00A8144A
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A824AE lstrcpyW,lstrlenW,NtCreateSection,	11_2_00A824AE
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A833E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	11_2_00A833E0
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A8042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,	11_2_00A8042D
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A81422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,	11_2_00A81422
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A83405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,	11_2_00A83405

Source: mssecsvc.exe.2.dr	Static PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: tasksche.exe.6.dr	Static PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: FjYNZSPNkt.dll	Virustotal: Detection: 86%
Source: FjYNZSPNkt.dll	Metadefender: Detection: 78%
Source: FjYNZSPNkt.dll	ReversingLabs: Detection: 96%

Source: FjYNZSPNkt.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\FjYNZSPNkt.dll,PlayGame
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",PlayGame
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
Source: unknown	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\BackgroundTransferHost.exe "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\FjYNZSPNkt.dll,PlayGame	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",PlayGame	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Drops executables to the windows directory (C:\Windows) and starts them

Source: classification engine

Classification label: mal100.rans.troj.evad.winDLL@30/53@2/3

Source: C:\Windows\mssecsvc.exe	Code function: sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,		4_2_00407C40
Source: C:\Windows\tasksche.exe	Code function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,		29_2_00401CE8

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00408090 GetModuleFileNameA,__p___argc,OpenSCManagerA,InternetCloseHandle,OpenServiceA,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherA,

4_2_00408090

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00B905F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,FindCloseChangeNotification,

4_2_00B905F2

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\FjYNZSPNkt.dll,PlayGame

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00407CE0 InternetCloseHandle,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,FindResourceA,LoadResource,LockResource,SizeofResource,sprintf,sprintf,sprintf,MoveFileExA,CreateFileA,WriteFile,CloseHandle,CreateProcessA,CloseHandle,CloseHandle,

4_2_00407CE0

Source: mssecsvc.exe, 00000004.00000000.263749691.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.663555779.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.272335422.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.357943271.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000000.278856067.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000002.384640585.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000002.353674626.000000000040E000.00000008.00000001.01000000.00000008.sdmp

Binary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll

Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
Source: mssecsvc.exe	String found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
Source: mssecsvc.exe	String found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
Source: mssecsvc.exe	String found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
Source: mssecsvc.exe	String found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
Source: mssecsvc.exe	String found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
Source: mssecsvc.exe	String found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
Source: mssecsvc.exe	String found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa

Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\mssecsvc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: FjYNZSPNkt.dll

Static file information: File size 5267459 > 1048576

Source: FjYNZSPNkt.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000

Source: C:\Windows\tasksche.exe	Code function: 29_2_00407710 push eax; ret		29_2_0040773E
Source: C:\Windows\tasksche.exe	Code function: 29_2_004076C8 push eax; ret		29_2_004076E6

Source: mssecsvc.exe.2.dr

Static PE information: section name: hzuevao

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00B93D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,

4_2_00B93D36

Persistence and Installation Behavior

Source: C:\Windows\mssecsvc.exe	Executable created and started: C:\WINDOWS\tasksche.exe			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Executable created and started: C:\WINDOWS\mssecsvc.exe			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\mssecsvc.exe			Jump to dropped file
Source: C:\Windows\mssecsvc.exe	File created: C:\Windows\tasksche.exe			Jump to dropped file

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00407C40 sprintf,OpenSCManagerA,InternetCloseHandle,CreateServiceA,CloseServiceHandle,StartServiceA,CloseServiceHandle,CloseServiceHandle,

4_2_00407C40

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may execute only at specific dates)

Source: C:\Windows\mssecsvc.exe

Evasive API call chain: GetSystemTime,DecisionNodes,Sleep

graph_11-2539

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Windows\mssecsvc.exe	Special instruction interceptor: First address: 0000000000A718B2 instructions caused by: Self-modifying code
Source: C:\Windows\mssecsvc.exe	Special instruction interceptor: First address: 0000000000A6B1E4 instructions caused by: Self-modifying code

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B94178	4_2_00B94178
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA4178	4_2_7FEA4178
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A84178	11_2_00A84178

Source: C:\Windows\System32\svchost.exe TID: 480	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 468	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\mssecsvc.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_11-2539

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00B9042D rdtsc

4_2_00B9042D

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\mssecsvc.exe

API coverage: 10.0 %

Source: C:\Windows\mssecsvc.exe

Code function: 11_2_00A84178

11_2_00A84178

Source: C:\Windows\mssecsvc.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@vmicvss
Source: backgroundTaskHost.exe, 00000024.00000000.543434763.000001D426613000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 6post:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106554&TID=700342084&CID=128000000001392709&BID=1423522069&PG=PC000P0FR5.0000000IQ8&TPID=425106554&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=1&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=dd1a8e84fd1343a98117c17a02a03b24&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFDwI
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicheartbeat
Source: svchost.exe, 00000021.00000002.817775099.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
Source: backgroundTaskHost.exe, 00000024.00000003.521646632.000001D426635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=62f7fc83080b4ea4bc961e27c15af7da&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time={DATETIME}&asid={ASID}&eid={EID}"}]},"class":"content","items":DMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD":[{\"appPackageFamilyName\":\"ROBLOXCorporation.ROBLOX_55nm5eh3cm0pr\",\"entityId\":\"B_9NBLGGGZM6WM\",\"skuId\":\"0010\",\"productId\":\"9NBLGGGZM6WM\",\"applicationId\":\"ROBLOXCorporation.ROBLOX_55nm5eh3cm0pr!App\",\"options\":4,\"packageRelativeAppId\":\"App\",\"properties\":{\"storeCampaignId\":{\"text\":\"msft_1\"},\"installApp\":{\"bool\":false},\"installDelay\":{\"text\":\"medium\"},\"swapStartTile\":{\"event\":\"pin\",\"parameters\":{},\"action\":\"swapStartTile\"},\"displayName\":{\"text\":\"Roblox\"},\"phoneticName\":{\"text\":\"Roblox\"},\"packageSize\":{\"number\":143466514.0},\"launchStore\":{\"event\":\"clic
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@Block any inbound traffic for vmicvss
Source: mssecsvc.exe	Binary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~3
Source: mssecsvc.exe, 00000004.00000000.263749691.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.663555779.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.272335422.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.357943271.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000000.278856067.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000002.384640585.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000002.353692061.0000000000410000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
Source: svchost.exe, 00000021.00000002.817775099.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
Source: mssecsvc.exe, 00000006.00000002.361347885.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000006.00000002.361889160.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.315005780.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000000.311930287.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000018.00000002.795555976.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.681887539.000001FF10C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.679528785.000001FF0B429000.00000004.00000020.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.388870583.0000019B7D338000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.353158659.0000019B7D325000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000002.542897680.0000019B7D338000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: dwm.exe, 0000001B.00000002.813088603.000002C6305D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: backgroundTaskHost.exe, 00000024.00000003.562504340.000001D426635000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=62f7fc83080b4ea4bc961e27c15af7da&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time={DATETIME}&asid={ASID}&eid={EID}"}]},"class":"content","items":EG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD","reuseCount":-1,"requiresNetwork":0,"expireTime":"2023-07-20T15:50:55","rotationPeriod":31536000}\"event\":\"pin\",\"parameters\":{},\"action\":\"swapStartTile\"},\"displayName\":{\"text\":\"Roblox\"},\"phoneticName\":{\"text\":\"Roblox\"},\"packageSize\":{\"number\":143466514.0},\"launchStore\":{\"event\":\"click\",\"parameters\":{\"uri\":\"ms-windows-store://pdp/?productid=9nblgggzm6wm&ocid=ems.dco.startprogrammable&ccid=62f7fc8
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ng-MPSS$@vmicheartbeat-allow-in-1nOnly
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicvss
Source: backgroundTaskHost.exe, 00000024.00000000.543434763.000001D426613000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=62f7fc83080b4ea4bc961e27c15af7da&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&bSrc=i.t&time={DATETIME}&asid={ASID}&eid={EID}"}]},"class":"content","items":EG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD","reuseCount":-1,"requiresNetwork":0,"expireTime":"2023-07-20T15:50:55","rotationPeriod":31536000}\"event\":\"pin\",\"parameters\":{},\"action\":\"swapStartTile\"},\"displayName\":{\"text\":\"Roblox\"},\"phoneticName\":{\"text\":\"Roblox\"},\"packageSize\":{\"number\":143466514.0},\"launchStore\":{\"event\":\"click\",\"parameters\":{\"uri\":\"ms-windows-store://pdp/?productid=9nblgggzm6wm&ocid=ems.dco.startprogrammable&ccid=62f7fc8
Source: svchost.exe, 00000021.00000002.817775099.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@vmicheartbeat
Source: svchost.exe, 00000023.00000002.800948618.000002418A629000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
Source: mssecsvc.exe, 00000004.00000000.263749691.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.663555779.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000000.272335422.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000006.00000002.357943271.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000000.278856067.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000002.384640585.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000002.353692061.0000000000410000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: W$N.@vmicheartbeat-block-out
Source: backgroundTaskHost.exe, 00000024.00000003.544877796.000001D426A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD\",\"reuseCount\":-1,\"requiresNetwork\":0,\"expireTime\":\"2023-07-20T15:50:55\",\"rotationPeriod\":31536000}}"}],"refreshtime":"2022-07-27T15:50:55"}}
Source: svchost.exe, 00000010.00000000.306971509.0000025CB586C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@Block any other inbound traffic for vmicheartbeat
Source: svchost.exe, 00000021.00000002.817775099.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`0~l
Source: svchost.exe, 00000010.00000000.306971509.0000025CB586C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicshutdown
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicshutdown-block-out
Source: backgroundTaskHost.exe, 00000024.00000000.467119785.000001D4240CE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: post:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=230696396&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=2&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=62f7fc83080b4ea4bc961e27c15af7da&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@vmicheartbeat-block-in
Source: backgroundTaskHost.exe, 00000024.00000000.523479263.000001D4267A6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: {"_id":"B_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L","startTime":"2019-05-25T00:30:00","_imp":"post:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=230696396&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=2&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=62f7fc83080b4ea4bc961e27c15af7da&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD","reuseCount":-1,"requiresNetwork":0,"expireTime":"2023-07-20T15:50:55","rotationPeriod":31536000}"
Source: svchost.exe, 0000001A.00000002.793791069.000001B8BFC49000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat-allow-out
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ,@Allow inbound TCP port 389 traffic for vmicheartbeat
Source: backgroundTaskHost.exe, 00000024.00000000.543434763.000001D426613000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Qpost:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=230696396&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=2&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=62f7fc83080b4ea4bc961e27c15af7da&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFDementTyf
Source: backgroundTaskHost.exe, 00000024.00000003.525688768.000001D42694B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MNVMWARE%2&OE
Source: svchost.exe, 00000010.00000000.306971509.0000025CB586C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@vmicvss-block-in
Source: lsass.exe, 00000009.00000002.798535635.00000240B2694000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: backgroundTaskHost.exe, 00000024.00000003.505466351.000001D426A18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"_id":"B_9NBLGGGZM6WM_9WZDNCRFHWD2_9NH2GPH4JZS4_9NBLGGH6J6VK_9P6RC76MSMMJ_9WZDNCRFJ27N_9N0866FS04W8_9WZDNCRFJ10M_9WZDNCRFJ140_9NC2FBTHCJV8_9NBLGGH1CQ7L","startTime":"2019-05-25T00:30:00","_imp":"post:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=230696396&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=2&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=62f7fc83080b4ea4bc961e27c15af7da&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD","reuseCount":-1,"requiresNetwork":0,"expireTime":"2023-07-20T15:50:55","rotationPeriod":31536000}
Source: backgroundTaskHost.exe, 00000024.00000000.467119785.000001D4240CE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: post:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106554&TID=700342084&CID=128000000001392709&BID=1423522069&PG=PC000P0FR5.0000000IQ8&TPID=425106554&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=1&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=dd1a8e84fd1343a98117c17a02a03b24&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@Allow outbound TCP traffic for vmicheartbeat
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@vmicheartbeat
Source: dwm.exe, 0000001B.00000002.813088603.000002C6305D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000Y
Source: svchost.exe, 00000010.00000000.300104611.0000025CB5036000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmicshutdown
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@Block any inbound traffic for vmicshutdown
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@Block any outbound traffic for vmicvss
Source: backgroundTaskHost.exe, 00000024.00000000.467119785.000001D4240CE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: post:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106554&TID=700342084&CID=128000000001392709&BID=1423522069&PG=PC000P0FR5.0000000IQ8&TPID=425106554&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID={ASID}&TIME={DATETIME}&SLOT=1&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=dd1a8e84fd1343a98117c17a02a03b24&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE_DS=50583&CACHE_FS=32089&CACHE_SC=6&WPX=1&HPX=1&TIME=20220720T155045Z&PL=EN-US&CTMODE=MULTISESSION&ARCH=X64&CDMVER=10.0.17134.1&DEVFAM=WINDOWS.DESKTOP&DEVFORM=UNKNOWN&DISPHORZRES=1280&DISPSIZE=17.1&DISPVERTRES=1024&ISU=0&METERED=FALSE&NETTYPE=ETHERNET&NPID=SC-314559&OEMNAME=VMWARE%2C%20INC.&OEMID=VMWARE%2C%20INC.&OSSKU=PROFESSIONAL&SMBIOSDM=VMWARE7%2C1&TL=2&TSU=1611218&WAASBLDFLT=1&WAASCFGEXP=1&WAASCFGSET=1&WAASRETAIL=1&WAASRING=&CHNL=CFD0,"requ
Source: lsass.exe, 00000009.00000002.792607879.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.275771857.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.285123785.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.791962737.000002DDC763D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.795563189.000001F18B868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.791833204.0000022B27E29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.390460408.000002C301E2D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.791425086.000002C301E2D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.799675705.00000247D1CB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.395952690.00000247D1CB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.801576045.000002418A63F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: backgroundTaskHost.exe, 00000024.00000000.557062800.000001D4264FD000.00000004.00000020.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000024.00000000.587020146.000001D4264FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Lx&
Source: lsass.exe, 00000009.00000002.798535635.00000240B2694000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ,@vmicvss-block-out
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@vmicshutdown-block-in
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@vmicheartbeat-allow-in-2
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ,@Allow inbound TCP port 636 traffic for vmicheartbeat
Source: svchost.exe, 00000019.00000002.682002593.000001FF10C64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000010.00000000.300104611.0000025CB5036000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@vmicheartbeat
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@vmicheartbeat
Source: svchost.exe, 0000000E.00000002.788049235.000002DDC7602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: lsass.exe, 00000009.00000002.798535635.00000240B2694000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: mssecsvc.exe	Binary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Driver
Source: svchost.exe, 00000021.00000002.817775099.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
Source: backgroundTaskHost.exe, 0000001C.00000000.356343583.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.342288131.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.360482512.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.351846295.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.347247275.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.387936226.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.383393856.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.370724756.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.392409764.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.378513051.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@Block any other outbound traffic for vmicheartbeat
Source: lsass.exe, 00000009.00000000.285583942.00000240B2669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.275907393.00000240B2669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.796622060.00000240B2669000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V Adm B
Source: svchost.exe, 00000010.00000000.300104611.0000025CB5036000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @vmicheartbeat
Source: svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: ,@Block any outbound traffic for vmicshutdown

Source: C:\Windows\mssecsvc.exe

4_2_00B93D36

Source: C:\Windows\tasksche.exe

Code function: 29_2_004029CC free,GetProcessHeap,HeapFree,

29_2_004029CC

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00B9042D rdtsc

4_2_00B9042D

Source: C:\Windows\mssecsvc.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\mssecsvc.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B905F2 mov eax, dword ptr fs:[00000030h]	4_2_00B905F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B9042D mov eax, dword ptr fs:[00000030h]	4_2_00B9042D
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_00B9025E mov edx, dword ptr fs:[00000030h]	4_2_00B9025E
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]	4_2_7FEA05F2
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]	4_2_7FEA025E
Source: C:\Windows\mssecsvc.exe	Code function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]	4_2_7FEA042D
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A805F2 mov eax, dword ptr fs:[00000030h]	11_2_00A805F2
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A8042D mov eax, dword ptr fs:[00000030h]	11_2_00A8042D
Source: C:\Windows\mssecsvc.exe	Code function: 11_2_00A8025E mov edx, dword ptr fs:[00000030h]	11_2_00A8025E

Source: C:\Windows\mssecsvc.exe

Process queried: DebugPort

Maps a DLL or memory area into another process

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\winlogon.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\lsass.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\dwm.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\System32\backgroundTaskHost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: unknown protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\reytVt target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\winlogon.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\lsass.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Section loaded: \BaseNamedObjects\npbtVt target: C:\Windows\System32\dwm.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 19B7D740000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D426310000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D426310000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D426310000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Windows\System32\backgroundTaskHost.exe base: 1D423FC0000	Jump to behavior

Changes memory attributes in foreign processes to executable or writable

Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E99D0 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA120 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9670 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9A50 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773E9830 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\mssecsvc.exe	Memory protected: unknown base: 773EA040 protect: page execute and read and write	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Windows\mssecsvc.exe

Thread created: unknown EIP: 7FFF3C38

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1

Changes security center settings (notifications, updates, antivirus, firewall)

Source: dwm.exe, 0000001B.00000000.350379771.000002C633456000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000001B.00000002.837380196.000002C633456000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 00000007.00000002.805790920.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.282392035.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.272638752.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000007.00000002.805790920.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.282392035.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.272638752.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000007.00000002.805790920.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.282392035.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.272638752.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager,
Source: winlogon.exe, 00000007.00000002.805790920.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.282392035.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000000.272638752.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\a55f2be5f0b941e987b5cade10ae9cb7_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\c174b4f911d842a39252a6b31960e6c8_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\b9de0c2b2b3648e8a125cac302df5505_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658332418 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658332418 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658332419 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658332423 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\632e00fad280a96729794f359a66b17a2dc39681bc37311dad989871bd234e0c VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\95d06b98be181b45e9ff457bef9e40c387a9c0bbc5b2f9c66c20cd5c2ec94d0c VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\2f08b9969a984767a36345d102e1c84e2fcfd54da755a2d98b6fe62b3330d53a VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\20a965134266d21288385fdc62819121648b69cc26f87e618a979d435d7547ac VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658332433 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\6bce4edafa1d5562be892960e9a791e50699ffe57ea4fcf4b5b5456308a2e95f VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\842e4e4ad8e41e6a893a996baa08c061072d3b11c57f83bbc8f6b5992f9c5613 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\cbc20ba0195f823c2fea772005e771d5a040a705e7ba53a6725db96426511b39 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\098847447c33ddf8f805abd62099314078d2782a710a881d2548ac395a48ce9f VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\83a4606a9c604ec59350c94231b7a4ff_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\2f9298d8ab8f4c23885c30ea9b373c83_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\361920c594c1482591c08f3c6c53d03d_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\2b5e800dda5d4fe0804933c66ff1142b_1 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\backgroundTaskHost.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\098c5115fc7f4ab9959905b886004365_1 VolumeInformation	Jump to behavior

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00B9388E GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,

4_2_00B9388E

Source: C:\Windows\mssecsvc.exe

Code function: 4_2_00B9042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,

4_2_00B9042D

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000016.00000002.792433509.000001FA92C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000021.00000000.399456497.00000247D314C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.812507836.00000247D314C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: "@C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 00000021.00000002.817216854.00000247D368E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.400929134.00000247D368E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.401142709.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
Source: svchost.exe, 00000021.00000000.401142709.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.817775099.00000247D36C5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\device\harddiskvolume4\program files\windows defender\msmpeng.exe
Source: svchost.exe, 00000021.00000002.817216854.00000247D368E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.400929134.00000247D368E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.400308692.00000247D3613000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
Source: svchost.exe, 00000021.00000002.807269952.00000247D3000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: .@C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 00000021.00000000.399456497.00000247D314C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.812507836.00000247D314C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: *@C:\Program Files\Windows Defender\MsMpEng.exe
Source: svchost.exe, 00000016.00000002.794012016.000001FA92D02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: mssecsvc.exe, mssecsvc.exe, 0000000B.00000000.278856067.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000B.00000002.384640585.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001D.00000002.353692061.0000000000410000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
Source: mssecsvc.exe	Binary or memory string: 8\Device\HarddiskVolume2\Program Files\AVG\Av\avgcmgr.exe
Source: svchost.exe, 00000021.00000002.807269952.00000247D3000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.397661101.00000247D3000000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: $@C:\Program Files\Windows Defender\MsMpEng.exe

Stealing of Sensitive Information

Yara detected Virut

Source: Yara match	File source: 11.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000000.314054124.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.784858800.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.784858660.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.388703492.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.785329108.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.384952230.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.427531330.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.392931300.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.784858398.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.283233215.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.665288410.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.785379244.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.275433265.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.302543511.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.431362516.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.298581179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.297399320.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.300859546.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.785172242.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321636086.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321813327.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.785061929.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.319687483.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.785023367.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.784858957.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.280733139.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.785329413.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.785042903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.784832443.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.435545169.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321645741.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.785141452.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.785409783.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.280760913.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.302520549.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.298527592.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321842635.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.270789242.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.665390921.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.785106286.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.310448882.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.388561725.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.319657354.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785307990.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.296758568.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.785177108.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.290186231.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.389181031.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.784858725.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.407443351.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.300842077.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.667969815.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.785185973.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.784853909.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.785122913.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.411115059.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.280492982.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.785080117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.296737411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lsass.exe PID: 612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwm.exe PID: 984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 960, type: MEMORYSTR

Remote Access Functionality

Yara detected Virut

Source: Yara match	File source: 11.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000000.314054124.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.784858800.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.784858660.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.388703492.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.785329108.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000000.384952230.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.427531330.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000000.392931300.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.784858398.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.283233215.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.665288410.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.785379244.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.275433265.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.302543511.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000000.431362516.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.298581179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.297399320.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.300859546.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.785172242.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321636086.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321813327.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.785061929.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.319687483.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.785023367.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.784858957.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.280733139.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.785329413.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.785042903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.784832443.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.435545169.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321645741.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.785141452.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.785409783.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.280760913.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.302520549.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.298527592.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000000.321842635.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.270789242.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.665390921.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.785106286.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000000.310448882.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.388561725.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000000.319657354.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.785307990.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.296758568.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.785177108.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.290186231.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.389181031.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.784858725.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000000.407443351.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.300842077.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.667969815.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.785185973.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.784853909.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.785122913.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.411115059.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.280492982.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.785080117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.296737411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winlogon.exe PID: 572, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lsass.exe PID: 612, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: mssecsvc.exe PID: 6580, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontdrvhost.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 804, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dwm.exe PID: 984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 316, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 960, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	11 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	12 Native API	4 Windows Service	4 Windows Service	1 Obfuscated Files or Information	LSASS Memory	123 System Information Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	412 Process Injection	1 Software Packing	Security Account Manager	371 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Service Execution	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	3 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	412 Process Injection	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FjYNZSPNkt.dll	86%	Virustotal		Browse
FjYNZSPNkt.dll	78%	Metadefender		Browse
FjYNZSPNkt.dll	96%	ReversingLabs	Win32.Ransomware.WannaCry
FjYNZSPNkt.dll	100%	Avira	W32/Virut.Gen
FjYNZSPNkt.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\mssecsvc.exe	100%	Avira	W32/Virut.Gen
C:\Windows\tasksche.exe	100%	Avira	TR/FileCoder.AU
C:\Windows\mssecsvc.exe	100%	Joe Sandbox ML
C:\Windows\tasksche.exe	100%	Joe Sandbox ML
C:\Windows\mssecsvc.exe	97%	ReversingLabs	Win32.Ransomware.WannaCry
C:\Windows\tasksche.exe	85%	Metadefender		Browse
C:\Windows\tasksche.exe	95%	ReversingLabs	Win32.Ransomware.WannaCry

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.0.mssecsvc.exe.400000.6.unpack	100%	Avira	W32/Virut.Gen	Download File
4.2.mssecsvc.exe.7100a4.1.unpack	100%	Avira	TR/FileCoder.AU	Download File
29.0.tasksche.exe.400000.0.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.7100a4.5.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.7100a4.1.unpack	100%	Avira	TR/FileCoder.AU	Download File
11.0.mssecsvc.exe.7100a4.1.unpack	100%	Avira	TR/FileCoder.AU	Download File
4.2.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
6.2.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.400000.2.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.400000.4.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.7100a4.5.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.7100a4.7.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.400000.2.unpack	100%	Avira	W32/Virut.Gen	Download File
4.0.mssecsvc.exe.7100a4.7.unpack	100%	Avira	TR/FileCoder.AU	Download File
4.0.mssecsvc.exe.7100a4.1.unpack	100%	Avira	TR/FileCoder.AU	Download File
11.2.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
6.0.mssecsvc.exe.7100a4.3.unpack	100%	Avira	TR/FileCoder.AU	Download File
29.2.tasksche.exe.400000.0.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
6.2.mssecsvc.exe.7100a4.1.unpack	100%	Avira	TR/FileCoder.AU	Download File
4.0.mssecsvc.exe.7100a4.3.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.400000.4.unpack	100%	Avira	W32/Virut.Gen	Download File
11.0.mssecsvc.exe.400000.0.unpack	100%	Avira	W32/Virut.Gen	Download File
11.2.mssecsvc.exe.7100a4.1.unpack	100%	Avira	TR/FileCoder.AU	Download File
6.0.mssecsvc.exe.400000.6.unpack	100%	Avira	W32/Virut.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	12%	Virustotal		Browse
dual-a-0001.a-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	100%	URL Reputation	malware
https://www.bing.c	0%	Avira URL Cloud	safe
https://ris.a	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x	100%	Avira URL Cloud	malware
http://pki.goog/repo/certs/gtsr1.der04	0%	URL Reputation	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	100%	URL Reputation	malware
https://ris.api8.	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/l	100%	Avira URL Cloud	malware
https://www.bing.cpi/v	0%	Avira URL Cloud	safe
https://ris.api.iris.micr	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwer	100%	Avira URL Cloud	malware
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comC	0%	Avira URL Cloud	safe
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	0%	URL Reputation	safe
https://store-images.s-micros	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://crl.pki.goog/gtsr1/gtsr1.crl0W	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://ris.iris.mi	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
https://www.kryptoslogic.com	0%	URL Reputation	safe
https://arc.msn.coP	0%	Avira URL Cloud	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	104.16.173.80	true	true	12%, Virustotal, Browse	unknown
dual-a-0001.a-msedge.net	204.79.197.200	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000014.00000002.328766521.000001C91F63C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000014.00000002.328766521.000001C91F63C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bing.c	backgroundTaskHost.exe, 0000001C.00000000.356343583.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.342288131.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.360482512.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.351846295.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.347247275.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.387936226.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.383393856.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.370724756.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.392409764.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.378513051.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.365406036.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000014.00000003.325657488.000001C91F648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.329211076.000001C91F64F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ris.a	backgroundTaskHost.exe, 00000024.00000003.530398223.000001D4241D8000.00000004.00000020.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000024.00000003.565308249.000001D426696000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/reminderper	backgroundTaskHost.exe, 0000001C.00000000.356343583.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.342288131.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.360482512.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.351846295.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.347247275.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.387936226.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.383393856.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.370724756.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.392409764.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.378513051.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000002.528374745.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.365406036.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000014.00000002.328783143.000001C91F642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325819454.000001C91F641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/x	mssecsvc.exe, 00000006.00000002.361347885.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pki.goog/repo/certs/gtsr1.der04	lsass.exe, 00000009.00000000.276000241.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.799419871.00000240B26AA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.285841175.00000240B2694000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000014.00000003.325716393.000001C91F659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.329272939.000001C91F65A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	mssecsvc.exe, 0000000B.00000000.278777531.000000000040F000.00000008.00000001.01000000.00000004.sdmp	true	URL Reputation: malware	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ris.api8.	backgroundTaskHost.exe, 00000024.00000003.530398223.000001D4241D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000014.00000002.328783143.000001C91F642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325819454.000001C91F641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/l	mssecsvc.exe, 00000006.00000002.361347885.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.bing.cpi/v	backgroundTaskHost.exe, 0000001C.00000000.356343583.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.342288131.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.360482512.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.351846295.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.347247275.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.387936226.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.383393856.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.370724756.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.392409764.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.378513051.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.365406036.0000019B7B67C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ris.api.iris.micr	backgroundTaskHost.exe, 00000024.00000000.562702503.000001D426A91000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.com	svchost.exe, 00000021.00000000.396028620.00000247D1CC9000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.800444003.00000247D1CC9000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/22www.iuqerfsodp9ifjaposdfjhgosurijfaewrwer	mssecsvc.exe, 00000006.00000002.361347885.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comC	mssecsvc.exe, 00000006.00000002.361347885.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 00000014.00000002.326573506.000001C91F613000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000014.00000002.328766521.000001C91F63C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ	mssecsvc.exe, 00000004.00000002.663004539.000000000019C000.00000004.00000010.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000014.00000003.325809499.000001C91F656000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store-images.s-micros	backgroundTaskHost.exe, 00000024.00000000.543434763.000001D426613000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000014.00000002.328766521.000001C91F63C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000014.00000003.325809499.000001C91F656000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000019.00000002.682240230.000001FF10C87000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000014.00000002.329316521.000001C91F65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325640899.000001C91F65C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.pki.goog/gtsr1/gtsr1.crl0W	lsass.exe, 00000009.00000000.276000241.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.799419871.00000240B26AA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.285841175.00000240B2694000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000014.00000002.328766521.000001C91F63C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.326573506.000001C91F613000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pki.goog/repository/0	lsass.exe, 00000009.00000000.276000241.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000002.799419871.00000240B26AA000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000009.00000000.285841175.00000240B2694000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://%s.xboxlive.com	svchost.exe, 00000011.00000002.793454097.000001F18B83E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000014.00000003.325657488.000001C91F648000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.329211076.000001C91F64F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000014.00000002.328783143.000001C91F642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325819454.000001C91F641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ris.iris.mi	backgroundTaskHost.exe, 00000024.00000003.530398223.000001D4241D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000014.00000002.329316521.000001C91F65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325640899.000001C91F65C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pf.directory.live.com/profile/profile.asmx	backgroundTaskHost.exe, 0000001C.00000000.370554204.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.356234041.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.392348693.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.387781701.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.365252597.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000002.527484605.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.383213238.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.341995914.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.351629179.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.347111414.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.360350565.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 0000001C.00000000.378318070.0000019B7B628000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000014.00000003.325809499.000001C91F656000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000014.00000002.328783143.000001C91F642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325819454.000001C91F641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325767665.000001C91F640000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.kryptoslogic.com	mssecsvc.exe, 00000006.00000002.361889160.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000014.00000002.329316521.000001C91F65D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.325640899.000001C91F65C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000011.00000002.793454097.000001F18B83E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://arc.msn.coP	backgroundTaskHost.exe, 00000024.00000000.586901114.000001D4264CC000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000024.00000000.448289508.000001D4264CC000.00000004.00000001.00020000.00000000.sdmp, backgroundTaskHost.exe, 00000024.00000000.520676657.000001D4264CC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000014.00000003.325617470.000001C91F65F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 00000011.00000002.793454097.000001F18B83E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000014.00000003.325716393.000001C91F659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.329272939.000001C91F65A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.16.173.80	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	United States		13335	CLOUDFLARENETUS	true
104.17.244.81	unknown	United States		13335	CLOUDFLARENETUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	670186
Start date and time: 20/07/202217:49:48	2022-07-20 17:49:48 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	FjYNZSPNkt (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	18
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.evad.winDLL@30/53@2/3
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 29.3% (good quality ratio 26.6%) Quality average: 77.2% Quality standard deviation: 32.4%
HCA Information:	Successful, ratio: 81% Number of executed functions: 22 Number of non-executed functions: 99
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 20.40.129.122, 23.213.164.66, 20.40.136.238, 20.31.106.135, 20.238.103.94, 8.238.85.126, 67.26.139.254, 67.26.73.254, 8.248.131.254, 8.238.85.254
Excluded domains from analysis (whitelisted): fmghaw.com, wxqeub.com, egzhiu.com, odkwag.com, taseju.com, foefmh.com, fnkuzp.com, oyiqis.com, fs-wildcard.microsoft.com.edgekey.net, halijb.com, pamieb.com, veadit.com, bixitk.com, tarnof.com, eunure.com, uuvznv.com, iigysp.com, wzzoyp.com, www.bing.com, iris-de-prod-azsc-frc-b.francecentral.cloudapp.azure.com, uehixu.com, gveozl.com, ris-prod.trafficmanager.net, nsnpie.com, ouuquq.com, pbswoe.com, ris.api.iris.microsoft.com, imeonl.com, swihwi.com, kvzuyb.com, iegroa.com, zajvof.com, kkujyi.com, ieuydr.com, fg.download.windowsupdate.com.c.footprint.net, evcswy.com, ipffhg.com, dlaiin.com, cjtnlz.com, ryeofz.com, pzrdea.com, iris-de-prod-azsc-weu.westeurope.cloudapp.azure.com, arc.trafficmanager.net, bjnyie.com, prod.fs.microsoft.com.akadns.net, hmogya.com, naciyn.com, juiape.com, oyjapg.com, tqrihq.com, ant.trenz.pl, daufsi.com, fmleqf.com, iuzrbo.com, wu-bg-shim.trafficmanager.net, riwegs.com, kdbimr.com, xnynlv.com, wwflce.com, ryrgex.com, lbhuwa.com, pjyjyp.
Execution Graph export aborted for target tasksche.exe, PID 3908 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:51:07	API Interceptor	1x Sleep call for process: loaddll32.exe modified
17:51:31	API Interceptor	3x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.16.173.80	q18L3fXHcX.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	fPFPnWqeow.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	25HrP4nB7z.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	qeoYR80875.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	0AoAuUD0hv.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	GRse5xOyWS.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	1Pf340IWZT.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	Cw6bTawfPR.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	lF88TMoBXK.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	EQ6oxEN381.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	vR5qE3L7ow.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	mqGD2k04wg.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	5CzpLpyDvs.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	X3vbdqFLUr.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	V5E1THfAvp.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	TfN4L9J5dc.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	SDpiC5bJDG.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	SRm1E5EfSU.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	n321zWdF9X.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
	WF68F77LLw.dll	Get hash	malicious	Browse	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	q18L3fXHcX.dll	Get hash	malicious	Browse	104.17.244.81
	fPFPnWqeow.dll	Get hash	malicious	Browse	104.16.173.80
	GH3Nse733b.dll	Get hash	malicious	Browse	104.17.244.81
	3zkECrUffH.dll	Get hash	malicious	Browse	104.17.244.81
	25HrP4nB7z.dll	Get hash	malicious	Browse	104.17.244.81
	qeoYR80875.dll	Get hash	malicious	Browse	104.17.244.81
	0AoAuUD0hv.dll	Get hash	malicious	Browse	104.16.173.80
	2RjU5Sgppd.dll	Get hash	malicious	Browse	104.17.244.81
	Jj29gnNYzx.dll	Get hash	malicious	Browse	104.17.244.81
	GRse5xOyWS.dll	Get hash	malicious	Browse	104.16.173.80
	1Pf340IWZT.dll	Get hash	malicious	Browse	104.17.244.81
	Cw6bTawfPR.dll	Get hash	malicious	Browse	104.17.244.81
	lF88TMoBXK.dll	Get hash	malicious	Browse	104.16.173.80
	EQ6oxEN381.dll	Get hash	malicious	Browse	104.16.173.80
	vR5qE3L7ow.dll	Get hash	malicious	Browse	104.17.244.81
	DlxI9O90Df.dll	Get hash	malicious	Browse	104.17.244.81
	45Aq5PJ7wy.dll	Get hash	malicious	Browse	104.17.244.81
	6kocFOY6i7.dll	Get hash	malicious	Browse	104.16.173.80
	mqGD2k04wg.dll	Get hash	malicious	Browse	104.16.173.80
	lpETIMKCTG.dll	Get hash	malicious	Browse	104.17.244.81

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	uZqCEvStF9.dll	Get hash	malicious	Browse	104.29.91.176
	Purchase order #44827.docx	Get hash	malicious	Browse	104.18.183.224
	JVjvJDcyo7.dll	Get hash	malicious	Browse	172.68.168.51
	Details5621Opuqhzrxqhaycmmxkaywlkktoonbomxuaj.exe	Get hash	malicious	Browse	162.159.134.233
	fPFPnWqeow.dll	Get hash	malicious	Browse	104.17.244.81
	Purchase order #44827.docx	Get hash	malicious	Browse	104.18.183.224
	GH3Nse733b.dll	Get hash	malicious	Browse	104.17.244.81
	PO-AM2207586.xlsx	Get hash	malicious	Browse	188.114.96.3
	3zkECrUffH.dll	Get hash	malicious	Browse	104.17.244.81
	25HrP4nB7z.dll	Get hash	malicious	Browse	104.17.244.81
	Halkbank_Ekstre_201805002_103141_273160.pdf.exe	Get hash	malicious	Browse	104.18.115.97
	38grJ6wbWq.html	Get hash	malicious	Browse	104.17.8.210
	SecuriteInfo.com.VBA.Logan.3458.3825.xls	Get hash	malicious	Browse	104.18.182.224
	n_message-audio.htm	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.VBA.Logan.3458.27204.xls	Get hash	malicious	Browse	104.18.183.224
	https://nationalgiveawaypr9.editorx.io/my-site	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.VBA.Logan.3458.3825.xls	Get hash	malicious	Browse	104.18.183.224
	SecuriteInfo.com.VBA.Logan.3458.27204.xls	Get hash	malicious	Browse	104.18.183.224
	http://tracking.vedupdate.com/tracking/click?d=1k1ihPA66PZCuLWj2723CooG7W1qjCbMOZOaHhQFcoxVzieX6RuPHWcWVjdWtiqrru39deCSQ5gZar-DUza0TNM9U7eEkZG_PvwrPBZZyFuGPyiAlKaWhLJA70sXmkQDSk0f0t_0S__n0XK04eiBxuyCnAEjGo-rhlykrsxPG6M0OIeGNUinOr309LpQGOVu9w2	Get hash	malicious	Browse	104.22.24.131
	0NoB6NOrRp.exe	Get hash	malicious	Browse	23.227.38.74
CLOUDFLARENETUS	uZqCEvStF9.dll	Get hash	malicious	Browse	104.29.91.176
	Purchase order #44827.docx	Get hash	malicious	Browse	104.18.183.224
	JVjvJDcyo7.dll	Get hash	malicious	Browse	172.68.168.51
	Details5621Opuqhzrxqhaycmmxkaywlkktoonbomxuaj.exe	Get hash	malicious	Browse	162.159.134.233
	fPFPnWqeow.dll	Get hash	malicious	Browse	104.17.244.81
	Purchase order #44827.docx	Get hash	malicious	Browse	104.18.183.224
	GH3Nse733b.dll	Get hash	malicious	Browse	104.17.244.81
	PO-AM2207586.xlsx	Get hash	malicious	Browse	188.114.96.3
	3zkECrUffH.dll	Get hash	malicious	Browse	104.17.244.81
	25HrP4nB7z.dll	Get hash	malicious	Browse	104.17.244.81
	Halkbank_Ekstre_201805002_103141_273160.pdf.exe	Get hash	malicious	Browse	104.18.115.97
	38grJ6wbWq.html	Get hash	malicious	Browse	104.17.8.210
	SecuriteInfo.com.VBA.Logan.3458.3825.xls	Get hash	malicious	Browse	104.18.182.224
	n_message-audio.htm	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.VBA.Logan.3458.27204.xls	Get hash	malicious	Browse	104.18.183.224
	https://nationalgiveawaypr9.editorx.io/my-site	Get hash	malicious	Browse	104.17.25.14
	SecuriteInfo.com.VBA.Logan.3458.3825.xls	Get hash	malicious	Browse	104.18.183.224
	SecuriteInfo.com.VBA.Logan.3458.27204.xls	Get hash	malicious	Browse	104.18.183.224
	http://tracking.vedupdate.com/tracking/click?d=1k1ihPA66PZCuLWj2723CooG7W1qjCbMOZOaHhQFcoxVzieX6RuPHWcWVjdWtiqrru39deCSQ5gZar-DUza0TNM9U7eEkZG_PvwrPBZZyFuGPyiAlKaWhLJA70sXmkQDSk0f0t_0S__n0XK04eiBxuyCnAEjGo-rhlykrsxPG6M0OIeGNUinOr309LpQGOVu9w2	Get hash	malicious	Browse	104.22.24.131
	0NoB6NOrRp.exe	Get hash	malicious	Browse	23.227.38.74

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.2494772344026733
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4B:BJiRdwfu2SRU4B
MD5:	DEC059FD9745A1CE2C52D3204F8733E1
SHA1:	5A3D91EBDC56D75F80FDAADA1B7C3950080B15CD
SHA-256:	90EA7B989F684CF4EAF221C686C1E17A20C05E7CFD2E3EA6841A5DD99854D19D
SHA-512:	DDD20C0D7ECB5BED28BF6979E2AF568134097114FFAB91EE9A3795C68E1BDAD459EEE4EA28598538F0C6A2C38732FAC47137E437A30753AA0EFDF6964EEF9F50
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x20b281b8, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2507098173884764
Encrypted:	false
SSDEEP:	384:A8E8I+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:AfySB2nSB2RSjlK/+mLesOj1J2
MD5:	C2792AE423918088E4AFFAC562B38DC6
SHA1:	2C08648EEC0846C9F6607BD18687FF0F43A51787
SHA-256:	82FCFD75558D9C206131E7A1804CE77CE7E5C3D41248CDD707774186D1B58980
SHA-512:	C9605F0B9E8AD7BD8B38F946CD93AE1338C9C4D4703C5C725CEFE387D4573DDCFEC8D9A644143B5B87133387EC2AC8645AE03A8FC3C783411D2029638B302324
Malicious:	false
Preview:	...... ................e.f.3...w........................).....+6...z...3...z3.h.(.....+6...z....)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................~...+6...z..................C..w+6...z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07689334245217043
Encrypted:	false
SSDEEP:	3:dx//J7v6WqcTK/6q8T763lllt/Z7xifk/ill3Vkttlmlnl:dxXJr6WqcTFq8T7yZ7x8h3
MD5:	ED28FB6E4A34F02ED0AFD755C9081BBC
SHA1:	DC180126C5167BE6F38342FF4620FCD76CE7DBF8
SHA-256:	F26DCC3BE1252290BFB34EE4D72A1FA504D69D03A8972CB8020547927919AC1C
SHA-512:	91BB8C5EBA5805F4C6A1A0CACEDD482AB2F9736495C9BE0BC0C84C9E7D9D20A6F475E754C252BE87CB4095FE10CFDC076606DC8AB896934049D1FD83C8AE0F69
Malicious:	false
Preview:	.\.......................................3...w...3...z3.+6...z..........+6...z..+6...z..`e..+6...z/.................C..w+6...z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\1eb9023b-aa41-45a3-9b5d-5b71696cbaf9.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.409048610768343
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQif0cl:ZxMghwLtHSM1Sb9mSMXAvYfl
MD5:	65F5F3B91636716884C84C1F1D6C466B
SHA1:	886A03B0AA74D74782020C40F6B770EC440696A4
SHA-256:	4C71374A89D419BA05CC21234837A2863DD17E68C69C7BF37B3E7F0BFCFA34CB
SHA-512:	8D1DCC8D7BF82BD21EFDFCC563E80695755F2294E7CDF9FFFF4B9F0BF76A13655327AF32CE2AECF1DEC06DAC24316396AF862A5384BE252B94FD6BD71C61314E
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.z.3.4.m.?.v.e.r.=.2.5.1.e...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\26c0c66e-1fae-41bb-8965-9cfde6511223.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.422473556620063
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
MD5:	053A6748354C63633E9F064D374A3D64
SHA1:	F7392A988C29192C2DBB9192931C98C346A03B46
SHA-256:	1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
SHA-512:	175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\2e51cabf-3c62-4fa0-8e15-bf38a6aaae47.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.4331945997544016
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwR+aLNg:ZxMghwLtHSM1Sb9mSMXAvwR+ai
MD5:	525B1BA1772CFEE0BAE3DC8B3118E819
SHA1:	731557E8BA7563E9B04FD45DFE1E97E4B49080DB
SHA-256:	5A59D990336DC5A357E17ABF1CA3CF5200D212714769BC68EBE01639DB58C215
SHA-512:	1E86B1BD3E3AFDAB7FA0F57DA80EEF519976B1CDA586D8B90CB87FC247DD26AAACBA5669DE539E9817A7505DFB1BEE2457567A4909D36841F39CDD5D7ED7752E
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.X.J.7.Z.?.v.e.r.=.1.3.f.a...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6aa62ff1-6a40-4e34-903b-82855c0b2c58.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.3894363370336076
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
MD5:	A27F678F172C642E24DE4740C5B2DBC3
SHA1:	36444729D96B371E3B182455FD5416A724875FF3
SHA-256:	BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
SHA-512:	7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9f255525-0065-434d-93ea-d945a3271900.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.422473556620063
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
MD5:	053A6748354C63633E9F064D374A3D64
SHA1:	F7392A988C29192C2DBB9192931C98C346A03B46
SHA-256:	1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
SHA-512:	175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a2f8e179-fe51-444e-832b-074e239be3e6.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.4065402489118934
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRyjMr/J:ZxMghwLtHSM1Sb9mSMXAvwRyw
MD5:	0804BAA6AA2E6F3BFEE26C4878964D8F
SHA1:	364E417682227335558E0FC681CA63AAAB6EF547
SHA-256:	32A17854D220D2ADEF855727933DD22470E0A020E20CFC6A3EADA1DB587101E4
SHA-512:	7F774750853454E087B922329D4C8FD3E7B3FC75FF9D878AF3A0312F14B3F857AD8DC5EF71837BC5CAAC383DB3AF7051E6995697613F1039FA09380289B633C7
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.W.N.R.4.?.v.e.r.=.8.2.a.7...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\b13ed51d-37ae-4104-bd5c-dbe7e906955f.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.391792531393513
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRCAo1q1:ZxMghwLtHSM1Sb9mSMXAvwRC9+
MD5:	243F925C0ABBE732E09B0C2E29A638FD
SHA1:	FDB0600BA877727571437801BAF1B269E1591267
SHA-256:	E6EA053E76B0AAEA7FC55F05636DAD3C092C25C5730465655F0ED232B5D2AECC
SHA-512:	F24E9CF872FED828C9840D0A5D3905B83F30B6715556D55EE9F7294BBB04373EDFED7C9FCE91EBD277287B0198C47B50CF8B68A83420FC44D036E291821EFC65
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.F.w.5.F.?.v.e.r.=.6.f.6.a...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\baf71923-ac9e-420a-86e9-666354d5eab3.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.4179947346853985
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRtct/:ZxMghwLtHSM1Sb9mSMXAvwRGt/
MD5:	43327A6EC4655E2605BD848AC8080B10
SHA1:	51276390FDD68D8B69D029D9BAFDF9997ACB79C5
SHA-256:	71AB8FD7D98622E359F365BA254575446940872D50B54702788BCD7F9BFFD727
SHA-512:	59446BBE0E47D93FABD768C886DBBA365A61A576F83006000F0D8D3F93E741DC3AC2DC0E606AB7B81AFDA56E76A6CBA18E55DCBC0A0E211E5D06DE690E9B092B
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.F.d.p.q.?.v.e.r.=.5.5.b.1...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\bb6a075f-f8cc-4eb1-9664-c0a7d6856bb6.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.421963810396767
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRy4Uod:ZxMghwLtHSM1Sb9mSMXAvwRy
MD5:	C66BCF93ED9B2B486964DFDF8C3F8725
SHA1:	E8470CB4AA9AA86D45F7C4385B3108F02A01CDFF
SHA-256:	455B7863838C11F3A0B1C3AF86CAD3E0EC282893307EC0DB12B12A8501124678
SHA-512:	716FD3C99D8B83617378DBC142631F8BB7A603191A35EC4AC6A30B4025F441D521358C7AECE38F2A02421CA3A6C5A5B5745093C4DE960996C0FCBD69A838F344
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.W.I.E.t.?.v.e.r.=.b.6.5.3...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\cf9be2dc-8442-4a5f-9181-b5743484afb7.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.3894363370336076
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
MD5:	A27F678F172C642E24DE4740C5B2DBC3
SHA1:	36444729D96B371E3B182455FD5416A724875FF3
SHA-256:	BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
SHA-512:	7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d2744d4b-1d42-49a8-870f-1e1b9fcca2fe.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.414779436161726
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRGhtit/:ZxMghwLtHSM1Sb9mSMXAvwRG
MD5:	5DEFA2ED7476030EF2B061CC2497D806
SHA1:	AAC9CCE54C058128BC8F1B9C0B162A556D1C2664
SHA-256:	5F3096546980452D17067800A5F97C47B6763985DAD1026DE288065B9AEE2241
SHA-512:	0D840C0544B55E62F30BF3FD0836E0D282B2CFE6C322D3018D51E2784EDB496C4B5D6981B1683FE361D5ABD057B00295B7A2FC236BED21DB299E94432983889F
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.X.Q.V.g.?.v.e.r.=.a.c.2.7...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\e29af581-707e-4cba-bf52-969a9da8381a.up_meta

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	data
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.411867361088877
Encrypted:	false
SSDEEP:	6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQi/Eom:ZxMghwLtHSM1Sb9mSMXAvh
MD5:	4C2CFF2D31F47CFED62B158B615A9DB3
SHA1:	6B071121D4F0D8D243EA3A07E58098C3CAF6A495
SHA-256:	9F604F89356B479FC4FF6CFC8EC5816D00EA7A571D54997DC507BFC1DB2E622A
SHA-512:	7A0F1EBB1103F75DA0BE5483F305D487D470E15C0B400430C043805ED93AF3763894E425073C136AD09C63A281F2760714BC3C14DCDCB4191997CFE9393BBBC4
Malicious:	false
Preview:	F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.W.y.Z.s.w.?.v.e.r.=.e.e.4.9...........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658332418 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	336
Entropy (8bit):	3.494251376306208
Encrypted:	false
SSDEEP:	6:Qeu01nAKmsy6AlS5CGQAffetXDdv5XY4ANJdlzYiL+5K5SaNy/NiFYlYl:Qeu01n+p65CGIz95INjzYiaU5SaNQsYm
MD5:	0DBEDE3B68F3ED30ABC129EEEEB122FB
SHA1:	1CAB11D94041C41909B5A073880E0BB76894844D
SHA-256:	3DDA5DF7B76DF231A735E49B4368C43E99BA133CDFC155A5FD1C0ACFBDA06B22
SHA-512:	BC594861367ADA6734E81787896EF7F4C716FF9854B90058D8A8E812877285CDA4D4A82986DE6743C03142E1264041F4D022F29319D954FA41DB00BBBDEE6F61
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".e.r.r.o.r.s.".:.[.{.".c.o.d.e.".:.2.0.4.0.,.".m.s.g.".:.".D.e.m.a.n.d. .s.o.u.r.c.e. .r.e.t.u.r.n.s. .e.r.r.o.r. .(.N.a.m.e.:. .G.N._.p.s.,. .E.r.r.o.r.:. .N.o. .e.l.i.g.i.b.l.e. .c.o.n.t.e.n.t...)...".}.].,.".r.e.f.r.e.s.h.t.i.m.e.".:.".2.0.2.2.-.0.7.-.2.0.T.1.9.:.5.3.:.3.8.".}.}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\1658332418.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	336
Entropy (8bit):	3.494251376306208
Encrypted:	false
SSDEEP:	6:Qeu01nAKmsy6AlS5CGQAffetXDdv5XY4ANJdlzYiL+5K5SaNy/NiFYlYl:Qeu01n+p65CGIz95INjzYiaU5SaNQsYm
MD5:	0DBEDE3B68F3ED30ABC129EEEEB122FB
SHA1:	1CAB11D94041C41909B5A073880E0BB76894844D
SHA-256:	3DDA5DF7B76DF231A735E49B4368C43E99BA133CDFC155A5FD1C0ACFBDA06B22
SHA-512:	BC594861367ADA6734E81787896EF7F4C716FF9854B90058D8A8E812877285CDA4D4A82986DE6743C03142E1264041F4D022F29319D954FA41DB00BBBDEE6F61
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".e.r.r.o.r.s.".:.[.{.".c.o.d.e.".:.2.0.4.0.,.".m.s.g.".:.".D.e.m.a.n.d. .s.o.u.r.c.e. .r.e.t.u.r.n.s. .e.r.r.o.r. .(.N.a.m.e.:. .G.N._.p.s.,. .E.r.r.o.r.:. .N.o. .e.l.i.g.i.b.l.e. .c.o.n.t.e.n.t...)...".}.].,.".r.e.f.r.e.s.h.t.i.m.e.".:.".2.0.2.2.-.0.7.-.2.0.T.1.9.:.5.3.:.3.8.".}.}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	10378
Entropy (8bit):	5.36129020728065
Encrypted:	false
SSDEEP:	192:ZSCSB5k5gBlnBlS9vt9UmSmjhrhsnLUL/Lg2LZ2L4LBLiL+L3LB:ZDC+WLmnGTcdg23
MD5:	608783D73861EF319E60DBD7490EE82B
SHA1:	DFE87B3C755B6488D45B3464D9CE37738F542EE5
SHA-256:	A02CDFB36337DC507562ADC3E29AA22C98608CDF73A650E898469D820FA3C53E
SHA-512:	BA0AAC27FE7A0D9CF3E7A0EAAC2F44C307B57E6F3468A5F53FFCAF6C88372B49F34FCF7D6A4BB70F81F0EA6FC05C21DDBC398B987E18DD86172238610C46F7B1
Malicious:	false
Preview:	https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=dd1a8e84fd1343a98117c17a02a03b24&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=83a4606a9c604ec59350c94231b7a4ff&time=20220720T155447Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=dd1a8e84fd1343a98117c17a02a03b24&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=83a4606a9c604ec59350c94231b7a4ff&time=20220720T155448Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	10378
Entropy (8bit):	5.36129020728065
Encrypted:	false
SSDEEP:	192:ZSCSB5k5gBlnBlS9vt9UmSmjhrhsnLUL/Lg2LZ2L4LBLiL+L3LB:ZDC+WLmnGTcdg23
MD5:	608783D73861EF319E60DBD7490EE82B
SHA1:	DFE87B3C755B6488D45B3464D9CE37738F542EE5
SHA-256:	A02CDFB36337DC507562ADC3E29AA22C98608CDF73A650E898469D820FA3C53E
SHA-512:	BA0AAC27FE7A0D9CF3E7A0EAAC2F44C307B57E6F3468A5F53FFCAF6C88372B49F34FCF7D6A4BB70F81F0EA6FC05C21DDBC398B987E18DD86172238610C46F7B1
Malicious:	false
Preview:	https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=dd1a8e84fd1343a98117c17a02a03b24&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=83a4606a9c604ec59350c94231b7a4ff&time=20220720T155447Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=dd1a8e84fd1343a98117c17a02a03b24&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NMPJ99VJBWV&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=83a4606a9c604ec59350c94231b7a4ff&time=20220720T155448Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	5.225642587566377
Encrypted:	false
SSDEEP:	48:eSES2LHfaGujPqLILqfsBubT+TkS8ZU+8Levau6NPqLILqfsBubT+TkSl:YzGyE6z+e8iAyE6z+F
MD5:	42D4299132893EF8141AF34C24DBBB92
SHA1:	32FEC784B8ADADE06F008FA913C7255398BA88C9
SHA-256:	18F3543B099494441385E2B2D35A6DDDA21BFB6F0EEC9DA22214AE89C84D7AD1
SHA-512:	7E42ADF6640F9224E638A839416183362D6801CEB86C6DA9048AD7BBEA33BFB7347B922FF0EC0A3E40631C47C383025BB0D5D564D9F1A4D12EFBDC8FBC09D834
Malicious:	false
Preview:	https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=230696396&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID=b9de0c2b2b3648e8a125cac302df5505&TIME=20220720T155359Z&SLOT=2&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=62f7fc83080b4ea4bc961e27c15af7da&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACH

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	2891
Entropy (8bit):	5.225642587566377
Encrypted:	false
SSDEEP:	48:eSES2LHfaGujPqLILqfsBubT+TkS8ZU+8Levau6NPqLILqfsBubT+TkSl:YzGyE6z+e8iAyE6z+F
MD5:	42D4299132893EF8141AF34C24DBBB92
SHA1:	32FEC784B8ADADE06F008FA913C7255398BA88C9
SHA-256:	18F3543B099494441385E2B2D35A6DDDA21BFB6F0EEC9DA22214AE89C84D7AD1
SHA-512:	7E42ADF6640F9224E638A839416183362D6801CEB86C6DA9048AD7BBEA33BFB7347B922FF0EC0A3E40631C47C383025BB0D5D564D9F1A4D12EFBDC8FBC09D834
Malicious:	false
Preview:	https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=230696396&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ASID=b9de0c2b2b3648e8a125cac302df5505&TIME=20220720T155359Z&SLOT=2&REQT=20220720T155055&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=62f7fc83080b4ea4bc961e27c15af7da&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=F45BD19D-6B8E-42A3-8BE3-7AB3D0A2D2E6&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=BEEDE8C6B3A34585A9CD2D88614A35DA&REQASID=BEEDE8C6B3A34585A9CD2D88614A35DA&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611218&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACH

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658332419 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	52590
Entropy (8bit):	3.858201201622904
Encrypted:	false
SSDEEP:	768:LmdAB13hYoOCVO82XMaqnkQAQqQf8nkcJ:Lmy9uu39kke
MD5:	39FA0B52E1D46BC8E3DCF5820F17AA9A
SHA1:	017E74C26A9CEC933BDA4D064DEAC9909CD3A004
SHA-256:	4A9686BE3A4B05DD922219DDF61A481265CEC3B6CB46758A8801B9EFD6E1D0F0
SHA-512:	C9C36FB9E8B3A12F1AE7AC7813A3A18C824FD47A422856FE628ADE8B8C83DA2C838855D1CBE49BAC578DC47A4B0461187E640CEC4B506C43D927DC94773BBBA6
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.1.7.0.8.8.6.5.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".D.0.H.X.2.8.n.y.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658332419.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	52590
Entropy (8bit):	3.858201201622904
Encrypted:	false
SSDEEP:	768:LmdAB13hYoOCVO82XMaqnkQAQqQf8nkcJ:Lmy9uu39kke
MD5:	39FA0B52E1D46BC8E3DCF5820F17AA9A
SHA1:	017E74C26A9CEC933BDA4D064DEAC9909CD3A004
SHA-256:	4A9686BE3A4B05DD922219DDF61A481265CEC3B6CB46758A8801B9EFD6E1D0F0
SHA-512:	C9C36FB9E8B3A12F1AE7AC7813A3A18C824FD47A422856FE628ADE8B8C83DA2C838855D1CBE49BAC578DC47A4B0461187E640CEC4B506C43D927DC94773BBBA6
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.1.7.0.8.8.6.5.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".D.0.H.X.2.8.n.y.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658332433 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	49190
Entropy (8bit):	3.863199191433258
Encrypted:	false
SSDEEP:	768:9fqoWqhrqFi+IITcimdQjDQjE1QjmhvzaTctltiZt7tip0+rWZTcC:9Smo4DITjmeglY+TuS540tZTN
MD5:	E43EBDDD8B2B9497A88F32D20707E27E
SHA1:	040D7C4180CF11B349801711C203279209443DAE
SHA-256:	9F2786F0CDB696D97AAB7A45258D35A8EEB8B3C0A337331788B112731669D514
SHA-512:	9B109383DF33EA2A64864C5995B1F23011C0B7A2FB1485F5A9C2277DEF1DAAA0366331115C72A21120A92CA83F8429FD58FB0FBD2CFE2D516F496A0C3B14CCCF
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.6.4.7.1.1.1.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".I.B.X.U.r.F.e.o.Q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658332433.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	49190
Entropy (8bit):	3.863199191433258
Encrypted:	false
SSDEEP:	768:9fqoWqhrqFi+IITcimdQjDQjE1QjmhvzaTctltiZt7tip0+rWZTcC:9Smo4DITjmeglY+TuS540tZTN
MD5:	E43EBDDD8B2B9497A88F32D20707E27E
SHA1:	040D7C4180CF11B349801711C203279209443DAE
SHA-256:	9F2786F0CDB696D97AAB7A45258D35A8EEB8B3C0A337331788B112731669D514
SHA-512:	9B109383DF33EA2A64864C5995B1F23011C0B7A2FB1485F5A9C2277DEF1DAAA0366331115C72A21120A92CA83F8429FD58FB0FBD2CFE2D516F496A0C3B14CCCF
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.6.4.7.1.1.1.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".I.B.X.U.r.F.e.o.Q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658332418 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8976
Entropy (8bit):	3.836508248417169
Encrypted:	false
SSDEEP:	96:LcTcgyUG8Kk4b/WfDwPdrj9O1WUFwPUrj9Tpk4btWfDwPdrj9YZV8iqj9/BUlk0H:LFK460PtcMUaP8U4w0Pt0IQlk0CRv5I
MD5:	0C22157A6362A735E625A7C4DC0E14A6
SHA1:	AFA79580F14CC01C09CA7EAF3D24E4A2A3FDBCB9
SHA-256:	063C89445F4AEBB18C4F28EDBB057052FC72221581F2B90168B377A9C3A6D06B
SHA-512:	10450031F9A15CF6FC05BB59211F226FF92072F7AC7327876B599B296D6FF91329BE3A7FE9A7F5DA8ADEFE5B247C98981F17BF589844BAAFA55922A21119285B
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658332418.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	8976
Entropy (8bit):	3.836508248417169
Encrypted:	false
SSDEEP:	96:LcTcgyUG8Kk4b/WfDwPdrj9O1WUFwPUrj9Tpk4btWfDwPdrj9YZV8iqj9/BUlk0H:LFK460PtcMUaP8U4w0Pt0IQlk0CRv5I
MD5:	0C22157A6362A735E625A7C4DC0E14A6
SHA1:	AFA79580F14CC01C09CA7EAF3D24E4A2A3FDBCB9
SHA-256:	063C89445F4AEBB18C4F28EDBB057052FC72221581F2B90168B377A9C3A6D06B
SHA-512:	10450031F9A15CF6FC05BB59211F226FF92072F7AC7327876B599B296D6FF91329BE3A7FE9A7F5DA8ADEFE5B247C98981F17BF589844BAAFA55922A21119285B
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658332423 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9034
Entropy (8bit):	3.8389419525759414
Encrypted:	false
SSDEEP:	192:LFK460P6PGQMUaP66G84w0P6PGYfzGUzi8k0tRv50:LMs6CJ6Cs6ZfDziWzv50
MD5:	9644CCFBD455E59B2AB9E75391D768D0
SHA1:	D0A96630C8C1ADCF80D462FE0FEE6E1C76D1ABA4
SHA-256:	63C0508697C9A388F237E62296BF1D6B50411FCDA76AEA0FAA0D5ECC9686E564
SHA-512:	C6C569B4F603BC2840233751EB83E52B661E123DEC384C60599CD2B85E68726285D60BA1E6D5E4D9EE94A99B761EE8C562B1DEDC3C517E92C67E38DB8D9929CC
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658332423.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9034
Entropy (8bit):	3.8389419525759414
Encrypted:	false
SSDEEP:	192:LFK460P6PGQMUaP66G84w0P6PGYfzGUzi8k0tRv50:LMs6CJ6Cs6ZfDziWzv50
MD5:	9644CCFBD455E59B2AB9E75391D768D0
SHA1:	D0A96630C8C1ADCF80D462FE0FEE6E1C76D1ABA4
SHA-256:	63C0508697C9A388F237E62296BF1D6B50411FCDA76AEA0FAA0D5ECC9686E564
SHA-512:	C6C569B4F603BC2840233751EB83E52B661E123DEC384C60599CD2B85E68726285D60BA1E6D5E4D9EE94A99B761EE8C562B1DEDC3C517E92C67E38DB8D9929CC
Malicious:	false
Preview:	..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	5.385151819577346
Encrypted:	false
SSDEEP:	24:2AsfLW9g/OOIpZK7//hAsfLW9g/OOIpZK7//gj:psToSOPpZGXhAsToSOPpZGXgj
MD5:	65EB33016D1B4DB2040CDF583EF3B758
SHA1:	D985B7345D3CA9850DFE057B0BE00A12D184B4CE
SHA-256:	BBD72E11FAC5826D991FF15DC5BD26489F550E2B696AC5E6855A3940D49FD44E
SHA-512:	3CE2100B43852145BF6888C684E38ED8E873DC0E027A8A03141EED770145E68ED9927612B623AEAE5A75449C892BCEEDDD4826F210CE62FFE9854AAFC6CBF705
Malicious:	false
Preview:	https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1538333990&PG=PC000P0FR5.0000000IRT&REQASID=73631FA46E444129A5A78BF513D8A83F&UNID=338388&ASID=2f9298d8ab8f4c23885c30ea9b373c83&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=5999d0853d524f7baa85da876e7b24cf&DEVOSVER=10.0.17134.1&REQT=20220720T155343&TIME=20220720T155416Z&ARCRAS=&CLR=CDM..https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1538333990&PG=PC000P0FR5.0000000IRT&REQASID=73631FA46E444129A5A78BF513D8A83F&UNID=338388&ASID=2f9298d8ab8f4c23885c30ea9b373c83&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=69665304

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	5.385151819577346
Encrypted:	false
SSDEEP:	24:2AsfLW9g/OOIpZK7//hAsfLW9g/OOIpZK7//gj:psToSOPpZGXhAsToSOPpZGXgj
MD5:	65EB33016D1B4DB2040CDF583EF3B758
SHA1:	D985B7345D3CA9850DFE057B0BE00A12D184B4CE
SHA-256:	BBD72E11FAC5826D991FF15DC5BD26489F550E2B696AC5E6855A3940D49FD44E
SHA-512:	3CE2100B43852145BF6888C684E38ED8E873DC0E027A8A03141EED770145E68ED9927612B623AEAE5A75449C892BCEEDDD4826F210CE62FFE9854AAFC6CBF705
Malicious:	false
Preview:	https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1538333990&PG=PC000P0FR5.0000000IRT&REQASID=73631FA46E444129A5A78BF513D8A83F&UNID=338388&ASID=2f9298d8ab8f4c23885c30ea9b373c83&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=5999d0853d524f7baa85da876e7b24cf&DEVOSVER=10.0.17134.1&REQT=20220720T155343&TIME=20220720T155416Z&ARCRAS=&CLR=CDM..https://ris.api.iris.microsoft.com/v1/a/impression?CID=128000000000402926&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID=&&PID=400091688&UIT=P-&TargetID=700129702&AN=1538333990&PG=PC000P0FR5.0000000IRT&REQASID=73631FA46E444129A5A78BF513D8A83F&UNID=338388&ASID=2f9298d8ab8f4c23885c30ea9b373c83&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=69665304

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	5.214817274751045
Encrypted:	false
SSDEEP:	24:28yUqz/WYg7/vipZHe7bkU/56Dj3Ufi9LNUN5p+TUTrKVXciYsiIj:QUqLWY0XipZQIG56ccBu+T+qXTSa
MD5:	C2EAAC79F33CDDC20DEA38D33A68B3AA
SHA1:	04DA6D1AAC53BD0651061BAC156E125D0BA08AE2
SHA-256:	C04615ACF35192B5F259CBD0F5E9C80361B1ADB72BD7179D60AD6B7A5308E978
SHA-512:	718FFD51ABDAB257B434D425A0156E7B0738EE334BE9C228AD17B8675AB1B02FB630133A787B6DB0544AB948E0DCD60B4E3E4F361381AA056748DE7CC0F7DB24
Malicious:	false
Preview:	https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400091688&TID=700129702&CID=128000000000402926&BID=1538333990&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=73631FA46E444129A5A78BF513D8A83F&ASID=2f9298d8ab8f4c23885c30ea9b373c83&TIME=20220720T155417Z&SLOT=1&REQT=20220720T155343&MA_Score=2&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=5999d0853d524f7baa85da876e7b24cf&BCNT=1&PG=PC000P0FR5.0000000IRT&UNID=338388&MAP_TID=B79907B4-9D53-42CB-801D-E74EAEB938FB&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=73631FA46E444129A5A78BF513D8A83F&REQASID=73631FA46E444129A5A78BF513D8A83F&ARC=1&EMS=1&AUTH=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&ID=1A4A490328ED3BBECC8505EAE64E45F5&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611219&RAFB=0&MARKETBASEDCOUNTRY=US&C

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\imprbeacons.dat.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	5.214817274751045
Encrypted:	false
SSDEEP:	24:28yUqz/WYg7/vipZHe7bkU/56Dj3Ufi9LNUN5p+TUTrKVXciYsiIj:QUqLWY0XipZQIG56ccBu+T+qXTSa
MD5:	C2EAAC79F33CDDC20DEA38D33A68B3AA
SHA1:	04DA6D1AAC53BD0651061BAC156E125D0BA08AE2
SHA-256:	C04615ACF35192B5F259CBD0F5E9C80361B1ADB72BD7179D60AD6B7A5308E978
SHA-512:	718FFD51ABDAB257B434D425A0156E7B0738EE334BE9C228AD17B8675AB1B02FB630133A787B6DB0544AB948E0DCD60B4E3E4F361381AA056748DE7CC0F7DB24
Malicious:	false
Preview:	https://arc.msn.com/v3/Delivery/Events/Impression=&PID=400091688&TID=700129702&CID=128000000000402926&BID=1538333990&PG=PC000P0FR5.0000000IRT&TPID=400091688&REQASID=73631FA46E444129A5A78BF513D8A83F&ASID=2f9298d8ab8f4c23885c30ea9b373c83&TIME=20220720T155417Z&SLOT=1&REQT=20220720T155343&MA_Score=2&PERSID=1A4A490328ED3BBECC8505EAE64E45F5&GLOBALDEVICEID=6966530473343700&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=5999d0853d524f7baa85da876e7b24cf&BCNT=1&PG=PC000P0FR5.0000000IRT&UNID=338388&MAP_TID=B79907B4-9D53-42CB-801D-E74EAEB938FB&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=73631FA46E444129A5A78BF513D8A83F&REQASID=73631FA46E444129A5A78BF513D8A83F&ARC=1&EMS=1&AUTH=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&ID=1A4A490328ED3BBECC8505EAE64E45F5&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=1118&LOH=24&LO=1611219&RAFB=0&MARKETBASEDCOUNTRY=US&C

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\c174b4f911d842a39252a6b31960e6c8_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.585343488022799
Encrypted:	false
SSDEEP:	24:Yrw+lePMAK4/n80iiveVLsfWuKN/A6Wb7KDi3b36yFzkLSjhRKlnVbbRn:YrLtC7i8kLs/KV7yKDi3b3HFzkwhOnVJ
MD5:	2A9EA3CEDEF60F38CE074A7B942AE19B
SHA1:	8A5B1E5D0F23AA38A637146CB5329B3D4FEB45A7
SHA-256:	19A8A98F40C619E3EF175A6492EC80374536645307C54B1643A011CB82FA682E
SHA-512:	97E4A478453E8547194333E6C1C00353496E6C21105B5BD031064CC15AF05BA058BE72E1036BB0832133C42A2B38D6345816A2164EB3C61926C0E0AB01B1F0EC
Malicious:	false
Preview:	{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"c174b4f911d842a39252a6b31960e6c8","ctx.creativeId":"1658332303`128000000001627409`0`c174b4f911d842a39252a6b31960e6c8`604800`280815`137271744000000000","ctx.cv":"g3+qLsJmZEqu892I.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=1515916689&PG=PC000P0FR5.0000000INM&REQASID=7DE70F5F82C34804959CEE9CEC27BD2C&UNID=280815&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\c174b4f911d842a39252a6b31960e6c8_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.585343488022799
Encrypted:	false
SSDEEP:	24:Yrw+lePMAK4/n80iiveVLsfWuKN/A6Wb7KDi3b36yFzkLSjhRKlnVbbRn:YrLtC7i8kLs/KV7yKDi3b3HFzkwhOnVJ
MD5:	2A9EA3CEDEF60F38CE074A7B942AE19B
SHA1:	8A5B1E5D0F23AA38A637146CB5329B3D4FEB45A7
SHA-256:	19A8A98F40C619E3EF175A6492EC80374536645307C54B1643A011CB82FA682E
SHA-512:	97E4A478453E8547194333E6C1C00353496E6C21105B5BD031064CC15AF05BA058BE72E1036BB0832133C42A2B38D6345816A2164EB3C61926C0E0AB01B1F0EC
Malicious:	false
Preview:	{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"c174b4f911d842a39252a6b31960e6c8","ctx.creativeId":"1658332303`128000000001627409`0`c174b4f911d842a39252a6b31960e6c8`604800`280815`137271744000000000","ctx.cv":"g3+qLsJmZEqu892I.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=1515916689&PG=PC000P0FR5.0000000INM&REQASID=7DE70F5F82C34804959CEE9CEC27BD2C&UNID=280815&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\83a4606a9c604ec59350c94231b7a4ff_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	51075
Entropy (8bit):	5.587933088534143
Encrypted:	false
SSDEEP:	1536:+Eic+te6FD/cEz2qrQDnkAuiJqrJytvyfK54HAiM6:vic+t7FD/Tz2qOkAuicrJyVyfKuHAiR
MD5:	C3E070B5D13BEC38808435D6F13A6693
SHA1:	DDFB9346394A40E6F941ADF6A62E10BB1252ACEA
SHA-256:	56DBF3ECC97A0617CA700F20323B9858EA253D521A692A7AA6FBAECFAEB521DA
SHA-512:	562DA213F22D7360F3F0FEAA5BF0962D19ECD4EB776FF30F71F45A1C6962D44448AB913339C37AF65C627AD01B76687A7674548872080EEA239966A3E91B05D0
Malicious:	false
Preview:	{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=dd1a8e84fd1343a98117c17a02a03b24&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\83a4606a9c604ec59350c94231b7a4ff_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	51075
Entropy (8bit):	5.587933088534143
Encrypted:	false
SSDEEP:	1536:+Eic+te6FD/cEz2qrQDnkAuiJqrJytvyfK54HAiM6:vic+t7FD/Tz2qOkAuicrJyVyfKuHAiR
MD5:	C3E070B5D13BEC38808435D6F13A6693
SHA1:	DDFB9346394A40E6F941ADF6A62E10BB1252ACEA
SHA-256:	56DBF3ECC97A0617CA700F20323B9858EA253D521A692A7AA6FBAECFAEB521DA
SHA-512:	562DA213F22D7360F3F0FEAA5BF0962D19ECD4EB776FF30F71F45A1C6962D44448AB913339C37AF65C627AD01B76687A7674548872080EEA239966A3E91B05D0
Malicious:	false
Preview:	{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=dd1a8e84fd1343a98117c17a02a03b24&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\b9de0c2b2b3648e8a125cac302df5505_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	84129
Entropy (8bit):	5.6045734573835
Encrypted:	false
SSDEEP:	1536:9ctxExIx9n777l7oopjpBp4zZbZRZULtNWrpbWrpkWrp64Tp+W+X+oN5h5W52vfC:9ctxExIx9n777l7oopjpBp4zZbZRZULF
MD5:	F0AD6C0619ADA49C34DDD1019F8DF575
SHA1:	254EC0D8033AD7BEB5699D6EA26DB980412AB93E
SHA-256:	5190A4B1D216CA542EA5BC9C7071A4986A1CCE13A18282E94C34760BC43EFEBD
SHA-512:	B43869A2A39498F76EAD9917D3E9587767014CCE4E56E218AFB02AD9C6A98735E400532C0FA4C270EAAC7A8807DAAA04449FDD7AD47AD27ED25C8703CD720AD1
Malicious:	false
Preview:	{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=62f7fc83080b4ea4bc961e27c15af7da&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\b9de0c2b2b3648e8a125cac302df5505_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	84129
Entropy (8bit):	5.6045734573835
Encrypted:	false
SSDEEP:	1536:9ctxExIx9n777l7oopjpBp4zZbZRZULtNWrpbWrpkWrp64Tp+W+X+oN5h5W52vfC:9ctxExIx9n777l7oopjpBp4zZbZRZULF
MD5:	F0AD6C0619ADA49C34DDD1019F8DF575
SHA1:	254EC0D8033AD7BEB5699D6EA26DB980412AB93E
SHA-256:	5190A4B1D216CA542EA5BC9C7071A4986A1CCE13A18282E94C34760BC43EFEBD
SHA-512:	B43869A2A39498F76EAD9917D3E9587767014CCE4E56E218AFB02AD9C6A98735E400532C0FA4C270EAAC7A8807DAAA04449FDD7AD47AD27ED25C8703CD720AD1
Malicious:	false
Preview:	{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=62f7fc83080b4ea4bc961e27c15af7da&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\098c5115fc7f4ab9959905b886004365_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9667
Entropy (8bit):	5.6586743171290355
Encrypted:	false
SSDEEP:	192:fQrlMAvKMg2/IUjtlHB5BBt6GAvJwQBt6HNUg2QYYBt6yl:ag2FNt0vJwSt7g2at1
MD5:	1424E6329A25E3AB139025488A028B86
SHA1:	ED79BF18D5A617088725E664931957C1F3017EAB
SHA-256:	B915F8C90E0D53954458CAF79F56693DFDE5EDF1C3B8968AE6E2E37435125C72
SHA-512:	59AFE7F5DF654EB569F7AEB1E2D9D2C96736C3911478C0A569D0CBE348C773E090641386FD65E05E53D544081661459EF69F179A1885D022425062EF09D8CC5D
Malicious:	false
Preview:	{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":647111,"height":1080,"sha256":"IBXUrFeoQltv0Xj9XLyU5hwStkq6T5kx+/lV3eVqUR8=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\842e4e4ad8e41e6a893a996baa08c061072d3b11c57f83bbc8f6b5992f9c5613"},"portraitImage":{"fileSize":693351,"height":1920,"sha256":"aZds5OTEsKnOdFR8MLLboneq5nIEWnYQlGuXeadbKGk=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6bce4edafa1d5562be892960e9a791e50699ffe57ea4fcf4b5b5456308a2e95f"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.co

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\098c5115fc7f4ab9959905b886004365_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9667
Entropy (8bit):	5.6586743171290355
Encrypted:	false
SSDEEP:	192:fQrlMAvKMg2/IUjtlHB5BBt6GAvJwQBt6HNUg2QYYBt6yl:ag2FNt0vJwSt7g2at1
MD5:	1424E6329A25E3AB139025488A028B86
SHA1:	ED79BF18D5A617088725E664931957C1F3017EAB
SHA-256:	B915F8C90E0D53954458CAF79F56693DFDE5EDF1C3B8968AE6E2E37435125C72
SHA-512:	59AFE7F5DF654EB569F7AEB1E2D9D2C96736C3911478C0A569D0CBE348C773E090641386FD65E05E53D544081661459EF69F179A1885D022425062EF09D8CC5D
Malicious:	false
Preview:	{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":647111,"height":1080,"sha256":"IBXUrFeoQltv0Xj9XLyU5hwStkq6T5kx+/lV3eVqUR8=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\842e4e4ad8e41e6a893a996baa08c061072d3b11c57f83bbc8f6b5992f9c5613"},"portraitImage":{"fileSize":693351,"height":1920,"sha256":"aZds5OTEsKnOdFR8MLLboneq5nIEWnYQlGuXeadbKGk=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\6bce4edafa1d5562be892960e9a791e50699ffe57ea4fcf4b5b5456308a2e95f"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.co

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\2b5e800dda5d4fe0804933c66ff1142b_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9581
Entropy (8bit):	5.612212044178936
Encrypted:	false
SSDEEP:	192:n/lWHlAAvKNhSAttlHB5QBt4YGCBtJ+95DBtASWMA:NKGYsEt3tw9/tnA
MD5:	522625EF444FEA713AFDC8736BC71508
SHA1:	D1E0D3D45069C2953E16B6567220606DF590B36A
SHA-256:	D3DCB530086ECA5F1EA82C08B860014428AC8E96C64E73629719EA8B3272B747
SHA-512:	52DE8F2FCD421FA26CDBCAB55FFC00B2AB763B8322F06099F649BD228EE58599E57EDF5169CE7624B3C80B68521B8506266BF484C76905ADCC37CE87F422ACC5
Malicious:	false
Preview:	{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1708865,"height":1080,"sha256":"D0HX28nyO5NQd6kgwDFGgC/6JrE0LlomLmJ1DdzdriE=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7"},"portraitImage":{"fileSize":1660833,"height":1920,"sha256":"PpfCRreo37BZAhX8PHI2WD1K/f7wMV2Jdwu4/nMF3xw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\2b5e800dda5d4fe0804933c66ff1142b_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9581
Entropy (8bit):	5.612212044178936
Encrypted:	false
SSDEEP:	192:n/lWHlAAvKNhSAttlHB5QBt4YGCBtJ+95DBtASWMA:NKGYsEt3tw9/tnA
MD5:	522625EF444FEA713AFDC8736BC71508
SHA1:	D1E0D3D45069C2953E16B6567220606DF590B36A
SHA-256:	D3DCB530086ECA5F1EA82C08B860014428AC8E96C64E73629719EA8B3272B747
SHA-512:	52DE8F2FCD421FA26CDBCAB55FFC00B2AB763B8322F06099F649BD228EE58599E57EDF5169CE7624B3C80B68521B8506266BF484C76905ADCC37CE87F422ACC5
Malicious:	false
Preview:	{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1708865,"height":1080,"sha256":"D0HX28nyO5NQd6kgwDFGgC/6JrE0LlomLmJ1DdzdriE=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7"},"portraitImage":{"fileSize":1660833,"height":1920,"sha256":"PpfCRreo37BZAhX8PHI2WD1K/f7wMV2Jdwu4/nMF3xw=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\361920c594c1482591c08f3c6c53d03d_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9473
Entropy (8bit):	5.652579186064169
Encrypted:	false
SSDEEP:	192:4q267PA2LMAvKD1mF82tlHB5JBtgbAxCBtRsy7c2BtoI:w1ePttYAxQtnxtj
MD5:	29812D87989EEB218D6FA167798BDB07
SHA1:	D934486634BE1A6C16A0C65F13E55B1E45FAB67F
SHA-256:	2445F53D5CCF6E9E653BAA587EFD50C75F6EC69F3836F33A7E49ED47EDBF4329
SHA-512:	1D38EBDFB913CD930A14F609EC9FED57B174EA943373787F061042A9DF4F1450A86EB6A46B969AFC74EBDB44EB7E2D77C729DF4E934F962A366F30D1BC4A5EA4
Malicious:	false
Preview:	{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1703617,"height":1080,"sha256":"LpiSM1iMXxIMUa8mREwVzXkTdK4898dRH/qM7Vn+gmc=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cbc20ba0195f823c2fea772005e771d5a040a705e7ba53a6725db96426511b39"},"portraitImage":{"fileSize":1597826,"height":1920,"sha256":"RXC8u6QEPF7WyzU2QHPwovJ8bDNiW54aNWmKtXAc+g8=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\098847447c33ddf8f805abd62099314078d2782a710a881d2548ac395a48ce9f"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338387\361920c594c1482591c08f3c6c53d03d_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	9473
Entropy (8bit):	5.652579186064169
Encrypted:	false
SSDEEP:	192:4q267PA2LMAvKD1mF82tlHB5JBtgbAxCBtRsy7c2BtoI:w1ePttYAxQtnxtj
MD5:	29812D87989EEB218D6FA167798BDB07
SHA1:	D934486634BE1A6C16A0C65F13E55B1E45FAB67F
SHA-256:	2445F53D5CCF6E9E653BAA587EFD50C75F6EC69F3836F33A7E49ED47EDBF4329
SHA-512:	1D38EBDFB913CD930A14F609EC9FED57B174EA943373787F061042A9DF4F1450A86EB6A46B969AFC74EBDB44EB7E2D77C729DF4E934F962A366F30D1BC4A5EA4
Malicious:	false
Preview:	{"class":"content","collections":[],"name":"LockScreen","propertyManifest":{"landscapeImage":{"type":"image"},"portraitImage":{"type":"image"},"showImageOnSecureLock":{"isOptional":true,"type":"boolean"},"onRender":{"type":"action"}},"properties":{"landscapeImage":{"fileSize":1703617,"height":1080,"sha256":"LpiSM1iMXxIMUa8mREwVzXkTdK4898dRH/qM7Vn+gmc=","width":1920,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\cbc20ba0195f823c2fea772005e771d5a040a705e7ba53a6725db96426511b39"},"portraitImage":{"fileSize":1597826,"height":1920,"sha256":"RXC8u6QEPF7WyzU2QHPwovJ8bDNiW54aNWmKtXAc+g8=","width":1080,"image":"C:\\Users\\user\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\Assets\\098847447c33ddf8f805abd62099314078d2782a710a881d2548ac395a48ce9f"},"showImageOnSecureLock":{"bool":true},"onRender":{"event":"none","parameters":{"ctx.action":"setLockScreenHotspots","ctx.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\2f9298d8ab8f4c23885c30ea9b373c83_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3360
Entropy (8bit):	5.645856811275207
Encrypted:	false
SSDEEP:	96:KVvnfTSHt35Ez9ph8uwkSpnnhuz9phm3X:wfeHt35K9pbw7pnn+9pQ3X
MD5:	3D8223281C39302F4676F1AE9EF33D9C
SHA1:	B923B81F5631874B871A09ADA276AB5417BB516D
SHA-256:	A6EF78026B3A197425E758FCFC6AC6FAF216AE10186FEDC0BE1491B6E14E7D5B
SHA-512:	FB1228F11FB135AB82C17A2BCB1BF34C49242E09D322C1B0889F53ABF3CDD2E75C21AAD8B552BBFBF3D959BEFEF9DA3AA7D5E26F7A6E2D3ADC2CA04A691AFA91
Malicious:	false
Preview:	{"class":"content","collections":[],"itemPropertyManifest":{"templateType":{"type":"text"},"onRender":{"type":"action"}},"items":[{"properties":{"templateType":{"text":"hidden"},"onRender":{"event":"none","parameters":{"collectionId":"Start.Suggestions","ctx.action":"addTileToCollection","ctx.containerPath":"//item[0]","ctx.contentId":"2f9298d8ab8f4c23885c30ea9b373c83","ctx.creativeId":"1658332423`128000000000402926`0`2f9298d8ab8f4c23885c30ea9b373c83`3600`338388`137270880000000000","ctx.cv":"oaICtliqHkOsyYHR.0","ctx.expiration":"137270880000000000","ctx.placementId":"SubscribedContent-338388","onRender":"//item[0]/property[onRender]","templateType":"hidden"},"action":"addTileToCollection"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"},{"id":"//item[0]?eventName=click","name":"click"},{"id":"//item[0]?eventName=install","name":"install"},{"id":"//item[0]?eventName=installComplete","name":"installComplete"},{"id":"//item[0]?eventName=dislike","name":"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338388\2f9298d8ab8f4c23885c30ea9b373c83_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3360
Entropy (8bit):	5.645856811275207
Encrypted:	false
SSDEEP:	96:KVvnfTSHt35Ez9ph8uwkSpnnhuz9phm3X:wfeHt35K9pbw7pnn+9pQ3X
MD5:	3D8223281C39302F4676F1AE9EF33D9C
SHA1:	B923B81F5631874B871A09ADA276AB5417BB516D
SHA-256:	A6EF78026B3A197425E758FCFC6AC6FAF216AE10186FEDC0BE1491B6E14E7D5B
SHA-512:	FB1228F11FB135AB82C17A2BCB1BF34C49242E09D322C1B0889F53ABF3CDD2E75C21AAD8B552BBFBF3D959BEFEF9DA3AA7D5E26F7A6E2D3ADC2CA04A691AFA91
Malicious:	false
Preview:	{"class":"content","collections":[],"itemPropertyManifest":{"templateType":{"type":"text"},"onRender":{"type":"action"}},"items":[{"properties":{"templateType":{"text":"hidden"},"onRender":{"event":"none","parameters":{"collectionId":"Start.Suggestions","ctx.action":"addTileToCollection","ctx.containerPath":"//item[0]","ctx.contentId":"2f9298d8ab8f4c23885c30ea9b373c83","ctx.creativeId":"1658332423`128000000000402926`0`2f9298d8ab8f4c23885c30ea9b373c83`3600`338388`137270880000000000","ctx.cv":"oaICtliqHkOsyYHR.0","ctx.expiration":"137270880000000000","ctx.placementId":"SubscribedContent-338388","onRender":"//item[0]/property[onRender]","templateType":"hidden"},"action":"addTileToCollection"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"},{"id":"//item[0]?eventName=click","name":"click"},{"id":"//item[0]?eventName=install","name":"install"},{"id":"//item[0]?eventName=installComplete","name":"installComplete"},{"id":"//item[0]?eventName=dislike","name":"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\a55f2be5f0b941e987b5cade10ae9cb7_1 (copy)

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	5.581744819192165
Encrypted:	false
SSDEEP:	48:YrLt2u8kLs/KKVsyKDi3bOWHFzkwhoVnyNz:EYPs8sBcXuGoVyB
MD5:	5C40340BF3EB6DBA72E25396EB95FFA9
SHA1:	358B87F54F99B1728E4FCC04E56BFDA72B6A9B8B
SHA-256:	216BBB3A6715DD1A243837F255380BDE3F4664917DE11208D1027520C378DE1A
SHA-512:	8079C66571F2AC4996588742980E53B7C7F2D8523B282F830611ADEC1FBAE2BC8F80E14F6BF9B95FC004B9BEE0997E00A84ECF608054B371199D3085D910AFA8
Malicious:	false
Preview:	{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"a55f2be5f0b941e987b5cade10ae9cb7","ctx.creativeId":"1658332303`128000000001627409`0`a55f2be5f0b941e987b5cade10ae9cb7`604800`338389`137271744000000000","ctx.cv":"oaICtliqHkOsyYHR.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=271458172&PG=PC000P0FR5.0000000IRU&REQASID=63BD574049A44C08A7CCDC9A65721BEE&UNID=338389&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\a55f2be5f0b941e987b5cade10ae9cb7_1.~tmp

Process:	C:\Windows\System32\backgroundTaskHost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	5.581744819192165
Encrypted:	false
SSDEEP:	48:YrLt2u8kLs/KKVsyKDi3bOWHFzkwhoVnyNz:EYPs8sBcXuGoVyB
MD5:	5C40340BF3EB6DBA72E25396EB95FFA9
SHA1:	358B87F54F99B1728E4FCC04E56BFDA72B6A9B8B
SHA-256:	216BBB3A6715DD1A243837F255380BDE3F4664917DE11208D1027520C378DE1A
SHA-512:	8079C66571F2AC4996588742980E53B7C7F2D8523B282F830611ADEC1FBAE2BC8F80E14F6BF9B95FC004B9BEE0997E00A84ECF608054B371199D3085D910AFA8
Malicious:	false
Preview:	{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"a55f2be5f0b941e987b5cade10ae9cb7","ctx.creativeId":"1658332303`128000000001627409`0`a55f2be5f0b941e987b5cade10ae9cb7`604800`338389`137271744000000000","ctx.cv":"oaICtliqHkOsyYHR.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=271458172&PG=PC000P0FR5.0000000IRU&REQASID=63BD574049A44C08A7CCDC9A65721BEE&UNID=338389&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\mssecsvc.exe

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3751936
Entropy (8bit):	6.542658013502966
Encrypted:	false
SSDEEP:	49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:yDqPoBhz1aRxcSUDk36SA
MD5:	D6F23DCB793C969936142BF9B4F53837
SHA1:	3EB0608F37AFB0D0EC195C92D099AB274B0AD1C5
SHA-256:	DDA90D52F628194C8FD215A57926FABADE3A346E05ED2E080C8EBA7E3BF8DD0F
SHA-512:	DF23A8D2110BD17B2ED04F40AC090E834E3F5139CF3D470FE755973D09A3BA97D5D760DED17E4EE6B29AF460F243C378ACED52261F8676FF1C72B99260418162
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\mssecsvc.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L......=.....................08...................@..........................0g......................................................1.. 6..........................................................................................................text............................... ....rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...hzuevao...... g......@9.................................................................................................................................................................................................................................................................................................................................

C:\Windows\tasksche.exe

Process:	C:\Windows\mssecsvc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3514368
Entropy (8bit):	6.5250408221172975
Encrypted:	false
SSDEEP:	49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAL:QqPoBhz1aRxcSUDk36SA8
MD5:	3233ACED9279EF54267C479BBA665B90
SHA1:	0B2CC142386641901511269503CDF6F641FAD305
SHA-256:	F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
SHA-512:	55F25C51FFB89D46F2A7D2ED9B67701E178BD68E74B71D757D5FA14BD9530A427104FC36116633033EAD762ECF7960AB96429F5B0A085A701001C6832BA4555E
Malicious:	true
Yara Hits:	Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 85%, Browse Antivirus: ReversingLabs, Detection: 95%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.054737666485416
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FjYNZSPNkt.dll
File size:	5267459
MD5:	9209f16a98096aafd9686e3b0dffef02
SHA1:	eef3b058acf4631d573a77ec9fb787d3d876f81d
SHA256:	b74df112f9ecc4658a997f870dff5d36b2a8f5df8685da1fb70227395e7eb009
SHA512:	0c4e2f91a531d27e3ed50f2cbe268f50eefcd185801b4c39a9f654ebe9c11b8960076fb14c6b0f15053dfb6d7d2f84c7642a275b928af0b695b39e2e52990875
SSDEEP:	49152:jnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DDqPoBhz1aRxcSUDk36SA
TLSH:	0F36F601D2E51AA0DAF25EF7267ADB10833A6F45895BA66E1221500F0C77F1CDDE6F2C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x100011e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x59145751 [Thu May 11 12:21:37 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5708ae5fed0403e8117c645fb23e5b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F7550C1233Bh
cmp dword ptr [10003140h], 00000000h
jmp 00007F7550C12358h
cmp esi, 01h
je 00007F7550C12337h
cmp esi, 02h
jne 00007F7550C12354h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F7550C1233Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F7550C1233Eh
push edi
push esi
push ebx
call 00007F7550C1224Ah
test eax, eax
jne 00007F7550C12336h
xor eax, eax
jmp 00007F7550C12380h
push edi
push esi
push ebx
call 00007F7550C120FCh
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F7550C1233Eh
test eax, eax
jne 00007F7550C12369h
push edi
push eax
push ebx
call 00007F7550C12226h
test esi, esi
je 00007F7550C12337h
cmp esi, 03h
jne 00007F7550C12358h
push edi
push esi
push ebx
call 00007F7550C12215h
test eax, eax
jne 00007F7550C12335h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F7550C12343h
mov eax, dword ptr [10003150h]
test eax, eax
je 00007F7550C1233Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
jmp dword ptr [10002028h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720
[LNK] VS98 (6.0) imp/exp build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2190	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x203c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x500060	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x505000	0x5c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28c	0x1000	False	0.13037109375	data	1.4429971244731552	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x1d8	0x1000	False	0.072509765625	data	0.7346018133622799	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x154	0x1000	False	0.016845703125	data	0.085238686413312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x500060	0x501000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x505000	0x2ac	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
W	0x4060	0x500000	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
MSVCRT.dll	free, _initterm, malloc, _adjust_fdiv, sprintf

Exports

Name	Ordinal	Address
PlayGame	1	0x10001114

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
8.8.8.8192.168.2.453575462811577 07/20/22-17:55:02.126057	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	57546	8.8.8.8	192.168.2.4
192.168.2.48.8.8.860381532012730 07/20/22-17:53:18.256471	UDP	2012730	ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup	60381	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.856509532024281 07/20/22-17:53:49.518877	UDP	2024281	ET TROJAN Known Hostile Domain ant.trenz .pl Lookup	56509	53	192.168.2.4	8.8.8.8
192.168.2.4104.16.173.8049756802024298 07/20/22-17:51:12.245255	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49756	80	192.168.2.4	104.16.173.80
104.16.173.80192.168.2.480497562031515 07/20/22-17:51:12.277768	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49756	104.16.173.80	192.168.2.4
192.168.2.48.8.8.858171532024291 07/20/22-17:54:08.365418	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	58171	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.863284532012730 07/20/22-17:55:12.427931	UDP	2012730	ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup	63284	53	192.168.2.4	8.8.8.8
192.168.2.48.8.8.860506532024291 07/20/22-17:51:12.176394	UDP	2024291	ET TROJAN Possible WannaCry DNS Lookup 1	60506	53	192.168.2.4	8.8.8.8
104.17.244.81192.168.2.480497922031515 07/20/22-17:54:08.478476	TCP	2031515	ET TROJAN Known Sinkhole Response Kryptos Logic	80	49792	104.17.244.81	192.168.2.4
192.168.2.4104.17.244.8149792802024298 07/20/22-17:54:08.444562	TCP	2024298	ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1	49792	80	192.168.2.4	104.17.244.81
8.8.8.8192.168.2.453524722811577 07/20/22-17:54:18.402667	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	52472	8.8.8.8	192.168.2.4
8.8.8.8192.168.2.453501212811577 07/20/22-17:54:40.097301	UDP	2811577	ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)	53	50121	8.8.8.8	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 17:51:12.227129936 CEST	49756	80	192.168.2.4	104.16.173.80
Jul 20, 2022 17:51:12.244617939 CEST	80	49756	104.16.173.80	192.168.2.4
Jul 20, 2022 17:51:12.244714022 CEST	49756	80	192.168.2.4	104.16.173.80
Jul 20, 2022 17:51:12.245254993 CEST	49756	80	192.168.2.4	104.16.173.80
Jul 20, 2022 17:51:12.262600899 CEST	80	49756	104.16.173.80	192.168.2.4
Jul 20, 2022 17:51:12.277767897 CEST	80	49756	104.16.173.80	192.168.2.4
Jul 20, 2022 17:51:12.277880907 CEST	80	49756	104.16.173.80	192.168.2.4
Jul 20, 2022 17:51:12.277899981 CEST	49756	80	192.168.2.4	104.16.173.80
Jul 20, 2022 17:51:12.277959108 CEST	49756	80	192.168.2.4	104.16.173.80
Jul 20, 2022 17:51:12.278322935 CEST	49756	80	192.168.2.4	104.16.173.80
Jul 20, 2022 17:51:12.295485973 CEST	80	49756	104.16.173.80	192.168.2.4
Jul 20, 2022 17:54:08.426199913 CEST	49792	80	192.168.2.4	104.17.244.81
Jul 20, 2022 17:54:08.442748070 CEST	80	49792	104.17.244.81	192.168.2.4
Jul 20, 2022 17:54:08.443643093 CEST	49792	80	192.168.2.4	104.17.244.81
Jul 20, 2022 17:54:08.444561958 CEST	49792	80	192.168.2.4	104.17.244.81
Jul 20, 2022 17:54:08.461271048 CEST	80	49792	104.17.244.81	192.168.2.4
Jul 20, 2022 17:54:08.478476048 CEST	80	49792	104.17.244.81	192.168.2.4
Jul 20, 2022 17:54:08.478672981 CEST	49792	80	192.168.2.4	104.17.244.81
Jul 20, 2022 17:54:08.478925943 CEST	49792	80	192.168.2.4	104.17.244.81
Jul 20, 2022 17:54:08.496335030 CEST	80	49792	104.17.244.81	192.168.2.4
Jul 20, 2022 17:54:08.703829050 CEST	80	49792	104.17.244.81	192.168.2.4
Jul 20, 2022 17:54:08.703948021 CEST	49792	80	192.168.2.4	104.17.244.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 17:51:12.176393986 CEST	60506	53	192.168.2.4	8.8.8.8
Jul 20, 2022 17:51:12.196624041 CEST	53	60506	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:08.365417957 CEST	58171	53	192.168.2.4	8.8.8.8
Jul 20, 2022 17:54:08.385657072 CEST	53	58171	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.258260965 CEST	53	60512	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.308201075 CEST	53	61361	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.335342884 CEST	53	50445	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.367090940 CEST	53	51679	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.402667046 CEST	53	52472	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.451947927 CEST	53	62354	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.481395960 CEST	53	50061	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.517307997 CEST	53	60612	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.565526009 CEST	53	58816	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.615561008 CEST	53	56437	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.643445969 CEST	53	64825	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.676141977 CEST	53	53989	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.726281881 CEST	53	63431	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.756714106 CEST	53	56901	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.792995930 CEST	53	50800	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.904059887 CEST	53	52256	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:18.969556093 CEST	53	61081	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.006818056 CEST	53	63712	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.046688080 CEST	53	64316	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.079499006 CEST	53	50778	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.110985994 CEST	53	61486	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.160911083 CEST	53	61497	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.191792965 CEST	53	55142	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.232403994 CEST	53	55271	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.268182993 CEST	53	64948	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.301373005 CEST	53	60418	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.333065987 CEST	53	64259	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.368571997 CEST	53	61068	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.405153036 CEST	53	58715	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.433872938 CEST	53	57816	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.463195086 CEST	53	51787	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.505987883 CEST	53	53916	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.553107977 CEST	53	60790	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.583656073 CEST	53	62708	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:19.775619030 CEST	53	60946	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:39.945770979 CEST	53	57992	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:39.983746052 CEST	53	55664	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.029886961 CEST	53	55479	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.059593916 CEST	53	51679	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.097301006 CEST	53	50121	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.132085085 CEST	53	61030	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.181905985 CEST	53	62468	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.232880116 CEST	53	50737	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.284487963 CEST	53	53970	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.320353985 CEST	53	61849	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.373653889 CEST	53	62643	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.424299955 CEST	53	61888	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.478235006 CEST	53	61499	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.506979942 CEST	53	63356	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.558136940 CEST	53	57376	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.596235037 CEST	53	63429	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.630182981 CEST	53	51239	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.678375959 CEST	53	52656	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.716212988 CEST	53	61135	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.753846884 CEST	53	51417	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.804666996 CEST	53	57020	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.915461063 CEST	53	55659	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:40.979768038 CEST	53	49579	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.167217016 CEST	53	60445	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.251645088 CEST	53	54813	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.281882048 CEST	53	56520	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.383841038 CEST	53	49890	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.454515934 CEST	53	57838	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.494239092 CEST	53	54661	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.573896885 CEST	53	62646	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.625000000 CEST	53	55569	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.678946972 CEST	53	61114	8.8.8.8	192.168.2.4
Jul 20, 2022 17:54:41.718364954 CEST	53	51398	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:01.915558100 CEST	53	65060	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:01.948951006 CEST	53	51728	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.058417082 CEST	53	50780	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.088565111 CEST	53	56416	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.126056910 CEST	53	57546	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.162512064 CEST	53	62764	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.192738056 CEST	53	51082	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.220952988 CEST	53	64135	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.257361889 CEST	53	51285	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.305938005 CEST	53	63648	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.334044933 CEST	53	51469	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.441952944 CEST	53	53919	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.551109076 CEST	53	63863	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.586520910 CEST	53	57316	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.620600939 CEST	53	62948	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.660648108 CEST	53	49643	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.690216064 CEST	53	62225	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.727658987 CEST	53	63555	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.757400036 CEST	53	51863	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.793215990 CEST	53	51672	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.840558052 CEST	53	49779	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.885500908 CEST	53	64925	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.931385040 CEST	53	57347	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:02.980429888 CEST	53	49656	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:03.011116028 CEST	53	62739	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:03.042330027 CEST	53	61457	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:03.076562881 CEST	53	59845	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:03.105895996 CEST	53	64236	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:03.217895985 CEST	53	64044	8.8.8.8	192.168.2.4
Jul 20, 2022 17:55:03.264223099 CEST	53	57361	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 17:51:12.176393986 CEST	192.168.2.4	8.8.8.8	0x6cab	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:08.365417957 CEST	192.168.2.4	8.8.8.8	0xa53a	Standard query (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 17:51:12.196624041 CEST	8.8.8.8	192.168.2.4	0x6cab	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.16.173.80	A (IP address)	IN (0x0001)
Jul 20, 2022 17:51:12.196624041 CEST	8.8.8.8	192.168.2.4	0x6cab	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.17.244.81	A (IP address)	IN (0x0001)
Jul 20, 2022 17:51:41.309281111 CEST	8.8.8.8	192.168.2.4	0xe8fc	No error (0)	www-bing-com.dual-a-0001.a-msedge.net	dual-a-0001.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jul 20, 2022 17:51:41.309281111 CEST	8.8.8.8	192.168.2.4	0xe8fc	No error (0)	dual-a-0001.a-msedge.net		204.79.197.200	A (IP address)	IN (0x0001)
Jul 20, 2022 17:51:41.309281111 CEST	8.8.8.8	192.168.2.4	0xe8fc	No error (0)	dual-a-0001.a-msedge.net		13.107.21.200	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:08.385657072 CEST	8.8.8.8	192.168.2.4	0xa53a	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.17.244.81	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:08.385657072 CEST	8.8.8.8	192.168.2.4	0xa53a	No error (0)	www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com		104.16.173.80	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.258260965 CEST	8.8.8.8	192.168.2.4	0x87bd	Name error (3)	ipffhg.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.308201075 CEST	8.8.8.8	192.168.2.4	0x269a	Name error (3)	uehixu.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.335342884 CEST	8.8.8.8	192.168.2.4	0xae97	Name error (3)	umdeki.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.367090940 CEST	8.8.8.8	192.168.2.4	0x9d70	Name error (3)	btstvf.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.402667046 CEST	8.8.8.8	192.168.2.4	0x74e6	Name error (3)	veadit.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.451947927 CEST	8.8.8.8	192.168.2.4	0xf68f	Name error (3)	xpokac.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.481395960 CEST	8.8.8.8	192.168.2.4	0x80e7	Name error (3)	jreavt.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.517307997 CEST	8.8.8.8	192.168.2.4	0x2b21	Name error (3)	kdbimr.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.565526009 CEST	8.8.8.8	192.168.2.4	0x551c	Name error (3)	ivhjyg.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.615561008 CEST	8.8.8.8	192.168.2.4	0x58f8	Name error (3)	fnkuzp.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.643445969 CEST	8.8.8.8	192.168.2.4	0x1755	Name error (3)	wwflce.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.676141977 CEST	8.8.8.8	192.168.2.4	0xaccd	Name error (3)	zrsyos.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.726281881 CEST	8.8.8.8	192.168.2.4	0x13da	Name error (3)	halijb.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.756714106 CEST	8.8.8.8	192.168.2.4	0xdf4e	Name error (3)	dsebsq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.792995930 CEST	8.8.8.8	192.168.2.4	0xaccc	Name error (3)	ehoouc.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.904059887 CEST	8.8.8.8	192.168.2.4	0xbaa0	Name error (3)	rhekpv.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:18.969556093 CEST	8.8.8.8	192.168.2.4	0x7a3f	Name error (3)	kxvxyi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.006818056 CEST	8.8.8.8	192.168.2.4	0x1b4e	Name error (3)	pamieb.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.046688080 CEST	8.8.8.8	192.168.2.4	0x41fc	Name error (3)	ttaxui.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.079499006 CEST	8.8.8.8	192.168.2.4	0x80c3	Name error (3)	csvfep.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.110985994 CEST	8.8.8.8	192.168.2.4	0xed20	Name error (3)	rayrbu.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.160911083 CEST	8.8.8.8	192.168.2.4	0x3e4a	Name error (3)	evcswy.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.191792965 CEST	8.8.8.8	192.168.2.4	0x31cf	Name error (3)	daufsi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.232403994 CEST	8.8.8.8	192.168.2.4	0x7248	Name error (3)	lbhuwa.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.268182993 CEST	8.8.8.8	192.168.2.4	0xfffd	Name error (3)	bxgyim.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.301373005 CEST	8.8.8.8	192.168.2.4	0x25ec	Name error (3)	odknak.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.333065987 CEST	8.8.8.8	192.168.2.4	0xeb79	Name error (3)	imeonl.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.368571997 CEST	8.8.8.8	192.168.2.4	0x7b4c	Name error (3)	ohpqsg.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.405153036 CEST	8.8.8.8	192.168.2.4	0x3c9c	Name error (3)	tqrihq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.433872938 CEST	8.8.8.8	192.168.2.4	0x6abd	Name error (3)	rybavi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.463195086 CEST	8.8.8.8	192.168.2.4	0x6c13	Name error (3)	oyiqis.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.505987883 CEST	8.8.8.8	192.168.2.4	0xc030	Name error (3)	oattpq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.553107977 CEST	8.8.8.8	192.168.2.4	0xe33	Name error (3)	ecihey.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.583656073 CEST	8.8.8.8	192.168.2.4	0x6516	Name error (3)	pjyjyp.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:19.775619030 CEST	8.8.8.8	192.168.2.4	0xf493	Name error (3)	qzemuq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:39.945770979 CEST	8.8.8.8	192.168.2.4	0x9bf8	Name error (3)	bjnyie.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:39.983746052 CEST	8.8.8.8	192.168.2.4	0xd1fd	Name error (3)	ouuquq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.029886961 CEST	8.8.8.8	192.168.2.4	0x2204	Name error (3)	hmogya.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.059593916 CEST	8.8.8.8	192.168.2.4	0x69e1	Name error (3)	gveozl.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.097301006 CEST	8.8.8.8	192.168.2.4	0x74ee	Name error (3)	cjtnlz.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.132085085 CEST	8.8.8.8	192.168.2.4	0x6f0c	Name error (3)	zjercf.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.181905985 CEST	8.8.8.8	192.168.2.4	0x25b7	Name error (3)	punodi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.232880116 CEST	8.8.8.8	192.168.2.4	0x3f8b	Name error (3)	fmghaw.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.284487963 CEST	8.8.8.8	192.168.2.4	0x4140	Name error (3)	gyrtfu.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.320353985 CEST	8.8.8.8	192.168.2.4	0x5bfe	Name error (3)	ieuydr.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.373653889 CEST	8.8.8.8	192.168.2.4	0x7f2d	Name error (3)	foefmh.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.424299955 CEST	8.8.8.8	192.168.2.4	0xdee3	Name error (3)	wdsbch.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.478235006 CEST	8.8.8.8	192.168.2.4	0x625b	Name error (3)	dlaiin.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.506979942 CEST	8.8.8.8	192.168.2.4	0x3ea9	Name error (3)	buquni.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.558136940 CEST	8.8.8.8	192.168.2.4	0x945b	Name error (3)	yyoujc.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.596235037 CEST	8.8.8.8	192.168.2.4	0x2bdd	Name error (3)	iqkpke.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.630182981 CEST	8.8.8.8	192.168.2.4	0x230a	Name error (3)	xpuiqt.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.678375959 CEST	8.8.8.8	192.168.2.4	0x1c92	Name error (3)	aqoyoy.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.716212988 CEST	8.8.8.8	192.168.2.4	0x9649	Name error (3)	fotkqb.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.753846884 CEST	8.8.8.8	192.168.2.4	0x1eab	Name error (3)	bixitk.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.804666996 CEST	8.8.8.8	192.168.2.4	0x796a	Name error (3)	oyjapg.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.915461063 CEST	8.8.8.8	192.168.2.4	0x8cc5	Name error (3)	wxqeub.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:40.979768038 CEST	8.8.8.8	192.168.2.4	0x17f5	Name error (3)	ppuoul.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.167217016 CEST	8.8.8.8	192.168.2.4	0xfa4b	Name error (3)	uuvznv.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.251645088 CEST	8.8.8.8	192.168.2.4	0x3a54	Name error (3)	ppdeuk.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.281882048 CEST	8.8.8.8	192.168.2.4	0xa7d5	Name error (3)	yupiov.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.383841038 CEST	8.8.8.8	192.168.2.4	0xb9fd	Name error (3)	eyueag.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.454515934 CEST	8.8.8.8	192.168.2.4	0x83c1	Name error (3)	ilezol.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.494239092 CEST	8.8.8.8	192.168.2.4	0xdad	Name error (3)	odkwag.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.573896885 CEST	8.8.8.8	192.168.2.4	0x25a9	Name error (3)	kvzuyb.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.625000000 CEST	8.8.8.8	192.168.2.4	0x8ed1	Name error (3)	ywhiza.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.678946972 CEST	8.8.8.8	192.168.2.4	0x80b1	Name error (3)	wzzoyp.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:54:41.718364954 CEST	8.8.8.8	192.168.2.4	0xdaa9	Name error (3)	qdauqi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:01.915558100 CEST	8.8.8.8	192.168.2.4	0x796	Name error (3)	riwegs.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:01.948951006 CEST	8.8.8.8	192.168.2.4	0x99af	Name error (3)	uyhjyx.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.058417082 CEST	8.8.8.8	192.168.2.4	0x9e39	Name error (3)	parenq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.088565111 CEST	8.8.8.8	192.168.2.4	0x4e61	Name error (3)	egzhiu.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.126056910 CEST	8.8.8.8	192.168.2.4	0x1a9d	Name error (3)	ytohqg.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.162512064 CEST	8.8.8.8	192.168.2.4	0xd8f5	Name error (3)	xnynlv.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.192738056 CEST	8.8.8.8	192.168.2.4	0x3f5c	Name error (3)	seumyy.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.220952988 CEST	8.8.8.8	192.168.2.4	0x746	Name error (3)	kkujyi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.257361889 CEST	8.8.8.8	192.168.2.4	0xddff	Name error (3)	iigysp.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.305938005 CEST	8.8.8.8	192.168.2.4	0x7214	Name error (3)	swihwi.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.334044933 CEST	8.8.8.8	192.168.2.4	0xd0c	Name error (3)	yilrau.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.441952944 CEST	8.8.8.8	192.168.2.4	0x3340	Name error (3)	bwhvdc.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.551109076 CEST	8.8.8.8	192.168.2.4	0x9024	Name error (3)	ryeofz.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.586520910 CEST	8.8.8.8	192.168.2.4	0x7c4e	Name error (3)	vscxig.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.620600939 CEST	8.8.8.8	192.168.2.4	0x553f	Name error (3)	juiape.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.660648108 CEST	8.8.8.8	192.168.2.4	0xc16f	Name error (3)	iegroa.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.690216064 CEST	8.8.8.8	192.168.2.4	0xb71e	Name error (3)	pzrdea.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.727658987 CEST	8.8.8.8	192.168.2.4	0x984c	Name error (3)	fmleqf.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.757400036 CEST	8.8.8.8	192.168.2.4	0x660d	Name error (3)	nsnpie.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.793215990 CEST	8.8.8.8	192.168.2.4	0x36d1	Name error (3)	poyvid.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.840558052 CEST	8.8.8.8	192.168.2.4	0xed3e	Name error (3)	naciyn.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.885500908 CEST	8.8.8.8	192.168.2.4	0x3443	Name error (3)	zajvof.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.931385040 CEST	8.8.8.8	192.168.2.4	0xde1e	Name error (3)	exylvw.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:02.980429888 CEST	8.8.8.8	192.168.2.4	0x8528	Name error (3)	gieomq.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:03.011116028 CEST	8.8.8.8	192.168.2.4	0x3084	Name error (3)	ryrgex.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:03.042330027 CEST	8.8.8.8	192.168.2.4	0x7c73	Name error (3)	picaiu.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:03.076562881 CEST	8.8.8.8	192.168.2.4	0xcb94	Name error (3)	iuzrbo.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:03.105895996 CEST	8.8.8.8	192.168.2.4	0x3b46	Name error (3)	pbswoe.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:03.217895985 CEST	8.8.8.8	192.168.2.4	0x5901	Name error (3)	taseju.com	none	none	A (IP address)	IN (0x0001)
Jul 20, 2022 17:55:03.264223099 CEST	8.8.8.8	192.168.2.4	0xecde	Name error (3)	eunure.com	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49756	104.16.173.80	80	C:\Windows\mssecsvc.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 17:51:12.245254993 CEST	1011	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jul 20, 2022 17:51:12.277767897 CEST	1012	IN	HTTP/1.1 200 OK Date: Wed, 20 Jul 2022 15:51:12 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 72dcdb5d9c7e9ba6-FRA Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49792	104.17.244.81	80	C:\Windows\mssecsvc.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2022 17:54:08.444561958 CEST	17314	OUT	GET / HTTP/1.1 Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Cache-Control: no-cache
Jul 20, 2022 17:54:08.478476048 CEST	17315	IN	HTTP/1.1 200 OK Date: Wed, 20 Jul 2022 15:54:08 GMT Content-Type: text/html Content-Length: 607 Connection: close Server: cloudflare CF-RAY: 72dcdfaacf3c9046-FRA Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 6272, Parent PID: 5884

General

Target ID:	0
Start time:	17:51:01
Start date:	20/07/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll"
Imagebase:	0xd90000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 6280, Parent PID: 6272

General

Target ID:	1
Start time:	17:51:02
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exePID: 6288, Parent PID: 6272

General

Target ID:	2
Start time:	17:51:03
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\FjYNZSPNkt.dll,PlayGame
Imagebase:	0xc20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exePID: 6300, Parent PID: 6280

General

Target ID:	3
Start time:	17:51:03
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",#1
Imagebase:	0xc20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: mssecsvc.exePID: 6408, Parent PID: 6300

General

Target ID:	4
Start time:	17:51:04
Start date:	20/07/2022
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3751936 bytes
MD5 hash:	D6F23DCB793C969936142BF9B4F53837
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.665288410.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.263630110.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.267296098.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.261950970.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.263749691.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.665390921.0000000000B90000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.265483719.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.265422211.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.667969815.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.663379016.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.267432086.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly) Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT) Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\mssecsvc.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 97%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: rundll32.exePID: 6420, Parent PID: 6272

General

Target ID:	5
Start time:	17:51:06
Start date:	20/07/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\FjYNZSPNkt.dll",PlayGame
Imagebase:	0xc20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: mssecsvc.exePID: 6440, Parent PID: 6420

General

Target ID:	6
Start time:	17:51:07
Start date:	20/07/2022
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe
Imagebase:	0x400000
File size:	3751936 bytes
MD5 hash:	D6F23DCB793C969936142BF9B4F53837
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000000.272335422.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.266941602.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.274690512.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000006.00000000.272255673.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000006.00000002.357943271.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
Reputation:	low

Chronological Activities

Analysis Process: winlogon.exePID: 572, Parent PID: 6408

General

Target ID:	7
Start time:	17:51:08
Start date:	20/07/2022
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff775840000
File size:	677376 bytes
MD5 hash:	F9017F2DC455AD373DF036F5817A8870
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000002.784858660.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.280733139.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.280760913.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000007.00000000.270789242.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: lsass.exePID: 612, Parent PID: 6408

General

Target ID:	9
Start time:	17:51:11
Start date:	20/07/2022
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff765a60000
File size:	57976 bytes
MD5 hash:	317340CD278A374BCEF6A30194557227
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000000.275433265.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.784832443.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.785185973.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: mssecsvc.exePID: 6580, Parent PID: 564

General

Target ID:	11
Start time:	17:51:12
Start date:	20/07/2022
Path:	C:\Windows\mssecsvc.exe
Wow64 process (32bit):	true
Commandline:	C:\WINDOWS\mssecsvc.exe -m security
Imagebase:	0x400000
File size:	3751936 bytes
MD5 hash:	D6F23DCB793C969936142BF9B4F53837
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000002.388703492.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000B.00000000.278856067.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000B.00000002.388561725.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000002.384391046.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000B.00000000.278777531.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: fontdrvhost.exePID: 708, Parent PID: 6408

General

Target ID:	12
Start time:	17:51:13
Start date:	20/07/2022
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	fontdrvhost.exe
Imagebase:	0x7ff6e3c70000
File size:	790304 bytes
MD5 hash:	31113981180E69C2773BCADA4051738A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.784858957.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000002.785409783.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.296758568.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.280492982.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000C.00000000.296737411.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: fontdrvhost.exePID: 716, Parent PID: 6408

General

Target ID:	13
Start time:	17:51:14
Start date:	20/07/2022
Path:	C:\Windows\System32\fontdrvhost.exe
Wow64 process (32bit):	false
Commandline:	fontdrvhost.exe
Imagebase:	0x7ff6e3c70000
File size:	790304 bytes
MD5 hash:	31113981180E69C2773BCADA4051738A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000002.785329108.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000002.784858398.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.283233215.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.298581179.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000D.00000000.298527592.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 6636, Parent PID: 564

General

Target ID:	14
Start time:	17:51:16
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 724, Parent PID: 6408

General

Target ID:	15
Start time:	17:51:17
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000002.784858800.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000002.785379244.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.300859546.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.290186231.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.300842077.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 804, Parent PID: 6408

General

Target ID:	16
Start time:	17:51:21
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000000.302543511.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000000.297399320.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000000.302520549.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.785307990.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.784853909.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 6744, Parent PID: 564

General

Target ID:	17
Start time:	17:51:21
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: BackgroundTransferHost.exePID: 6784, Parent PID: 804

General

Target ID:	18
Start time:	17:51:22
Start date:	20/07/2022
Path:	C:\Windows\System32\BackgroundTransferHost.exe
Wow64 process (32bit):	false
Commandline:	"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
Imagebase:	0x7ff62dce0000
File size:	36864 bytes
MD5 hash:	02BA81746B929ECC9DB6665589B68335
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 6844, Parent PID: 564

General

Target ID:	19
Start time:	17:51:22
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 6900, Parent PID: 564

General

Target ID:	20
Start time:	17:51:23
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SgrmBroker.exePID: 6972, Parent PID: 564

General

Target ID:	21
Start time:	17:51:25
Start date:	20/07/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7b2bb0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 6992, Parent PID: 564

General

Target ID:	22
Start time:	17:51:25
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 7024, Parent PID: 564

General

Target ID:	23
Start time:	17:51:26
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 852, Parent PID: 6408

General

Target ID:	24
Start time:	17:51:27
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k rpcss -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.314054124.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.785329413.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.310448882.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.784858725.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 3852, Parent PID: 564

General

Target ID:	25
Start time:	17:51:30
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 900, Parent PID: 6408

General

Target ID:	26
Start time:	17:51:31
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.319687483.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.785023367.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.319657354.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: dwm.exePID: 984, Parent PID: 6408

General

Target ID:	27
Start time:	17:51:32
Start date:	20/07/2022
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	dwm.exe
Imagebase:	0x7ff7aa950000
File size:	62464 bytes
MD5 hash:	70073A05B2B43FFB7A625708BB29E7C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.321636086.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.321813327.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000002.785061929.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.321645741.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001B.00000000.321842635.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: backgroundTaskHost.exePID: 4912, Parent PID: 612

General

Target ID:	28
Start time:	17:51:41
Start date:	20/07/2022
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca
Imagebase:	0x7ff7748d0000
File size:	19352 bytes
MD5 hash:	B7FC4A29431D4F795BBAB1FB182B759A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasksche.exePID: 3908, Parent PID: 6440

General

Target ID:	29
Start time:	17:51:44
Start date:	20/07/2022
Path:	C:\Windows\tasksche.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\tasksche.exe /i
Imagebase:	0x400000
File size:	3514368 bytes
MD5 hash:	3233ACED9279EF54267C479BBA665B90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001D.00000002.353674626.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001D.00000000.347152674.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly) Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 85%, Metadefender, Browse Detection: 95%, ReversingLabs

Chronological Activities

Analysis Process: svchost.exePID: 6288, Parent PID: 564

General

Target ID:	30
Start time:	17:51:46
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 1020, Parent PID: 6408

General

Target ID:	31
Start time:	17:52:02
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000000.384952230.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000002.785042903.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 316, Parent PID: 6408

General

Target ID:	32
Start time:	17:52:04
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000000.389181031.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000002.785080117.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 416, Parent PID: 6408

General

Target ID:	33
Start time:	17:52:06
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000000.392931300.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000002.785141452.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 948, Parent PID: 6408

General

Target ID:	34
Start time:	17:52:12
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000002.785106286.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000000.407443351.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 960, Parent PID: 6408

General

Target ID:	35
Start time:	17:52:14
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000002.785122913.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000023.00000000.411115059.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: backgroundTaskHost.exePID: 6420, Parent PID: 804

General

Target ID:	36
Start time:	17:52:19
Start date:	20/07/2022
Path:	C:\Windows\System32\backgroundTaskHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
Imagebase:	0x7ff7748d0000
File size:	19352 bytes
MD5 hash:	B7FC4A29431D4F795BBAB1FB182B759A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exePID: 1132, Parent PID: 6408

General

Target ID:	37
Start time:	17:52:22
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000000.427531330.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000025.00000002.785172242.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 1200, Parent PID: 6408

General

Target ID:	38
Start time:	17:52:24
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000000.431362516.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000002.785177108.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 1272, Parent PID: 6408

General

Target ID:	39
Start time:	17:52:25
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000027.00000000.435545169.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exePID: 6700, Parent PID: 564

General

Target ID:	40
Start time:	17:52:26
Start date:	20/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language